From 3b3a7cb1378b26dc5deeb87a7e19ca179148a4c0 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 25 Oct 2022 15:40:24 -0700 Subject: [PATCH 001/324] License update. --- .../prepare/windows-autopatch-prerequisites.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index cac236afd3..d5f7c38027 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -34,7 +34,15 @@ Windows Autopatch is included with Window 10/11 Enterprise E3 or higher (user-ba | License | ID | GUID number | | ----- | ----- | ------| | [Microsoft 365 E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E3 | 05e9a617-0261-4cee-bb44-138d3ef5d965 | +| [Microsoft 365 E3 (500 seats minimum_HUB)](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | Microsoft_365_E3 | 0c21030a-7e60-4ec7-9a0f-0042e0e0211a | +| [Microsoft 365 E3 - Unattended License](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E3_RPA1 | c2ac2ee4-9bb1-47e4-8541-d689c7e83371 | | [Microsoft 365 E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5 | 06ebc4ee-1bb5-47dd-8120-11324bc54e06 | +| [Microsoft 365 E5 (500 seats minimum)_HUB](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | Microsoft_365_E5 | db684ac5-c0e7-4f92-8284-ef9ebde75d33 | +| [Microsoft 365 E5 with calling minutes](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5_CALLINGMINUTES | a91fc4e0-65e5-4266-aa76-4037509c1626 | +| [Microsoft 365 E5 without audio conferencing](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5_NOPSTNCONF | cd2925a3-5076-4233-8931-638a8c94f773 | +| [Microsoft 365 E5 without audio conferencing (500 seats minimum)_HUB](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | Microsoft_365_E5_without_Audio_Conferencing | 2113661c-6509-4034-98bb-9c47bd28d63c | +| [TEST - Microsoft 365 E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E3_TEST | 23a55cbc-971c-4ba2-8bae-04cd13d2f4ad | +| [TEST - Microsoft 365 E5 without audio conferencing](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5_NOPSTNCONF_TEST | 1362a0d9-b3c2-4112-bf1a-7a838d181c0f | | [Windows 10/11 Enterprise E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E3 | 6a0f6da5-0b87-4190-a6ae-9bb5a2b9546a | | [Windows 10/11 Enterprise E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E5 | 488ba24a-39a9-4473-8ee5-19291e71b002 | | [Windows 10/11 Enterprise VDA](/windows/deployment/deploy-enterprise-licenses#virtual-desktop-access-vda) | E3_VDA_only | d13ef257-988a-46f3-8fce-f47484dd4550 | From 2582298d3753994269a0c0ddd848191c46fe8a6b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 1 Nov 2022 15:13:57 -0400 Subject: [PATCH 002/324] Add Defender Policy CSP --- .../mdm/policies-in-policy-csp-admx-backed.md | 4918 ++++++++++------ ...in-policy-csp-supported-by-group-policy.md | 1819 +++--- .../mdm/policy-csp-defender.md | 5150 +++++++++-------- windows/client-management/mdm/toc.yml | 1826 +++--- 4 files changed, 7610 insertions(+), 6103 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index b683f12d06..6a4bbc1496 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1,1913 +1,3029 @@ --- title: ADMX-backed policies in Policy CSP description: Learn about the ADMX-backed policies in Policy CSP. -ms.reviewer: +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft +ms.date: 11/01/2022 ms.localizationpriority: medium -ms.date: 10/08/2020 +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article --- + + # ADMX-backed policies in Policy CSP -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [ADMX_ActiveXInstallService/AxISURLZonePolicies](./policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies) -- [ADMX_AddRemovePrograms/DefaultCategory](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory) -- [ADMX_AddRemovePrograms/NoAddFromCDorFloppy](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromcdorfloppy) -- [ADMX_AddRemovePrograms/NoAddFromInternet](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfrominternet) -- [ADMX_AddRemovePrograms/NoAddFromNetwork](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromnetwork) -- [ADMX_AddRemovePrograms/NoAddPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddpage) -- [ADMX_AddRemovePrograms/NoAddRemovePrograms](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddremoveprograms) -- [ADMX_AddRemovePrograms/NoChooseProgramsPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nochooseprogramspage) -- [ADMX_AddRemovePrograms/NoRemovePage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noremovepage) -- [ADMX_AddRemovePrograms/NoServices](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noservices) -- [ADMX_AddRemovePrograms/NoSupportInfo](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nosupportinfo) -- [ADMX_AddRemovePrograms/NoWindowsSetupPage](./policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nowindowssetuppage) -- [ADMX_AdmPwd/POL_AdmPwd_DontAllowPwdExpirationBehindPolicy](./policy-csp-admx-admpwd.md#admx-admpwd-pol_admpwd_dontallowpwdexpirationbehindpolicy) -- [ADMX_AdmPwd/POL_AdmPwd_Enabled](./policy-csp-admx-admpwd.md#admx-admpwd-pol_admpwd_enabled) -- [ADMX_AdmPwd/POL_AdmPwd_AdminName](./policy-csp-admx-admpwd.md#admx-admpwd-pol_admpwd_adminname) -- [ADMX_AdmPwd/POL_AdmPwd](./policy-csp-admx-admpwd.md#admx-admpwd-pol_admpwd) -- [ADMX_AppCompat/AppCompatPrevent16BitMach](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatprevent16bitmach) -- [ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatremoveprogramcompatproppage) -- [ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffapplicationimpacttelemetry) -- [ADMX_AppCompat/AppCompatTurnOffSwitchBack](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffswitchback) -- [ADMX_AppCompat/AppCompatTurnOffEngine](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffengine) -- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_1) -- [ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant_2) -- [ADMX_AppCompat/AppCompatTurnOffUserActionRecord](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffuseractionrecord) -- [ADMX_AppCompat/AppCompatTurnOffProgramInventory](./policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprograminventory) -- [ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles](./policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles) -- [ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules) -- [ADMX_AppXRuntime/AppxRuntimeBlockFileElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) -- [ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt) -- [ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation](./policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) -- [ADMX_AttachmentManager/AM_EstimateFileHandlerRisk](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk) -- [ADMX_AttachmentManager/AM_SetFileRiskLevel](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel) -- [ADMX_AttachmentManager/AM_SetHighRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion) -- [ADMX_AttachmentManager/AM_SetLowRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion) -- [ADMX_AttachmentManager/AM_SetModRiskInclusion](./policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion) -- [ADMX_AuditSettings/IncludeCmdLine](./policy-csp-admx-auditsettings.md#admx-auditsettings-includecmdline) -- [ADMX_Bits/BITS_DisableBranchCache](./policy-csp-admx-bits.md#admx-bits-bits-disablebranchcache) -- [ADMX_Bits/BITS_DisablePeercachingClient](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingclient) -- [ADMX_Bits/BITS_DisablePeercachingServer](./policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingserver) -- [ADMX_Bits/BITS_EnablePeercaching](./policy-csp-admx-bits.md#admx-bits-bits-enablepeercaching) -- [ADMX_Bits/BITS_MaxBandwidthServedForPeers](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthservedforpeers) -- [ADMX_Bits/BITS_MaxBandwidthV2_Maintenance](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-maintenance) -- [ADMX_Bits/BITS_MaxBandwidthV2_Work](./policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-work) -- [ADMX_Bits/BITS_MaxCacheSize](./policy-csp-admx-bits.md#admx-bits-bits-maxcachesize) -- [ADMX_Bits/BITS_MaxContentAge](./policy-csp-admx-bits.md#admx-bits-bits-maxcontentage) -- [ADMX_Bits/BITS_MaxDownloadTime](./policy-csp-admx-bits.md#admx-bits-bits-maxdownloadtime) -- [ADMX_Bits/BITS_MaxFilesPerJob](./policy-csp-admx-bits.md#admx-bits-bits-maxfilesperjob) -- [ADMX_Bits/BITS_MaxJobsPerMachine](./policy-csp-admx-bits.md#admx-bits-bits-maxjobspermachine) -- [ADMX_Bits/BITS_MaxJobsPerUser](./policy-csp-admx-bits.md#admx-bits-bits-maxjobsperuser) -- [ADMX_Bits/BITS_MaxRangesPerFile](./policy-csp-admx-bits.md#admx-bits-bits-maxrangesperfile) -- [ADMX_CipherSuiteOrder/SSLCipherSuiteOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslciphersuiteorder) -- [ADMX_CipherSuiteOrder/SSLCurveOrder](./policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslcurveorder) -- [ADMX_COM/AppMgmt_COM_SearchForCLSID_1](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1) -- [ADMX_COM/AppMgmt_COM_SearchForCLSID_2](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2) -- [ADMX_ControlPanel/DisallowCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls) -- [ADMX_ControlPanel/ForceClassicControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel) -- [ADMX_ControlPanel/NoControlPanel](./policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel) -- [ADMX_ControlPanel/RestrictCpls](./policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls) -- [ADMX_ControlPanelDisplay/CPL_Display_Disable](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable) -- [ADMX_ControlPanelDisplay/CPL_Display_HideSettings](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings) -- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice) -- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange) -- [ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle) -- [ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver) -- [ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen) -- [ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui) -- [ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui) -- [ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors) -- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure) -- [ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout) -- [ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver) -- [ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) -- [ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle) -- [ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground](./policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground) -- [ADMX_Cpls/UseDefaultTile](./policy-csp-admx-cpls.md#admx-cpls-usedefaulttile) -- [ADMX_CredentialProviders/AllowDomainDelayLock](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock) -- [ADMX_CredentialProviders/DefaultCredentialProvider](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider) -- [ADMX_CredentialProviders/ExcludedCredentialProviders](./policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders) -- [ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly) -- [ADMX_CredSsp/AllowDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials) -- [ADMX_CredSsp/AllowEncryptionOracle](./policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle) -- [ADMX_CredSsp/AllowFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentials) -- [ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentialswhenntlmonly) -- [ADMX_CredSsp/AllowSavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentials) -- [ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentialswhenntlmonly) -- [ADMX_CredSsp/DenyDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-denydefaultcredentials) -- [ADMX_CredSsp/DenyFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials) -- [ADMX_CredSsp/DenySavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials) -- [ADMX_CredSsp/RestrictedRemoteAdministration](./policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration) -- [ADMX_CredUI/EnableSecureCredentialPrompting](./policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting) -- [ADMX_CredUI/NoLocalPasswordResetQuestions](./policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions) -- [ADMX_CtrlAltDel/DisableChangePassword](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword) -- [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) -- [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) -- [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) -- [ADMX_DataCollection/CommercialIdPolicy](./policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) -- [ADMX_DCOM/DCOMActivationSecurityCheckAllowLocalList](./policy-csp-admx-dcom.md#admx-dcom-dcomactivationsecuritycheckallowlocallist) -- [ADMX_DCOM/DCOMActivationSecurityCheckExemptionList](./policy-csp-admx-dcom.md#admx-dcom-dcomactivationsecuritycheckexemptionlist) -- [ADMX_Desktop/AD_EnableFilter](./policy-csp-admx-desktop.md#admx-desktop-ad-enablefilter) -- [ADMX_Desktop/AD_HideDirectoryFolder](./policy-csp-admx-desktop.md#admx-desktop-ad-hidedirectoryfolder) -- [ADMX_Desktop/AD_QueryLimit](./policy-csp-admx-desktop.md#admx-desktop-ad-querylimit) -- [ADMX_Desktop/ForceActiveDesktopOn](./policy-csp-admx-desktop.md#admx-desktop-forceactivedesktopon) -- [ADMX_Desktop/NoActiveDesktop](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktop) -- [ADMX_Desktop/NoActiveDesktopChanges](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktopchanges) -- [ADMX_Desktop/NoDesktop](./policy-csp-admx-desktop.md#admx-desktop-nodesktop) -- [ADMX_Desktop/NoDesktopCleanupWizard](./policy-csp-admx-desktop.md#admx-desktop-nodesktopcleanupwizard) -- [ADMX_Desktop/NoInternetIcon](./policy-csp-admx-desktop.md#admx-desktop-nointerneticon) -- [ADMX_Desktop/NoMyComputerIcon](./policy-csp-admx-desktop.md#admx-desktop-nomycomputericon) -- [ADMX_Desktop/NoMyDocumentsIcon](./policy-csp-admx-desktop.md#admx-desktop-nomydocumentsicon) -- [ADMX_Desktop/NoNetHood](./policy-csp-admx-desktop.md#admx-desktop-nonethood) -- [ADMX_Desktop/NoPropertiesMyComputer](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmycomputer) -- [ADMX_Desktop/NoPropertiesMyDocuments](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmydocuments) -- [ADMX_Desktop/NoRecentDocsNetHood](./policy-csp-admx-desktop.md#admx-desktop-norecentdocsnethood) -- [ADMX_Desktop/NoRecycleBinIcon](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinicon) -- [ADMX_Desktop/NoRecycleBinProperties](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinproperties) -- [ADMX_Desktop/NoSaveSettings](./policy-csp-admx-desktop.md#admx-desktop-nosavesettings) -- [ADMX_Desktop/NoWindowMinimizingShortcuts](./policy-csp-admx-desktop.md#admx-desktop-nowindowminimizingshortcuts) -- [ADMX_Desktop/Wallpaper](./policy-csp-admx-desktop.md#admx-desktop-wallpaper) -- [ADMX_Desktop/sz_ATC_DisableAdd](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableadd) -- [ADMX_Desktop/sz_ATC_DisableClose](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableclose) -- [ADMX_Desktop/sz_ATC_DisableDel](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disabledel) -- [ADMX_Desktop/sz_ATC_DisableEdit](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableedit) -- [ADMX_Desktop/sz_ATC_NoComponents](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-nocomponents) -- [ADMX_Desktop/sz_AdminComponents_Title](./policy-csp-admx-desktop.md#admx-desktop-sz-admincomponents-title) -- [ADMX_Desktop/sz_DB_DragDropClose](./policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) -- [ADMX_Desktop/sz_DB_Moving](./policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) -- [ADMX_Desktop/sz_DWP_NoHTMLPaper](./policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) -- [ADMX_DeviceCompat/DeviceFlags](./policy-csp-admx-devicecompat.md#admx-devicecompat-deviceflags) -- [ADMX_DeviceCompat/DriverShims](./policy-csp-admx-devicecompat.md#admx-devicecompat-drivershims) -- [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) -- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) -- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) -- [ADMX_DeviceInstallation/DeviceInstall_InstallTimeout](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) -- [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) -- [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) -- [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) -- [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) -- [ADMX_DeviceGuard/ConfigCIPolicy](./policy-csp-admx-deviceguard.md#admx-deviceguard-configcipolicy) -- [ADMX_DeviceSetup/DeviceInstall_BalloonTips](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) -- [ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) -- [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) -- [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) -- [ADMX_DiskNVCache/BootResumePolicy](./policy-csp-admx-disknvcache.md#admx-disknvcache-bootresumepolicy) -- [ADMX_DiskNVCache/FeatureOffPolicy](./policy-csp-admx-disknvcache.md#admx-disknvcache-featureoffpolicy) -- [ADMX_DiskNVCache/SolidStatePolicy](./policy-csp-admx-disknvcache.md#admx-disknvcache-solidstatepolicy) -- [ADMX_DiskQuota/DQ_RemovableMedia](./policy-csp-admx-diskquota.md#admx-diskquota-dq_removablemedia) -- [ADMX_DiskQuota/DQ_Enable](./policy-csp-admx-diskquota.md#admx-diskquota-dq_enable) -- [ADMX_DiskQuota/DQ_Enforce](./policy-csp-admx-diskquota.md#admx-diskquota-dq_enforce) -- [ADMX_DiskQuota/DQ_LogEventOverLimit](./policy-csp-admx-diskquota.md#admx-diskquota-dq_logeventoverlimit) -- [ADMX_DiskQuota/DQ_LogEventOverThreshold](./policy-csp-admx-diskquota.md#admx-diskquota-dq_logeventoverthreshold) -- [ADMX_DiskQuota/DQ_Limit](./policy-csp-admx-diskquota.md#admx-diskquota-dq_limit) -- [ADMX_DistributedLinkTracking/DLT_AllowDomainMode](./policy-csp-admx-distributedlinktracking.md#admx-distributedlinktracking-dlt_allowdomainmode) -- [ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) -- [ADMX_DnsClient/DNS_AppendToMultiLabelName](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-appendtomultilabelname) -- [ADMX_DnsClient/DNS_Domain](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domain) -- [ADMX_DnsClient/DNS_DomainNameDevolutionLevel](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domainnamedevolutionlevel) -- [ADMX_DnsClient/DNS_IdnEncoding](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnencoding) -- [ADMX_DnsClient/DNS_IdnMapping](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnmapping) -- [ADMX_DnsClient/DNS_NameServer](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-nameserver) -- [ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-preferlocalresponsesoverlowerorderdns) -- [ADMX_DnsClient/DNS_PrimaryDnsSuffix](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-primarydnssuffix) -- [ADMX_DnsClient/DNS_RegisterAdapterName](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registeradaptername) -- [ADMX_DnsClient/DNS_RegisterReverseLookup](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registerreverselookup) -- [ADMX_DnsClient/DNS_RegistrationEnabled](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationenabled) -- [ADMX_DnsClient/DNS_RegistrationOverwritesInConflict](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationoverwritesinconflict) -- [ADMX_DnsClient/DNS_RegistrationRefreshInterval](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationrefreshinterval) -- [ADMX_DnsClient/DNS_RegistrationTtl](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationttl) -- [ADMX_DnsClient/DNS_SearchList](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-searchlist) -- [ADMX_DnsClient/DNS_SmartMultiHomedNameResolution](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartmultihomednameresolution) -- [ADMX_DnsClient/DNS_SmartProtocolReorder](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartprotocolreorder) -- [ADMX_DnsClient/DNS_UpdateSecurityLevel](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatesecuritylevel) -- [ADMX_DnsClient/DNS_UpdateTopLevelDomainZones](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatetopleveldomainzones) -- [ADMX_DnsClient/DNS_UseDomainNameDevolution](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-usedomainnamedevolution) -- [ADMX_DnsClient/Turn_Off_Multicast](./policy-csp-admx-dnsclient.md#admx-dnsclient-turn-off-multicast) -- [ADMX_DFS/DFSDiscoverDC](./policy-csp-admx-dfs.md#admx-dfs-dfsdiscoverdc) -- [ADMX_DWM/DwmDefaultColorizationColor_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-1) -- [ADMX_DWM/DwmDefaultColorizationColor_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-2) -- [ADMX_DWM/DwmDisallowAnimations_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-1) -- [ADMX_DWM/DwmDisallowAnimations_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-2) -- [ADMX_DWM/DwmDisallowColorizationColorChanges_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-1) -- [ADMX_DWM/DwmDisallowColorizationColorChanges_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-2) -- [ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](./policy-csp-admx-eaime.md#admx-eaime-l-donotincludenonpublishingstandardglyphinthecandidatelist) -- [ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion](./policy-csp-admx-eaime.md#admx-eaime-l-restrictcharactercoderangeofconversion) -- [ADMX_EAIME/L_TurnOffCustomDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffcustomdictionary) -- [ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffhistorybasedpredictiveinput) -- [ADMX_EAIME/L_TurnOffInternetSearchIntegration](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffinternetsearchintegration) -- [ADMX_EAIME/L_TurnOffOpenExtendedDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffopenextendeddictionary) -- [ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffsavingautotuningdatatofile) -- [ADMX_EAIME/L_TurnOnCloudCandidate](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidate) -- [ADMX_EAIME/L_TurnOnCloudCandidateCHS](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidatechs) -- [ADMX_EAIME/L_TurnOnLexiconUpdate](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlexiconupdate) -- [ADMX_EAIME/L_TurnOnLiveStickers](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) -- [ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport](./policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) -- [ADMX_EventLogging/EnableProtectedEventLogging](./policy-csp-admx-eventlogging.md#admx-eventlogging-enableprotectedeventlogging) -- [ADMX_EncryptFilesonMove/NoEncryptOnMove](./policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) -- [ADMX_EnhancedStorage/ApprovedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedenstordevices) -- [ADMX_EnhancedStorage/ApprovedSilos](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedsilos) -- [ADMX_EnhancedStorage/DisablePasswordAuthentication](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disablepasswordauthentication) -- [ADMX_EnhancedStorage/DisallowLegacyDiskDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) -- [ADMX_EnhancedStorage/LockDeviceOnMachineLock](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) -- [ADMX_EnhancedStorage/RootHubConnectedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) -- [ADMX_ErrorReporting/PCH_AllOrNoneDef](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornonedef) -- [ADMX_ErrorReporting/PCH_AllOrNoneEx](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneex) -- [ADMX_ErrorReporting/PCH_AllOrNoneInc](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneinc) -- [ADMX_ErrorReporting/PCH_ConfigureReport](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-configurereport) -- [ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-reportoperatingsystemfaults) -- [ADMX_ErrorReporting/WerArchive_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-1) -- [ADMX_ErrorReporting/WerArchive_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-2) -- [ADMX_ErrorReporting/WerAutoApproveOSDumps_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-1) -- [ADMX_ErrorReporting/WerAutoApproveOSDumps_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-2) -- [ADMX_ErrorReporting/WerBypassDataThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-1) -- [ADMX_ErrorReporting/WerBypassDataThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-2) -- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-1) -- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-2) -- [ADMX_ErrorReporting/WerBypassPowerThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-1) -- [ADMX_ErrorReporting/WerBypassPowerThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-2) -- [ADMX_ErrorReporting/WerCER](./policy-csp-admx-errorreporting.md#admx-errorreporting-wercer) -- [ADMX_ErrorReporting/WerConsentCustomize_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentcustomize-1) -- [ADMX_ErrorReporting/WerConsentOverride_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-1) -- [ADMX_ErrorReporting/WerConsentOverride_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-2) -- [ADMX_ErrorReporting/WerDefaultConsent_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-1) -- [ADMX_ErrorReporting/WerDefaultConsent_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-2) -- [ADMX_ErrorReporting/WerDisable_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdisable-1) -- [ADMX_ErrorReporting/WerExlusion_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-1) -- [ADMX_ErrorReporting/WerExlusion_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-2) -- [ADMX_ErrorReporting/WerNoLogging_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-1) -- [ADMX_ErrorReporting/WerNoLogging_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-2) -- [ADMX_ErrorReporting/WerNoSecondLevelData_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernosecondleveldata-1) -- [ADMX_ErrorReporting/WerQueue_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-1) -- [ADMX_ErrorReporting/WerQueue_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) -- [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) -- [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) -- [ADMX_EventLog/Channel_LogEnabled](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logenabled) -- [ADMX_EventLog/Channel_LogFilePath_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-1) -- [ADMX_EventLog/Channel_LogFilePath_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-2) -- [ADMX_EventLog/Channel_LogFilePath_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-3) -- [ADMX_EventLog/Channel_LogFilePath_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-4) -- [ADMX_EventLog/Channel_LogMaxSize_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logmaxsize-3) -- [ADMX_EventLog/Channel_Log_AutoBackup_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-1) -- [ADMX_EventLog/Channel_Log_AutoBackup_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-2) -- [ADMX_EventLog/Channel_Log_AutoBackup_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-3) -- [ADMX_EventLog/Channel_Log_AutoBackup_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-4) -- [ADMX_EventLog/Channel_Log_FileLogAccess_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-1) -- [ADMX_EventLog/Channel_Log_FileLogAccess_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-2) -- [ADMX_EventLog/Channel_Log_FileLogAccess_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-3) -- [ADMX_EventLog/Channel_Log_FileLogAccess_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-4) -- [ADMX_EventLog/Channel_Log_FileLogAccess_5](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-5) -- [ADMX_EventLog/Channel_Log_FileLogAccess_6](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-6) -- [ADMX_EventLog/Channel_Log_FileLogAccess_7](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-7) -- [ADMX_EventLog/Channel_Log_FileLogAccess_8](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-8) -- [ADMX_EventLog/Channel_Log_Retention_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-2) -- [ADMX_EventLog/Channel_Log_Retention_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-3) -- [ADMX_EventLog/Channel_Log_Retention_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-4) -- [ADMX_EventViewer/EventViewer_RedirectionProgram](./policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer_redirectionprogram) -- [ADMX_EventViewer/EventViewer_RedirectionProgramCommandLineParameters](./policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer_redirectionprogramcommandlineparameters) -- [ADMX_EventViewer/EventViewer_RedirectionURL](./policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer_redirectionurl) -- [ADMX_Explorer/AdminInfoUrl](./policy-csp-admx-explorer.md#admx-explorer-admininfourl) -- [ADMX_Explorer/AlwaysShowClassicMenu](./policy-csp-admx-explorer.md#admx-explorer-alwaysshowclassicmenu) -- [ADMX_Explorer/DisableRoamedProfileInit](./policy-csp-admx-explorer.md#admx-explorer-disableroamedprofileinit) -- [ADMX_Explorer/PreventItemCreationInUsersFilesFolder](./policy-csp-admx-explorer.md#admx-explorer-preventitemcreationinusersfilesfolder) -- [ADMX_Explorer/TurnOffSPIAnimations](./policy-csp-admx-explorer.md#admx-explorer-turnoffspianimations) -- [ADMX_ExternalBoot/PortableOperatingSystem_Hibernate](./policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem_hibernate) -- [ADMX_ExternalBoot/PortableOperatingSystem_Sleep](./policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem_sleep) -- [ADMX_ExternalBoot/PortableOperatingSystem_Launcher](./policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem_launcher) -- [ADMX_FileRecovery/WdiScenarioExecutionPolicy](./policy-csp-admx-filerecovery.md#admx-filerecovery-wdiscenarioexecutionpolicy) -- [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) -- [ADMX_FileSys/DisableCompression](./policy-csp-admx-filesys.md#admx-filesys-disablecompression) -- [ADMX_FileSys/DisableDeleteNotification](./policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) -- [ADMX_FileSys/DisableEncryption](./policy-csp-admx-filesys.md#admx-filesys-disableencryption) -- [ADMX_FileSys/EnablePagefileEncryption](./policy-csp-admx-filesys.md#admx-filesys-enablepagefileencryption) -- [ADMX_FileSys/LongPathsEnabled](./policy-csp-admx-filesys.md#admx-filesys-longpathsenabled) -- [ADMX_FileSys/ShortNameCreationSettings](./policy-csp-admx-filesys.md#admx-filesys-shortnamecreationsettings) -- [ADMX_FileSys/SymlinkEvaluation](./policy-csp-admx-filesys.md#admx-filesys-symlinkevaluation) -- [ADMX_FileSys/TxfDeprecatedFunctionality](./policy-csp-admx-filesys.md#admx-filesys-txfdeprecatedfunctionality) -- [ADMX_FileRecovery/WdiScenarioExecutionPolicy](./policy-csp-admx-filerecovery.md#admx-filerecovery-wdiscenarioexecutionpolicy) -- [ADMX_FileRevocation/DelegatedPackageFamilyNames](./policy-csp-admx-filerevocation.md#admx-filerevocation-delegatedpackagefamilynames) -- [ADMX_FolderRedirection/DisableFRAdminPin](./policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpin) -- [ADMX_FolderRedirection/DisableFRAdminPinByFolder](./policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpinbyfolder) -- [ADMX_FolderRedirection/FolderRedirectionEnableCacheRename](./policy-csp-admx-folderredirection.md#admx-folderredirection-folderredirectionenablecacherename) -- [ADMX_FolderRedirection/LocalizeXPRelativePaths_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-1) -- [ADMX_FolderRedirection/LocalizeXPRelativePaths_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) -- [ADMX_FolderRedirection/PrimaryComputer_FR_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) -- [ADMX_FolderRedirection/PrimaryComputer_FR_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) -- [ADMX_FramePanes/NoReadingPane](./policy-csp-admx-framepanes.md#admx-framepanes-noreadingpane) -- [ADMX_FramePanes/NoPreviewPane](./policy-csp-admx-framepanes.md#admx-framepanes-nopreviewpane) -- [ADMX_FTHSVC/WdiScenarioExecutionPolicy](./policy-csp-admx-fthsvc.md#admx-fthsvc-wdiscenarioexecutionpolicy) -- [ADMX_Globalization/BlockUserInputMethodsForSignIn](./policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin) -- [ADMX_Globalization/CustomLocalesNoSelect_1](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1) -- [ADMX_Globalization/CustomLocalesNoSelect_2](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2) -- [ADMX_Globalization/HideAdminOptions](./policy-csp-admx-globalization.md#admx-globalization-hideadminoptions) -- [ADMX_Globalization/HideCurrentLocation](./policy-csp-admx-globalization.md#admx-globalization-hidecurrentlocation) -- [ADMX_Globalization/HideLanguageSelection](./policy-csp-admx-globalization.md#admx-globalization-hidelanguageselection) -- [ADMX_Globalization/HideLocaleSelectAndCustomize](./policy-csp-admx-globalization.md#admx-globalization-hidelocaleselectandcustomize) -- [ADMX_Globalization/ImplicitDataCollectionOff_1](./policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-1) -- [ADMX_Globalization/ImplicitDataCollectionOff_2](./policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-2) -- [ADMX_Globalization/LocaleSystemRestrict](./policy-csp-admx-globalization.md#admx-globalization-localesystemrestrict) -- [ADMX_Globalization/LocaleUserRestrict_1](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-1) -- [ADMX_Globalization/LocaleUserRestrict_2](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-2) -- [ADMX_Globalization/LockMachineUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockmachineuilanguage) -- [ADMX_Globalization/LockUserUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockuseruilanguage) -- [ADMX_Globalization/PreventGeoIdChange_1](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-1) -- [ADMX_Globalization/PreventGeoIdChange_2](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-2) -- [ADMX_Globalization/PreventUserOverrides_1](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-1) -- [ADMX_Globalization/PreventUserOverrides_2](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-2) -- [ADMX_Globalization/RestrictUILangSelect](./policy-csp-admx-globalization.md#admx-globalization-restrictuilangselect) -- [ADMX_Globalization/TurnOffAutocorrectMisspelledWords](./policy-csp-admx-globalization.md#admx-globalization-turnoffautocorrectmisspelledwords) -- [ADMX_Globalization/TurnOffHighlightMisspelledWords](./policy-csp-admx-globalization.md#admx-globalization-turnoffhighlightmisspelledwords) -- [ADMX_Globalization/TurnOffInsertSpace](./policy-csp-admx-globalization.md#admx-globalization-turnoffinsertspace) -- [ADMX_Globalization/TurnOffOfferTextPredictions](./policy-csp-admx-globalization.md#admx-globalization-turnoffoffertextpredictions) -- [ADMX_Globalization/Y2K](./policy-csp-admx-globalization.md#admx-globalization-y2k) -- [ADMX_GroupPolicy/AllowX-ForestPolicy-and-RUP](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-allowx-forestpolicy-and-rup) -- [ADMX_GroupPolicy/CSE_AppMgmt](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-appmgmt) -- [ADMX_GroupPolicy/CSE_DiskQuota](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-diskquota) -- [ADMX_GroupPolicy/CSE_EFSRecovery](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-efsrecovery) -- [ADMX_GroupPolicy/CSE_FolderRedirection](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-folderredirection) -- [ADMX_GroupPolicy/CSE_IEM](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-iem) -- [ADMX_GroupPolicy/CSE_IPSecurity](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-ipsecurity) -- [ADMX_GroupPolicy/CSE_Registry](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-registry) -- [ADMX_GroupPolicy/CSE_Scripts](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-scripts) -- [ADMX_GroupPolicy/CSE_Security](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-security) -- [ADMX_GroupPolicy/CSE_Wired](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wired) -- [ADMX_GroupPolicy/CSE_Wireless](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wireless) -- [ADMX_GroupPolicy/CorpConnSyncWaitTime](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-corpconnsyncwaittime) -- [ADMX_GroupPolicy/DenyRsopToInteractiveUser_1](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-1) -- [ADMX_GroupPolicy/DenyRsopToInteractiveUser_2](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-2) -- [ADMX_GroupPolicy/DisableAOACProcessing](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableaoacprocessing) -- [ADMX_GroupPolicy/DisableAutoADMUpdate](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableautoadmupdate) -- [ADMX_GroupPolicy/DisableBackgroundPolicy](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablebackgroundpolicy) -- [ADMX_GroupPolicy/DisableLGPOProcessing](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablelgpoprocessing) -- [ADMX_GroupPolicy/DisableUsersFromMachGP](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableusersfrommachgp) -- [ADMX_GroupPolicy/EnableCDP](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablecdp) -- [ADMX_GroupPolicy/EnableLogonOptimization](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimization) -- [ADMX_GroupPolicy/EnableLogonOptimizationOnServerSKU](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimizationonserversku) -- [ADMX_GroupPolicy/EnableMMX](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablemmx) -- [ADMX_GroupPolicy/EnforcePoliciesOnly](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-enforcepoliciesonly) -- [ADMX_GroupPolicy/FontMitigation](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-fontmitigation) -- [ADMX_GroupPolicy/GPDCOptions](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-gpdcoptions) -- [ADMX_GroupPolicy/GPTransferRate_1](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-1) -- [ADMX_GroupPolicy/GPTransferRate_2](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-2) -- [ADMX_GroupPolicy/GroupPolicyRefreshRate](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrate) -- [ADMX_GroupPolicy/GroupPolicyRefreshRateDC](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshratedc) -- [ADMX_GroupPolicy/GroupPolicyRefreshRateUser](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrateuser) -- [ADMX_GroupPolicy/LogonScriptDelay](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-logonscriptdelay) -- [ADMX_GroupPolicy/NewGPODisplayName](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpodisplayname) -- [ADMX_GroupPolicy/NewGPOLinksDisabled](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpolinksdisabled) -- [ADMX_GroupPolicy/OnlyUseLocalAdminFiles](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-onlyuselocaladminfiles) -- [ADMX_GroupPolicy/ProcessMitigationOptions](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-processmitigationoptions) -- [ADMX_GroupPolicy/RSoPLogging](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-rsoplogging) -- [ADMX_GroupPolicy/ResetDfsClientInfoDuringRefreshPolicy](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-resetdfsclientinfoduringrefreshpolicy) -- [ADMX_GroupPolicy/SlowLinkDefaultForDirectAccess](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaultfordirectaccess) -- [ADMX_GroupPolicy/SlowlinkDefaultToAsync](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaulttoasync) -- [ADMX_GroupPolicy/SyncWaitTime](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-syncwaittime) -- [ADMX_GroupPolicy/UserPolicyMode](./policy-csp-admx-grouppolicy.md#admx-grouppolicy-userpolicymode) -- [ADMX_Help/DisableHHDEP](./policy-csp-admx-help.md#admx-help-disablehhdep) -- [ADMX_Help/HelpQualifiedRootDir_Comp](./policy-csp-admx-help.md#admx-help-helpqualifiedrootdir-comp) -- [ADMX_Help/RestrictRunFromHelp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp) -- [ADMX_Help/RestrictRunFromHelp_Comp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp-comp) -- [ADMX_HelpAndSupport/ActiveHelp](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-activehelp) -- [ADMX_HelpAndSupport/HPExplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpexplicitfeedback) -- [ADMX_HelpAndSupport/HPImplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpimplicitfeedback) -- [ADMX_HelpAndSupport/HPOnlineAssistance](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hponlineassistance) -- [ADMX_ICM/CEIPEnable](./policy-csp-admx-icm.md#admx-icm-ceipenable) -- [ADMX_ICM/CertMgr_DisableAutoRootUpdates](./policy-csp-admx-icm.md#admx-icm-certmgr-disableautorootupdates) -- [ADMX_ICM/DisableHTTPPrinting_1](./policy-csp-admx-icm.md#admx-icm-disablehttpprinting-1) -- [ADMX_ICM/DisableWebPnPDownload_1](./policy-csp-admx-icm.md#admx-icm-disablewebpnpdownload-1) -- [ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate](./policy-csp-admx-icm.md#admx-icm-driversearchplaces-dontsearchwindowsupdate) -- [ADMX_ICM/EventViewer_DisableLinks](./policy-csp-admx-icm.md#admx-icm-eventviewer-disablelinks) -- [ADMX_ICM/HSS_HeadlinesPolicy](./policy-csp-admx-icm.md#admx-icm-hss-headlinespolicy) -- [ADMX_ICM/HSS_KBSearchPolicy](./policy-csp-admx-icm.md#admx-icm-hss-kbsearchpolicy) -- [ADMX_ICM/InternetManagement_RestrictCommunication_1](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-1) -- [ADMX_ICM/InternetManagement_RestrictCommunication_2](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-2) -- [ADMX_ICM/NC_ExitOnISP](./policy-csp-admx-icm.md#admx-icm-nc-exitonisp) -- [ADMX_ICM/NC_NoRegistration](./policy-csp-admx-icm.md#admx-icm-nc-noregistration) -- [ADMX_ICM/PCH_DoNotReport](./policy-csp-admx-icm.md#admx-icm-pch-donotreport) -- [ADMX_ICM/RemoveWindowsUpdate_ICM](./policy-csp-admx-icm.md#admx-icm-removewindowsupdate-icm) -- [ADMX_ICM/SearchCompanion_DisableFileUpdates](./policy-csp-admx-icm.md#admx-icm-searchcompanion-disablefileupdates) -- [ADMX_ICM/ShellNoUseInternetOpenWith_1](./policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-1) -- [ADMX_ICM/ShellNoUseInternetOpenWith_2](./policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-2) -- [ADMX_ICM/ShellNoUseStoreOpenWith_1](./policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-1) -- [ADMX_ICM/ShellNoUseStoreOpenWith_2](./policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-2) -- [ADMX_ICM/ShellPreventWPWDownload_1](./policy-csp-admx-icm.md#admx-icm-shellpreventwpwdownload-1) -- [ADMX_ICM/ShellRemoveOrderPrints_1](./policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-1) -- [ADMX_ICM/ShellRemoveOrderPrints_2](./policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-2) -- [ADMX_ICM/ShellRemovePublishToWeb_1](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-1) -- [ADMX_ICM/ShellRemovePublishToWeb_2](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-2) -- [ADMX_ICM/WinMSG_NoInstrumentation_1](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-1) -- [ADMX_ICM/WinMSG_NoInstrumentation_2](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-2) -- [ADMX_IIS/PreventIISInstall](./policy-csp-admx-iis.md#admx-iis-preventiisinstall) -- [ADMX_iSCSI/iSCSIGeneral_RestrictAdditionalLogins](./policy-csp-admx-iscsi.md#admx-iscsi-iscsigeneral_restrictadditionallogins) -- [ADMX_iSCSI/iSCSIGeneral_ChangeIQNName](./policy-csp-admx-iscsi.md#admx-iscsi-iscsigeneral_changeiqnname) -- [ADMX_iSCSI/iSCSISecurity_ChangeCHAPSecret](./policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity_changechapsecret) -- [ADMX_kdc/CbacAndArmor](./policy-csp-admx-kdc.md#admx-kdc-cbacandarmor) -- [ADMX_kdc/ForestSearch](./policy-csp-admx-kdc.md#admx-kdc-forestsearch) -- [ADMX_kdc/PKINITFreshness](./policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness) -- [ADMX_kdc/RequestCompoundId](./policy-csp-admx-kdc.md#admx-kdc-requestcompoundid) -- [ADMX_kdc/TicketSizeThreshold](./policy-csp-admx-kdc.md#admx-kdc-ticketsizethreshold) -- [ADMX_kdc/emitlili](./policy-csp-admx-kdc.md#admx-kdc-emitlili) -- [ADMX_Kerberos/AlwaysSendCompoundId](./policy-csp-admx-kerberos.md#admx-kerberos-alwayssendcompoundid) -- [ADMX_Kerberos/DevicePKInitEnabled](./policy-csp-admx-kerberos.md#admx-kerberos-devicepkinitenabled) -- [ADMX_Kerberos/HostToRealm](./policy-csp-admx-kerberos.md#admx-kerberos-hosttorealm) -- [ADMX_Kerberos/KdcProxyDisableServerRevocationCheck](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxydisableserverrevocationcheck) -- [ADMX_Kerberos/KdcProxyServer](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxyserver) -- [ADMX_Kerberos/MitRealms](./policy-csp-admx-kerberos.md#admx-kerberos-mitrealms) -- [ADMX_Kerberos/ServerAcceptsCompound](./policy-csp-admx-kerberos.md#admx-kerberos-serveracceptscompound) -- [ADMX_Kerberos/StrictTarget](./policy-csp-admx-kerberos.md#admx-kerberos-stricttarget) -- [ADMX_LanmanServer/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-ciphersuiteorder) -- [ADMX_LanmanServer/Pol_HashPublication](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) -- [ADMX_LanmanServer/Pol_HashSupportVersion](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) -- [ADMX_LanmanServer/Pol_HonorCipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) -- [ADMX_LanmanWorkstation/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-ciphersuiteorder) -- [ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enablehandlecachingforcafiles) -- [ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enableofflinefilesforcashares) -- [ADMX_LeakDiagnostic/WdiScenarioExecutionPolicy](./policy-csp-admx-leakdiagnostic.md#admx-leakdiagnostic-wdiscenarioexecutionpolicy) -- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) -- [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) -- [ADMX_LocationProviderAdm/DisableWindowsLocationProvider_1](./policy-csp-admx-locationprovideradm.md#admx-locationprovideradm-disablewindowslocationprovider_1) -- [ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin](./policy-csp-admx-logon.md#admx-logon-blockuserfromshowingaccountdetailsonsignin) -- [ADMX_Logon/DisableAcrylicBackgroundOnLogon](./policy-csp-admx-logon.md#admx-logon-disableacrylicbackgroundonlogon) -- [ADMX_Logon/DisableExplorerRunLegacy_1](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-1) -- [ADMX_Logon/DisableExplorerRunLegacy_2](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-2) -- [ADMX_Logon/DisableExplorerRunOnceLegacy_1](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-1) -- [ADMX_Logon/DisableExplorerRunOnceLegacy_2](./policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-2) -- [ADMX_Logon/DisableStatusMessages](./policy-csp-admx-logon.md#admx-logon-disablestatusmessages) -- [ADMX_Logon/DontEnumerateConnectedUsers](./policy-csp-admx-logon.md#admx-logon-dontenumerateconnectedusers) -- [ADMX_Logon/NoWelcomeTips_1](./policy-csp-admx-logon.md#admx-logon-nowelcometips-1) -- [ADMX_Logon/NoWelcomeTips_2](./policy-csp-admx-logon.md#admx-logon-nowelcometips-2) -- [ADMX_Logon/Run_1](./policy-csp-admx-logon.md#admx-logon-run-1) -- [ADMX_Logon/Run_2](./policy-csp-admx-logon.md#admx-logon-run-2) -- [ADMX_Logon/SyncForegroundPolicy](./policy-csp-admx-logon.md#admx-logon-syncforegroundpolicy) -- [ADMX_Logon/UseOEMBackground](./policy-csp-admx-logon.md#admx-logon-useoembackground) -- [ADMX_Logon/VerboseStatus](./policy-csp-admx-logon.md#admx-logon-verbosestatus) -- [ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-allowfastservicestartup) -- [ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableantispywaredefender) -- [ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableautoexclusions) -- [ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableblockatfirstseen) -- [ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablelocaladminmerge) -- [ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablerealtimemonitoring) -- [ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableroutinelytakingaction) -- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-extensions) -- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-paths) -- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-processes) -- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions) -- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-rules) -- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications) -- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders) -- [ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation) -- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement) -- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid) -- [ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition) -- [ADMX_MicrosoftDefenderAntivirus/ProxyBypass](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxybypass) -- [ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxypacurl) -- [ADMX_MicrosoftDefenderAntivirus/ProxyServer](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxyserver) -- [ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay) -- [ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay) -- [ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-randomizescheduletasktimes) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring) -- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection) -- [ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime) -- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduleday) -- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduletime) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_Disablegenericreports](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disablegenericreports) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents) -- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracinglevel) -- [ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-allowpause) -- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxdepth) -- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxsize) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablearchivescanning) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableemailscanning) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableheuristics) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablepackedexescanning) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablerestorepoint) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan) -- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles) -- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor) -- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters) -- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday) -- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime) -- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime) -- [ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-lowcpupriority) -- [ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup) -- [ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay) -- [ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-quickscaninterval) -- [ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scanonlyifidle) -- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduleday) -- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduletime) -- [ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-servicekeepalive) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduleday) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduletime) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval) -- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup) -- [ADMX_MicrosoftDefenderAntivirus/SpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynetreporting) -- [ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting) -- [ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-threats-threatiddefaultaction) -- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring) -- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress) -- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification) -- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-uilockdown) -- [ADMX_MMC/MMC_ActiveXControl](./policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) -- [ADMX_MMC/MMC_ExtendView](./policy-csp-admx-mmc.md#admx-mmc-mmc-extendview) -- [ADMX_MMC/MMC_LinkToWeb](./policy-csp-admx-mmc.md#admx-mmc-mmc-linktoweb) -- [ADMX_MMC/MMC_Restrict_Author](./policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-author) -- [ADMX_MMC/MMC_Restrict_To_Permitted_Snapins](./policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-to-permitted-snapins) -- [ADMX_MMCSnapins/MMC_ADMComputers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-1) -- [ADMX_MMCSnapins/MMC_ADMComputers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-2) -- [ADMX_MMCSnapins/MMC_ADMUsers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-1) -- [ADMX_MMCSnapins/MMC_ADMUsers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-2) -- [ADMX_MMCSnapins/MMC_ADSI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-adsi) -- [ADMX_MMCSnapins/MMC_ActiveDirDomTrusts](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirdomtrusts) -- [ADMX_MMCSnapins/MMC_ActiveDirSitesServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirsitesservices) -- [ADMX_MMCSnapins/MMC_ActiveDirUsersComp](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activediruserscomp) -- [ADMX_MMCSnapins/MMC_AppleTalkRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-appletalkrouting) -- [ADMX_MMCSnapins/MMC_AuthMan](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-authman) -- [ADMX_MMCSnapins/MMC_CertAuth](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauth) -- [ADMX_MMCSnapins/MMC_CertAuthPolSet](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauthpolset) -- [ADMX_MMCSnapins/MMC_Certs](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certs) -- [ADMX_MMCSnapins/MMC_CertsTemplate](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certstemplate) -- [ADMX_MMCSnapins/MMC_ComponentServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-componentservices) -- [ADMX_MMCSnapins/MMC_ComputerManagement](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-computermanagement) -- [ADMX_MMCSnapins/MMC_ConnectionSharingNAT](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-connectionsharingnat) -- [ADMX_MMCSnapins/MMC_DCOMCFG](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dcomcfg) -- [ADMX_MMCSnapins/MMC_DFS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dfs) -- [ADMX_MMCSnapins/MMC_DHCPRelayMgmt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dhcprelaymgmt) -- [ADMX_MMCSnapins/MMC_DeviceManager_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-1) -- [ADMX_MMCSnapins/MMC_DeviceManager_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-2) -- [ADMX_MMCSnapins/MMC_DiskDefrag](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskdefrag) -- [ADMX_MMCSnapins/MMC_DiskMgmt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskmgmt) -- [ADMX_MMCSnapins/MMC_EnterprisePKI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-enterprisepki) -- [ADMX_MMCSnapins/MMC_EventViewer_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-1) -- [ADMX_MMCSnapins/MMC_EventViewer_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-2) -- [ADMX_MMCSnapins/MMC_EventViewer_3](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-3) -- [ADMX_MMCSnapins/MMC_EventViewer_4](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-4) -- [ADMX_MMCSnapins/MMC_FAXService](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-faxservice) -- [ADMX_MMCSnapins/MMC_FailoverClusters](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-failoverclusters) -- [ADMX_MMCSnapins/MMC_FolderRedirection_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-1) -- [ADMX_MMCSnapins/MMC_FolderRedirection_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-2) -- [ADMX_MMCSnapins/MMC_FrontPageExt](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-frontpageext) -- [ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicymanagementsnapin) -- [ADMX_MMCSnapins/MMC_GroupPolicySnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicysnapin) -- [ADMX_MMCSnapins/MMC_GroupPolicyTab](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicytab) -- [ADMX_MMCSnapins/MMC_HRA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-hra) -- [ADMX_MMCSnapins/MMC_IAS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ias) -- [ADMX_MMCSnapins/MMC_IASLogging](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iaslogging) -- [ADMX_MMCSnapins/MMC_IEMaintenance_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-1) -- [ADMX_MMCSnapins/MMC_IEMaintenance_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-2) -- [ADMX_MMCSnapins/MMC_IGMPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-igmprouting) -- [ADMX_MMCSnapins/MMC_IIS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iis) -- [ADMX_MMCSnapins/MMC_IPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iprouting) -- [ADMX_MMCSnapins/MMC_IPSecManage_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage-gp) -- [ADMX_MMCSnapins/MMC_IPXRIPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxriprouting) -- [ADMX_MMCSnapins/MMC_IPXRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxrouting) -- [ADMX_MMCSnapins/MMC_IPXSAPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxsaprouting) -- [ADMX_MMCSnapins/MMC_IndexingService](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-indexingservice) -- [ADMX_MMCSnapins/MMC_IpSecManage](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage) -- [ADMX_MMCSnapins/MMC_IpSecMonitor](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmonitor) -- [ADMX_MMCSnapins/MMC_LocalUsersGroups](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-localusersgroups) -- [ADMX_MMCSnapins/MMC_LogicalMappedDrives](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-logicalmappeddrives) -- [ADMX_MMCSnapins/MMC_NPSUI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-npsui) -- [ADMX_MMCSnapins/MMC_NapSnap](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap) -- [ADMX_MMCSnapins/MMC_NapSnap_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap-gp) -- [ADMX_MMCSnapins/MMC_Net_Framework](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-net-framework) -- [ADMX_MMCSnapins/MMC_OCSP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ocsp) -- [ADMX_MMCSnapins/MMC_OSPFRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ospfrouting) -- [ADMX_MMCSnapins/MMC_PerfLogsAlerts](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-perflogsalerts) -- [ADMX_MMCSnapins/MMC_PublicKey](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-publickey) -- [ADMX_MMCSnapins/MMC_QoSAdmission](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-qosadmission) -- [ADMX_MMCSnapins/MMC_RAS_DialinUser](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ras-dialinuser) -- [ADMX_MMCSnapins/MMC_RIPRouting](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-riprouting) -- [ADMX_MMCSnapins/MMC_RIS](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ris) -- [ADMX_MMCSnapins/MMC_RRA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rra) -- [ADMX_MMCSnapins/MMC_RSM](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rsm) -- [ADMX_MMCSnapins/MMC_RemStore](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remstore) -- [ADMX_MMCSnapins/MMC_RemoteAccess](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remoteaccess) -- [ADMX_MMCSnapins/MMC_RemoteDesktop](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remotedesktop) -- [ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-resultantsetofpolicysnapin) -- [ADMX_MMCSnapins/MMC_Routing](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-routing) -- [ADMX_MMCSnapins/MMC_SCA](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sca) -- [ADMX_MMCSnapins/MMC_SMTPProtocol](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-smtpprotocol) -- [ADMX_MMCSnapins/MMC_SNMP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-snmp) -- [ADMX_MMCSnapins/MMC_ScriptsMachine_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-1) -- [ADMX_MMCSnapins/MMC_ScriptsMachine_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-2) -- [ADMX_MMCSnapins/MMC_ScriptsUser_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-1) -- [ADMX_MMCSnapins/MMC_ScriptsUser_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-2) -- [ADMX_MMCSnapins/MMC_SecuritySettings_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-1) -- [ADMX_MMCSnapins/MMC_SecuritySettings_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-2) -- [ADMX_MMCSnapins/MMC_SecurityTemplates](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitytemplates) -- [ADMX_MMCSnapins/MMC_SendConsoleMessage](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sendconsolemessage) -- [ADMX_MMCSnapins/MMC_ServerManager](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servermanager) -- [ADMX_MMCSnapins/MMC_ServiceDependencies](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servicedependencies) -- [ADMX_MMCSnapins/MMC_Services](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-services) -- [ADMX_MMCSnapins/MMC_SharedFolders](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders) -- [ADMX_MMCSnapins/MMC_SharedFolders_Ext](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders-ext) -- [ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-1) -- [ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-2) -- [ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-1) -- [ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-2) -- [ADMX_MMCSnapins/MMC_SysInfo](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysinfo) -- [ADMX_MMCSnapins/MMC_SysProp](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysprop) -- [ADMX_MMCSnapins/MMC_TPMManagement](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-tpmmanagement) -- [ADMX_MMCSnapins/MMC_Telephony](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-telephony) -- [ADMX_MMCSnapins/MMC_TerminalServices](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-terminalservices) -- [ADMX_MMCSnapins/MMC_WMI](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wmi) -- [ADMX_MMCSnapins/MMC_WindowsFirewall](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall) -- [ADMX_MMCSnapins/MMC_WindowsFirewall_GP](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall-gp) -- [ADMX_MMCSnapins/MMC_WiredNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirednetworkpolicy) -- [ADMX_MMCSnapins/MMC_WirelessMon](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessmon) -- [ADMX_MMCSnapins/MMC_WirelessNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessnetworkpolicy) -- [ADMX_MobilePCMobilityCenter/MobilityCenterEnable_1](./policy-csp-admx-mobilepcmobilitycenter.md#admx-mobilepcmobilitycenter-mobilitycenterenable_1) -- [ADMX_MobilePCMobilityCenter/MobilityCenterEnable_2](./policy-csp-admx-mobilepcmobilitycenter.md#admx-mobilepcmobilitycenter-mobilitycenterenable_2) -- [ADMX_MobilePCPresentationSettings/PresentationSettingsEnable_1](./policy-csp-admx-mobilepcpresentationsettings.md#admx-mobilepcpresentationsettings-presentationsettingsenable_1) -- [ADMX_MobilePCPresentationSettings/PresentationSettingsEnable_2](./policy-csp-admx-mobilepcpresentationsettings.md#admx-mobilepcpresentationsettings-presentationsettingsenable_2) -- [ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine](./policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) -- [ADMX_msched/ActivationBoundaryPolicy](./policy-csp-admx-msched.md#admx-msched-activationboundarypolicy) -- [ADMX_msched/RandomDelayPolicy](./policy-csp-admx-msched.md#admx-msched-randomdelaypolicy) -- [ADMX_MSDT/MsdtSupportProvider](./policy-csp-admx-msdt.md#admx-msdt-msdtsupportprovider) -- [ADMX_MSDT/MsdtToolDownloadPolicy](./policy-csp-admx-msdt.md#admx-msdt-msdttooldownloadpolicy) -- [ADMX_MSDT/WdiScenarioExecutionPolicy](./policy-csp-admx-msdt.md#admx-msdt-wdiscenarioexecutionpolicy) -- [ADMX_MSI/AllowLockdownBrowse](./policy-csp-admx-msi.md#admx-msi-allowlockdownbrowse) -- [ADMX_MSI/AllowLockdownMedia](./policy-csp-admx-msi.md#admx-msi-allowlockdownmedia) -- [ADMX_MSI/AllowLockdownPatch](./policy-csp-admx-msi.md#admx-msi-allowlockdownpatch) -- [ADMX_MSI/DisableAutomaticApplicationShutdown](./policy-csp-admx-msi.md#admx-msi-disableautomaticapplicationshutdown) -- [ADMX_MSI/DisableBrowse](./policy-csp-admx-msi.md#admx-msi-disablebrowse) -- [ADMX_MSI/DisableFlyweightPatching](./policy-csp-admx-msi.md#admx-msi-disableflyweightpatching) -- [ADMX_MSI/DisableLoggingFromPackage](./policy-csp-admx-msi.md#admx-msi-disableloggingfrompackage) -- [ADMX_MSI/DisableMSI](./policy-csp-admx-msi.md#admx-msi-disablemsi) -- [ADMX_MSI/DisableMedia](./policy-csp-admx-msi.md#admx-msi-disablemedia) -- [ADMX_MSI/DisablePatch](./policy-csp-admx-msi.md#admx-msi-disablepatch) -- [ADMX_MSI/DisableRollback_1](./policy-csp-admx-msi.md#admx-msi-disablerollback-1) -- [ADMX_MSI/DisableRollback_2](./policy-csp-admx-msi.md#admx-msi-disablerollback-2) -- [ADMX_MSI/DisableSharedComponent](./policy-csp-admx-msi.md#admx-msi-disablesharedcomponent) -- [ADMX_MSI/MSILogging](./policy-csp-admx-msi.md#admx-msi-msilogging) -- [ADMX_MSI/MSI_DisableLUAPatching](./policy-csp-admx-msi.md#admx-msi-msi-disableluapatching) -- [ADMX_MSI/MSI_DisablePatchUninstall](./policy-csp-admx-msi.md#admx-msi-msi-disablepatchuninstall) -- [ADMX_MSI/MSI_DisableSRCheckPoints](./policy-csp-admx-msi.md#admx-msi-msi-disablesrcheckpoints) -- [ADMX_MSI/MSI_DisableUserInstalls](./policy-csp-admx-msi.md#admx-msi-msi-disableuserinstalls) -- [ADMX_MSI/MSI_EnforceUpgradeComponentRules](./policy-csp-admx-msi.md#admx-msi-msi-enforceupgradecomponentrules) -- [ADMX_MSI/MSI_MaxPatchCacheSize](./policy-csp-admx-msi.md#admx-msi-msi-maxpatchcachesize) -- [ADMX_MSI/MsiDisableEmbeddedUI](./policy-csp-admx-msi.md#admx-msi-msidisableembeddedui) -- [ADMX_MSI/SafeForScripting](./policy-csp-admx-msi.md#admx-msi-safeforscripting) -- [ADMX_MSI/SearchOrder](./policy-csp-admx-msi.md#admx-msi-searchorder) -- [ADMX_MSI/TransformsSecure](./policy-csp-admx-msi.md#admx-msi-transformssecure) -- [ADMX_MsiFileRecovery/WdiScenarioExecutionPolicy](./policy-csp-admx-msifilerecovery.md#admx-msifilerecovery-wdiscenarioexecutionpolicy) -- [ADMX_nca/CorporateResources](./policy-csp-admx-nca.md#admx-nca-corporateresources) -- [ADMX_nca/CustomCommands](./policy-csp-admx-nca.md#admx-nca-customcommands) -- [ADMX_nca/DTEs](./policy-csp-admx-nca.md#admx-nca-dtes) -- [ADMX_nca/FriendlyName](./policy-csp-admx-nca.md#admx-nca-friendlyname) -- [ADMX_nca/LocalNamesOn](./policy-csp-admx-nca.md#admx-nca-localnameson) -- [ADMX_nca/PassiveMode](./policy-csp-admx-nca.md#admx-nca-passivemode) -- [ADMX_nca/ShowUI](./policy-csp-admx-nca.md#admx-nca-showui) -- [ADMX_nca/SupportEmail](./policy-csp-admx-nca.md#admx-nca-supportemail) -- [ADMX_NCSI/NCSI_CorpDnsProbeContent](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobecontent) -- [ADMX_NCSI/NCSI_CorpDnsProbeHost](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobehost) -- [ADMX_NCSI/NCSI_CorpSitePrefixes](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpsiteprefixes) -- [ADMX_NCSI/NCSI_CorpWebProbeUrl](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpwebprobeurl) -- [ADMX_NCSI/NCSI_DomainLocationDeterminationUrl](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-domainlocationdeterminationurl) -- [ADMX_NCSI/NCSI_GlobalDns](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-globaldns) -- [ADMX_NCSI/NCSI_PassivePolling](./policy-csp-admx-ncsi.md#admx-ncsi-ncsi-passivepolling) -- [ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresslookuponpingbehavior) -- [ADMX_Netlogon/Netlogon_AddressTypeReturned](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresstypereturned) -- [ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowdnssuffixsearch) -- [ADMX_Netlogon/Netlogon_AllowNT4Crypto](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allownt4crypto) -- [ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowsinglelabeldnsdomain) -- [ADMX_Netlogon/Netlogon_AutoSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-autositecoverage) -- [ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidfallbacknetbiosdiscovery) -- [ADMX_Netlogon/Netlogon_AvoidPdcOnWan](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidpdconwan) -- [ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryinitialperiod) -- [ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretrymaximumperiod) -- [ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryquittime) -- [ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundsuccessfulrefreshperiod) -- [ADMX_Netlogon/Netlogon_DebugFlag](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-debugflag) -- [ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsavoidregisterrecords) -- [ADMX_Netlogon/Netlogon_DnsRefreshInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsrefreshinterval) -- [ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnssrvrecorduselowercasehostnames) -- [ADMX_Netlogon/Netlogon_DnsTtl](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsttl) -- [ADMX_Netlogon/Netlogon_ExpectedDialupDelay](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-expecteddialupdelay) -- [ADMX_Netlogon/Netlogon_ForceRediscoveryInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-forcerediscoveryinterval) -- [ADMX_Netlogon/Netlogon_GcSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-gcsitecoverage) -- [ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ignoreincomingmailslotmessages) -- [ADMX_Netlogon/Netlogon_LdapSrvPriority](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvpriority) -- [ADMX_Netlogon/Netlogon_LdapSrvWeight](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvweight) -- [ADMX_Netlogon/Netlogon_MaximumLogFileSize](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-maximumlogfilesize) -- [ADMX_Netlogon/Netlogon_NdncSiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ndncsitecoverage) -- [ADMX_Netlogon/Netlogon_NegativeCachePeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-negativecacheperiod) -- [ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-netlogonsharecompatibilitymode) -- [ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-nonbackgroundsuccessfulrefreshperiod) -- [ADMX_Netlogon/Netlogon_PingUrgencyMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-pingurgencymode) -- [ADMX_Netlogon/Netlogon_ScavengeInterval](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-scavengeinterval) -- [ADMX_Netlogon/Netlogon_SiteCoverage](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitecoverage) -- [ADMX_Netlogon/Netlogon_SiteName](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitename) -- [ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sysvolsharecompatibilitymode) -- [ADMX_Netlogon/Netlogon_TryNextClosestSite](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-trynextclosestsite) -- [ADMX_Netlogon/Netlogon_UseDynamicDns](./policy-csp-admx-netlogon.md#admx-netlogon-netlogon-usedynamicdns) -- [ADMX_NetworkConnections/NC_AddRemoveComponents](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-addremovecomponents) -- [ADMX_NetworkConnections/NC_AdvancedSettings](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-advancedsettings) -- [ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-allowadvancedtcpipconfig) -- [ADMX_NetworkConnections/NC_ChangeBindState](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-changebindstate) -- [ADMX_NetworkConnections/NC_DeleteAllUserConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deletealluserconnection) -- [ADMX_NetworkConnections/NC_DeleteConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deleteconnection) -- [ADMX_NetworkConnections/NC_DialupPrefs](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-dialupprefs) -- [ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-donotshowlocalonlyicon) -- [ADMX_NetworkConnections/NC_EnableAdminProhibits](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-enableadminprohibits) -- [ADMX_NetworkConnections/NC_ForceTunneling](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-forcetunneling) -- [ADMX_NetworkConnections/NC_IpStateChecking](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-ipstatechecking) -- [ADMX_NetworkConnections/NC_LanChangeProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanchangeproperties) -- [ADMX_NetworkConnections/NC_LanConnect](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanconnect) -- [ADMX_NetworkConnections/NC_LanProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanproperties) -- [ADMX_NetworkConnections/NC_NewConnectionWizard](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-newconnectionwizard) -- [ADMX_NetworkConnections/NC_PersonalFirewallConfig](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-personalfirewallconfig) -- [ADMX_NetworkConnections/NC_RasAllUserProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasalluserproperties) -- [ADMX_NetworkConnections/NC_RasChangeProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-raschangeproperties) -- [ADMX_NetworkConnections/NC_RasConnect](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasconnect) -- [ADMX_NetworkConnections/NC_RasMyProperties](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasmyproperties) -- [ADMX_NetworkConnections/NC_RenameAllUserRasConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamealluserrasconnection) -- [ADMX_NetworkConnections/NC_RenameConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renameconnection) -- [ADMX_NetworkConnections/NC_RenameLanConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamelanconnection) -- [ADMX_NetworkConnections/NC_RenameMyRasConnection](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamemyrasconnection) -- [ADMX_NetworkConnections/NC_ShowSharedAccessUI](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) -- [ADMX_NetworkConnections/NC_Statistics](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) -- [ADMX_NetworkConnections/NC_StdDomainUserSetLocation](./policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) -- [ADMX_OfflineFiles/Pol_AlwaysPinSubFolders](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) -- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) -- [ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) -- [ADMX_OfflineFiles/Pol_BackgroundSyncSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-backgroundsyncsettings) -- [ADMX_OfflineFiles/Pol_CacheSize](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-cachesize) -- [ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-1) -- [ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-2) -- [ADMX_OfflineFiles/Pol_DefCacheSize](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-defcachesize) -- [ADMX_OfflineFiles/Pol_Enabled](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-enabled) -- [ADMX_OfflineFiles/Pol_EncryptOfflineFiles](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-encryptofflinefiles) -- [ADMX_OfflineFiles/Pol_EventLoggingLevel_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-1) -- [ADMX_OfflineFiles/Pol_EventLoggingLevel_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-2) -- [ADMX_OfflineFiles/Pol_ExclusionListSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-exclusionlistsettings) -- [ADMX_OfflineFiles/Pol_ExtExclusionList](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-extexclusionlist) -- [ADMX_OfflineFiles/Pol_GoOfflineAction_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-1) -- [ADMX_OfflineFiles/Pol_GoOfflineAction_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-2) -- [ADMX_OfflineFiles/Pol_NoCacheViewer_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-1) -- [ADMX_OfflineFiles/Pol_NoCacheViewer_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-2) -- [ADMX_OfflineFiles/Pol_NoConfigCache_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-1) -- [ADMX_OfflineFiles/Pol_NoConfigCache_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-2) -- [ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-1) -- [ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-2) -- [ADMX_OfflineFiles/Pol_NoPinFiles_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-1) -- [ADMX_OfflineFiles/Pol_NoPinFiles_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-2) -- [ADMX_OfflineFiles/Pol_NoReminders_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-1) -- [ADMX_OfflineFiles/Pol_NoReminders_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-2) -- [ADMX_OfflineFiles/Pol_OnlineCachingSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-onlinecachingsettings) -- [ADMX_OfflineFiles/Pol_PurgeAtLogoff](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-purgeatlogoff) -- [ADMX_OfflineFiles/Pol_QuickAdimPin](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-quickadimpin) -- [ADMX_OfflineFiles/Pol_ReminderFreq_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-1) -- [ADMX_OfflineFiles/Pol_ReminderFreq_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-2) -- [ADMX_OfflineFiles/Pol_ReminderInitTimeout_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-1) -- [ADMX_OfflineFiles/Pol_ReminderInitTimeout_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-2) -- [ADMX_OfflineFiles/Pol_ReminderTimeout_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-1) -- [ADMX_OfflineFiles/Pol_ReminderTimeout_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-2) -- [ADMX_OfflineFiles/Pol_SlowLinkSettings](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinksettings) -- [ADMX_OfflineFiles/Pol_SlowLinkSpeed](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinkspeed) -- [ADMX_OfflineFiles/Pol_SyncAtLogoff_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-1) -- [ADMX_OfflineFiles/Pol_SyncAtLogoff_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-2) -- [ADMX_OfflineFiles/Pol_SyncAtLogon_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-1) -- [ADMX_OfflineFiles/Pol_SyncAtLogon_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-2) -- [ADMX_OfflineFiles/Pol_SyncAtSuspend_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-1) -- [ADMX_OfflineFiles/Pol_SyncAtSuspend_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-2) -- [ADMX_OfflineFiles/Pol_SyncOnCostedNetwork](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-synconcostednetwork) -- [ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-1) -- [ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2](./policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-2) -- [ADMX_pca/DetectDeprecatedCOMComponentFailuresPolicy](./policy-csp-admx-pca.md#admx-pca-detectdeprecatedcomcomponentfailurespolicy) -- [ADMX_pca/DetectDeprecatedComponentFailuresPolicy](./policy-csp-admx-pca.md#admx-pca-detectdeprecatedcomponentfailurespolicy) -- [ADMX_pca/DetectInstallFailuresPolicy](./policy-csp-admx-pca.md#admx-pca-detectinstallfailurespolicy) -- [ADMX_pca/DetectUndetectedInstallersPolicy](./policy-csp-admx-pca.md#admx-pca-detectundetectedinstallerspolicy) -- [ADMX_pca/DetectUpdateFailuresPolicy](./policy-csp-admx-pca.md#admx-pca-detectupdatefailurespolicy) -- [ADMX_pca/DisablePcaUIPolicy](./policy-csp-admx-pca.md#admx-pca-disablepcauipolicy) -- [ADMX_pca/DetectBlockedDriversPolicy](./policy-csp-admx-pca.md#admx-pca-detectblockeddriverspolicy) -- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache) -- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-distributed) -- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hosted) -- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedcachediscovery) -- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedmultipleservers) -- [ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-smb) -- [ADMX_PeerToPeerCaching/SetCachePercent](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setcachepercent) -- [ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdatacacheentrymaxage) -- [ADMX_PeerToPeerCaching/SetDowngrading](./policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdowngrading) -- [ADMX_PenTraining/PenTrainingOff_1](./policy-csp-admx-pentraining.md#admx-pentraining-pentrainingoff_1) -- [ADMX_PenTraining/PenTrainingOff_2](./policy-csp-admx-pentraining.md#admx-pentraining-pentrainingoff_2) -- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-1) -- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-2) -- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-3) -- [ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4](./policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-4) -- [ADMX_Power/ACConnectivityInStandby_2](./policy-csp-admx-power.md#admx-power-acconnectivityinstandby-2) -- [ADMX_Power/ACCriticalSleepTransitionsDisable_2](./policy-csp-admx-power.md#admx-power-accriticalsleeptransitionsdisable-2) -- [ADMX_Power/ACStartMenuButtonAction_2](./policy-csp-admx-power.md#admx-power-acstartmenubuttonaction-2) -- [ADMX_Power/AllowSystemPowerRequestAC](./policy-csp-admx-power.md#admx-power-allowsystempowerrequestac) -- [ADMX_Power/AllowSystemPowerRequestDC](./policy-csp-admx-power.md#admx-power-allowsystempowerrequestdc) -- [ADMX_Power/AllowSystemSleepWithRemoteFilesOpenAC](./policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopenac) -- [ADMX_Power/AllowSystemSleepWithRemoteFilesOpenDC](./policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopendc) -- [ADMX_Power/CustomActiveSchemeOverride_2](./policy-csp-admx-power.md#admx-power-customactiveschemeoverride-2) -- [ADMX_Power/DCBatteryDischargeAction0_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargeaction0-2) -- [ADMX_Power/DCBatteryDischargeAction1_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargeaction1-2) -- [ADMX_Power/DCBatteryDischargeLevel0_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargelevel0-2) -- [ADMX_Power/DCBatteryDischargeLevel1UINotification_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1uinotification-2) -- [ADMX_Power/DCBatteryDischargeLevel1_2](./policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1-2) -- [ADMX_Power/DCConnectivityInStandby_2](./policy-csp-admx-power.md#admx-power-dcconnectivityinstandby-2) -- [ADMX_Power/DCCriticalSleepTransitionsDisable_2](./policy-csp-admx-power.md#admx-power-dccriticalsleeptransitionsdisable-2) -- [ADMX_Power/DCStartMenuButtonAction_2](./policy-csp-admx-power.md#admx-power-dcstartmenubuttonaction-2) -- [ADMX_Power/DiskACPowerDownTimeOut_2](./policy-csp-admx-power.md#admx-power-diskacpowerdowntimeout-2) -- [ADMX_Power/DiskDCPowerDownTimeOut_2](./policy-csp-admx-power.md#admx-power-diskdcpowerdowntimeout-2) -- [ADMX_Power/Dont_PowerOff_AfterShutdown](./policy-csp-admx-power.md#admx-power-dont-poweroff-aftershutdown) -- [ADMX_Power/EnableDesktopSlideShowAC](./policy-csp-admx-power.md#admx-power-enabledesktopslideshowac) -- [ADMX_Power/EnableDesktopSlideShowDC](./policy-csp-admx-power.md#admx-power-enabledesktopslideshowdc) -- [ADMX_Power/InboxActiveSchemeOverride_2](./policy-csp-admx-power.md#admx-power-inboxactiveschemeoverride-2) -- [ADMX_Power/PW_PromptPasswordOnResume](./policy-csp-admx-power.md#admx-power-pw-promptpasswordonresume) -- [ADMX_Power/PowerThrottlingTurnOff](./policy-csp-admx-power.md#admx-power-powerthrottlingturnoff) -- [ADMX_Power/ReserveBatteryNotificationLevel](./policy-csp-admx-power.md#admx-power-reservebatterynotificationlevel) -- [ADMX_PowerShellExecutionPolicy/EnableModuleLogging](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) -- [ADMX_PowerShellExecutionPolicy/EnableScripts](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) -- [ADMX_PowerShellExecutionPolicy/EnableTranscripting](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) -- [ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) -- [ADMX_PreviousVersions/DisableLocalPage_1](./policy-csp-admx-previousversions.md#admx-previousversions-disablelocalpage_1) -- [ADMX_PreviousVersions/DisableLocalPage_2](./policy-csp-admx-previousversions.md#admx-previousversions-disablelocalpage_2) -- [ADMX_PreviousVersions/DisableRemotePage_1](./policy-csp-admx-previousversions.md#admx-previousversions-disableremotepage_1) -- [ADMX_PreviousVersions/DisableRemotePage_2](./policy-csp-admx-previousversions.md#admx-previousversions-disableremotepage_2) -- [ADMX_PreviousVersions/HideBackupEntries_1](./policy-csp-admx-previousversions.md#admx-previousversions-hidebackupentries_1) -- [ADMX_PreviousVersions/HideBackupEntries_2](./policy-csp-admx-previousversions.md#admx-previousversions-hidebackupentries_2) -- [ADMX_PreviousVersions/DisableLocalRestore_1](./policy-csp-admx-previousversions.md#admx-previousversions-disablelocalrestore_1) -- [ADMX_PreviousVersions/DisableLocalRestore_2](./policy-csp-admx-previousversions.md#admx-previousversions-disablelocalrestore_2) -- [ADMX_Printing/AllowWebPrinting](./policy-csp-admx-printing.md#admx-printing-allowwebprinting) -- [ADMX_Printing/ApplicationDriverIsolation](./policy-csp-admx-printing.md#admx-printing-applicationdriverisolation) -- [ADMX_Printing/CustomizedSupportUrl](./policy-csp-admx-printing.md#admx-printing-customizedsupporturl) -- [ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate](./policy-csp-admx-printing.md#admx-printing-donotinstallcompatibledriverfromwindowsupdate) -- [ADMX_Printing/DomainPrinters](./policy-csp-admx-printing.md#admx-printing-domainprinters) -- [ADMX_Printing/DownlevelBrowse](./policy-csp-admx-printing.md#admx-printing-downlevelbrowse) -- [ADMX_Printing/EMFDespooling](./policy-csp-admx-printing.md#admx-printing-emfdespooling) -- [ADMX_Printing/ForceSoftwareRasterization](./policy-csp-admx-printing.md#admx-printing-forcesoftwarerasterization) -- [ADMX_Printing/IntranetPrintersUrl](./policy-csp-admx-printing.md#admx-printing-intranetprintersurl) -- [ADMX_Printing/KMPrintersAreBlocked](./policy-csp-admx-printing.md#admx-printing-kmprintersareblocked) -- [ADMX_Printing/LegacyDefaultPrinterMode](./policy-csp-admx-printing.md#admx-printing-legacydefaultprintermode) -- [ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS](./policy-csp-admx-printing.md#admx-printing-mxdwuselegacyoutputformatmsxps) -- [ADMX_Printing/NoDeletePrinter](./policy-csp-admx-printing.md#admx-printing-nodeleteprinter) -- [ADMX_Printing/NonDomainPrinters](./policy-csp-admx-printing.md#admx-printing-nondomainprinters) -- [ADMX_Printing/PackagePointAndPrintOnly](./policy-csp-admx-printing.md#admx-printing-packagepointandprintonly) -- [ADMX_Printing/PackagePointAndPrintOnly_Win7](./policy-csp-admx-printing.md#admx-printing-packagepointandprintonly-win7) -- [ADMX_Printing/PackagePointAndPrintServerList](./policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist) -- [ADMX_Printing/PackagePointAndPrintServerList_Win7](./policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist-win7) -- [ADMX_Printing/PhysicalLocation](./policy-csp-admx-printing.md#admx-printing-physicallocation) -- [ADMX_Printing/PhysicalLocationSupport](./policy-csp-admx-printing.md#admx-printing-physicallocationsupport) -- [ADMX_Printing/PrintDriverIsolationExecutionPolicy](./policy-csp-admx-printing.md#admx-printing-printdriverisolationexecutionpolicy -) -- [ADMX_Printing/PrintDriverIsolationOverrideCompat](./policy-csp-admx-printing.md#admx-printing-printdriverisolationoverridecompat) -- [ADMX_Printing/PrinterDirectorySearchScope](./policy-csp-admx-printing.md#admx-printing-printerdirectorysearchscope) -- [ADMX_Printing/PrinterServerThread](./policy-csp-admx-printing.md#admx-printing-printerserverthread) -- [ADMX_Printing/ShowJobTitleInEventLogs](./policy-csp-admx-printing.md#admx-printing-showjobtitleineventlogs) -- [ADMX_Printing/V4DriverDisallowPrinterExtension](./policy-csp-admx-printing.md#admx-printing-v4driverdisallowprinterextension) -- [ADMX_Printing2/AutoPublishing](./policy-csp-admx-printing2.md#admx-printing2-autopublishing) -- [ADMX_Printing2/ImmortalPrintQueue](./policy-csp-admx-printing2.md#admx-printing2-immortalprintqueue) -- [ADMX_Printing2/PruneDownlevel](./policy-csp-admx-printing2.md#admx-printing2-prunedownlevel) -- [ADMX_Printing2/PruningInterval](./policy-csp-admx-printing2.md#admx-printing2-pruninginterval) -- [ADMX_Printing2/PruningPriority](./policy-csp-admx-printing2.md#admx-printing2-pruningpriority) -- [ADMX_Printing2/PruningRetries](./policy-csp-admx-printing2.md#admx-printing2-pruningretries) -- [ADMX_Printing2/PruningRetryLog](./policy-csp-admx-printing2.md#admx-printing2-pruningretrylog) -- [ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint](./policy-csp-admx-printing2.md#admx-printing2-registerspoolerremoterpcendpoint) -- [ADMX_Printing2/VerifyPublishedState](./policy-csp-admx-printing2.md#admx-printing2-verifypublishedstate) -- [ADMX_Programs/NoDefaultPrograms](./policy-csp-admx-programs.md#admx-programs-nodefaultprograms) -- [ADMX_Programs/NoGetPrograms](./policy-csp-admx-programs.md#admx-programs-nogetprograms) -- [ADMX_Programs/NoInstalledUpdates](./policy-csp-admx-programs.md#admx-programs-noinstalledupdates) -- [ADMX_Programs/NoProgramsAndFeatures](./policy-csp-admx-programs.md#admx-programs-noprogramsandfeatures) -- [ADMX_Programs/NoProgramsCPL](./policy-csp-admx-programs.md#admx-programs-noprogramscpl) -- [ADMX_Programs/NoWindowsFeatures](./policy-csp-admx-programs.md#admx-programs-nowindowsfeatures) -- [ADMX_Programs/NoWindowsMarketplace](./policy-csp-admx-programs.md#admx-programs-nowindowsmarketplace) -- [ADMX_Reliability/EE_EnablePersistentTimeStamp](./policy-csp-admx-reliability.md#admx-reliability-ee-enablepersistenttimestamp) -- [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) -- [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) -- [ADMX_Reliability/ShutdownReason](./policy-csp-admx-reliability.md#admx-reliability-shutdownreason) -- [ADMX_RemoteAssistance/RA_EncryptedTicketOnly](./policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-encryptedticketonly) -- [ADMX_RemoteAssistance/RA_Optimize_Bandwidth](./policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-optimize-bandwidth) -- [ADMX_RemovableStorage/AccessRights_RebootTime_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-1) -- [ADMX_RemovableStorage/AccessRights_RebootTime_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-2) -- [ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyexecute-access-2) -- [ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-1) -- [ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-2) -- [ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-1) -- [ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-2) -- [ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-1) -- [ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-2) -- [ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-1) -- [ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-2) -- [ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyexecute-access-2) -- [ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-1) -- [ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-2) -- [ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-1) -- [ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-2) -- [ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyexecute-access-2) -- [ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-1) -- [ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-2) -- [ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denywrite-access-1) -- [ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-1) -- [ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-2) -- [ADMX_RemovableStorage/Removable_Remote_Allow_Access](./policy-csp-admx-removablestorage.md#admx-removablestorage-removable-remote-allow-access) -- [ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyexecute-access-2) -- [ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-1) -- [ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-2) -- [ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-1) -- [ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-2) -- [ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-1) -- [ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-2) -- [ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-1) -- [ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-2) -- [ADMX_RPC/RpcExtendedErrorInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcextendederrorinformation) -- [ADMX_RPC/RpcIgnoreDelegationFailure](./policy-csp-admx-rpc.md#admx-rpc-rpcignoredelegationfailure) -- [ADMX_RPC/RpcMinimumHttpConnectionTimeout](./policy-csp-admx-rpc.md#admx-rpc-rpcminimumhttpconnectiontimeout) -- [ADMX_RPC/RpcStateInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcstateinformation) -- [ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled](./policy-csp-admx-scripts.md#admx-scripts-allow-logon-script-netbiosdisabled) -- [ADMX_Scripts/MaxGPOScriptWaitPolicy](./policy-csp-admx-scripts.md#admx-scripts-maxgposcriptwaitpolicy) -- [ADMX_Scripts/Run_Computer_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-computer-ps-scripts-first) -- [ADMX_Scripts/Run_Legacy_Logon_Script_Hidden](./policy-csp-admx-scripts.md#admx-scripts-run-legacy-logon-script-hidden) -- [ADMX_Scripts/Run_Logoff_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-logoff-script-visible) -- [ADMX_Scripts/Run_Logon_Script_Sync_1](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-1) -- [ADMX_Scripts/Run_Logon_Script_Sync_2](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-2) -- [ADMX_Scripts/Run_Logon_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-logon-script-visible) -- [ADMX_Scripts/Run_Shutdown_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-shutdown-script-visible) -- [ADMX_Scripts/Run_Startup_Script_Sync](./policy-csp-admx-scripts.md#admx-scripts-run-startup-script-sync) -- [ADMX_Scripts/Run_Startup_Script_Visible](./policy-csp-admx-scripts.md#admx-scripts-run-startup-script-visible) -- [ADMX_Scripts/Run_User_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) -- [ADMX_sdiageng/BetterWhenConnected](./policy-csp-admx-sdiageng.md#admx-sdiageng-betterwhenconnected) -- [ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticsexecutionpolicy) -- [ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy](./policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy) -- [ADMX_sdiagschd/ScheduledDiagnosticsExecutionPolicy](./policy-csp-admx-sdiagschd.md#admx-sdiagschd-scheduleddiagnosticsexecutionpolicy) -- [ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain](./policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain) -- [ADMX_Sensors/DisableLocationScripting_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-1) -- [ADMX_Sensors/DisableLocationScripting_2](./policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-2) -- [ADMX_Sensors/DisableLocation_1](./policy-csp-admx-sensors.md#admx-sensors-disablelocation-1) -- [ADMX_Sensors/DisableSensors_1](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-1) -- [ADMX_Sensors/DisableSensors_2](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-2) -- [ADMX_ServerManager/Do_not_display_Manage_Your_Server_page](./policy-csp-admx-servermanager.md#admx-servermanager-do_not_display_manage_your_server_page) -- [ADMX_ServerManager/ServerManagerAutoRefreshRate](./policy-csp-admx-servermanager.md#admx-servermanager-servermanagerautorefreshrate) -- [ADMX_ServerManager/DoNotLaunchInitialConfigurationTasks](./policy-csp-admx-servermanager.md#admx-servermanager-donotlaunchinitialconfigurationtasks) -- [ADMX_ServerManager/DoNotLaunchServerManager](./policy-csp-admx-servermanager.md#admx-servermanager-donotlaunchservermanager) -- [ADMX_Servicing/Servicing](./policy-csp-admx-servicing.md#admx-servicing-servicing) -- [ADMX_SettingSync/DisableAppSyncSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableappsyncsettingsync) -- [ADMX_SettingSync/DisableApplicationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableapplicationsettingsync) -- [ADMX_SettingSync/DisableCredentialsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablecredentialssettingsync) -- [ADMX_SettingSync/DisableDesktopThemeSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disabledesktopthemesettingsync) -- [ADMX_SettingSync/DisablePersonalizationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablepersonalizationsettingsync) -- [ADMX_SettingSync/DisableSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablesettingsync) -- [ADMX_SettingSync/DisableStartLayoutSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablestartlayoutsettingsync) -- [ADMX_SettingSync/DisableSyncOnPaidNetwork](./policy-csp-admx-settingsync.md#admx-settingsync-disablesynconpaidnetwork) -- [ADMX_SettingSync/DisableWindowsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablewindowssettingsync) -- [ADMX_SharedFolders/PublishDfsRoots](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) -- [ADMX_SharedFolders/PublishSharedFolders](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) -- [ADMX_Sharing/NoInplaceSharing](./policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) -- [ADMX_ShellCommandPromptRegEditTools/DisallowApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) -- [ADMX_ShellCommandPromptRegEditTools/DisableRegedit](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) -- [ADMX_ShellCommandPromptRegEditTools/DisableCMD](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) -- [ADMX_ShellCommandPromptRegEditTools/RestrictApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-restrictapps) -- [ADMX_Smartcard/AllowCertificatesWithNoEKU](./policy-csp-admx-smartcard.md#admx-smartcard-allowcertificateswithnoeku) -- [ADMX_Smartcard/AllowIntegratedUnblock](./policy-csp-admx-smartcard.md#admx-smartcard-allowintegratedunblock) -- [ADMX_Smartcard/AllowSignatureOnlyKeys](./policy-csp-admx-smartcard.md#admx-smartcard-allowsignatureonlykeys) -- [ADMX_Smartcard/AllowTimeInvalidCertificates](./policy-csp-admx-smartcard.md#admx-smartcard-allowtimeinvalidcertificates) -- [ADMX_Smartcard/CertPropEnabledString](./policy-csp-admx-smartcard.md#admx-smartcard-certpropenabledstring) -- [ADMX_Smartcard/CertPropRootCleanupString](./policy-csp-admx-smartcard.md#admx-smartcard-certproprootcleanupstring) -- [ADMX_Smartcard/CertPropRootEnabledString](./policy-csp-admx-smartcard.md#admx-smartcard-certproprootenabledstring) -- [ADMX_Smartcard/DisallowPlaintextPin](./policy-csp-admx-smartcard.md#admx-smartcard-disallowplaintextpin) -- [ADMX_Smartcard/EnumerateECCCerts](./policy-csp-admx-smartcard.md#admx-smartcard-enumerateecccerts) -- [ADMX_Smartcard/FilterDuplicateCerts](./policy-csp-admx-smartcard.md#admx-smartcard-filterduplicatecerts) -- [ADMX_Smartcard/ForceReadingAllCertificates](./policy-csp-admx-smartcard.md#admx-smartcard-forcereadingallcertificates) -- [ADMX_Smartcard/IntegratedUnblockPromptString](./policy-csp-admx-smartcard.md#admx-smartcard-integratedunblockpromptstring) -- [ADMX_Smartcard/ReverseSubject](./policy-csp-admx-smartcard.md#admx-smartcard-reversesubject) -- [ADMX_Smartcard/SCPnPEnabled](./policy-csp-admx-smartcard.md#admx-smartcard-scpnpenabled) -- [ADMX_Smartcard/SCPnPNotification](./policy-csp-admx-smartcard.md#admx-smartcard-scpnpnotification) -- [ADMX_Smartcard/X509HintsNeeded](./policy-csp-admx-smartcard.md#admx-smartcard-x509hintsneeded) -- [ADMX_Snmp/SNMP_Communities](./policy-csp-admx-snmp.md#admx-snmp-snmp-communities) -- [ADMX_Snmp/SNMP_PermittedManagers](./policy-csp-admx-snmp.md#admx-snmp-snmp-permittedmanagers) -- [ADMX_Snmp/SNMP_Traps_Public](./policy-csp-admx-snmp.md#admx-snmp-snmp-traps-public) -- [ADMX_StartMenu/AddSearchInternetLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-addsearchinternetlinkinstartmenu) -- [ADMX_StartMenu/ClearRecentDocsOnExit](./policy-csp-admx-startmenu.md#admx-startmenu-clearrecentdocsonexit) -- [ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-clearrecentprogfornewuserinstartmenu) -- [ADMX_StartMenu/ClearTilesOnExit](./policy-csp-admx-startmenu.md#admx-startmenu-cleartilesonexit) -- [ADMX_StartMenu/DesktopAppsFirstInAppsView](./policy-csp-admx-startmenu.md#admx-startmenu-desktopappsfirstinappsview) -- [ADMX_StartMenu/DisableGlobalSearchOnAppsView](./policy-csp-admx-startmenu.md#admx-startmenu-disableglobalsearchonappsview) -- [ADMX_StartMenu/ForceStartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-forcestartmenulogoff) -- [ADMX_StartMenu/GoToDesktopOnSignIn](./policy-csp-admx-startmenu.md#admx-startmenu-gotodesktoponsignin) -- [ADMX_StartMenu/GreyMSIAds](./policy-csp-admx-startmenu.md#admx-startmenu-greymsiads) -- [ADMX_StartMenu/HidePowerOptions](./policy-csp-admx-startmenu.md#admx-startmenu-hidepoweroptions) -- [ADMX_StartMenu/Intellimenus](./policy-csp-admx-startmenu.md#admx-startmenu-intellimenus) -- [ADMX_StartMenu/LockTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-locktaskbar) -- [ADMX_StartMenu/MemCheckBoxInRunDlg](./policy-csp-admx-startmenu.md#admx-startmenu-memcheckboxinrundlg) -- [ADMX_StartMenu/NoAutoTrayNotify](./policy-csp-admx-startmenu.md#admx-startmenu-noautotraynotify) -- [ADMX_StartMenu/NoBalloonTip](./policy-csp-admx-startmenu.md#admx-startmenu-noballoontip) -- [ADMX_StartMenu/NoChangeStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) -- [ADMX_StartMenu/NoClose](./policy-csp-admx-startmenu.md#admx-startmenu-noclose) -- [ADMX_StartMenu/NoCommonGroups](./policy-csp-admx-startmenu.md#admx-startmenu-nocommongroups) -- [ADMX_StartMenu/NoFavoritesMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nofavoritesmenu) -- [ADMX_StartMenu/NoFind](./policy-csp-admx-startmenu.md#admx-startmenu-nofind) -- [ADMX_StartMenu/NoGamesFolderOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nogamesfolderonstartmenu) -- [ADMX_StartMenu/NoHelp](./policy-csp-admx-startmenu.md#admx-startmenu-nohelp) -- [ADMX_StartMenu/NoInstrumentation](./policy-csp-admx-startmenu.md#admx-startmenu-noinstrumentation) -- [ADMX_StartMenu/NoMoreProgramsList](./policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) -- [ADMX_StartMenu/NoNetAndDialupConnect](./policy-csp-admx-startmenu.md#admx-startmenu-nonetanddialupconnect) -- [ADMX_StartMenu/NoPinnedPrograms](./policy-csp-admx-startmenu.md#admx-startmenu-nopinnedprograms) -- [ADMX_StartMenu/NoRecentDocsMenu](./policy-csp-admx-startmenu.md#admx-startmenu-norecentdocsmenu) -- [ADMX_StartMenu/NoResolveSearch](./policy-csp-admx-startmenu.md#admx-startmenu-noresolvesearch) -- [ADMX_StartMenu/NoResolveTrack](./policy-csp-admx-startmenu.md#admx-startmenu-noresolvetrack) -- [ADMX_StartMenu/NoRun](./policy-csp-admx-startmenu.md#admx-startmenu-norun) -- [ADMX_StartMenu/NoSMConfigurePrograms](./policy-csp-admx-startmenu.md#admx-startmenu-nosmconfigureprograms) -- [ADMX_StartMenu/NoSMMyDocuments](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmydocuments) -- [ADMX_StartMenu/NoSMMyMusic](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmymusic) -- [ADMX_StartMenu/NoSMMyNetworkPlaces](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmynetworkplaces) -- [ADMX_StartMenu/NoSMMyPictures](./policy-csp-admx-startmenu.md#admx-startmenu-nosmmypictures) -- [ADMX_StartMenu/NoSearchCommInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomminstartmenu) -- [ADMX_StartMenu/NoSearchComputerLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomputerlinkinstartmenu) -- [ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearcheverywherelinkinstartmenu) -- [ADMX_StartMenu/NoSearchFilesInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchfilesinstartmenu) -- [ADMX_StartMenu/NoSearchInternetInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchinternetinstartmenu) -- [ADMX_StartMenu/NoSearchProgramsInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nosearchprogramsinstartmenu) -- [ADMX_StartMenu/NoSetFolders](./policy-csp-admx-startmenu.md#admx-startmenu-nosetfolders) -- [ADMX_StartMenu/NoSetTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) -- [ADMX_StartMenu/NoStartMenuDownload](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenudownload) -- [ADMX_StartMenu/NoStartMenuHomegroup](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuhomegroup) -- [ADMX_StartMenu/NoStartMenuRecordedTV](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenurecordedtv) -- [ADMX_StartMenu/NoStartMenuSubFolders](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenusubfolders) -- [ADMX_StartMenu/NoStartMenuVideos](./policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuvideos) -- [ADMX_StartMenu/NoStartPage](./policy-csp-admx-startmenu.md#admx-startmenu-nostartpage) -- [ADMX_StartMenu/NoTaskBarClock](./policy-csp-admx-startmenu.md#admx-startmenu-notaskbarclock) -- [ADMX_StartMenu/NoTaskGrouping](./policy-csp-admx-startmenu.md#admx-startmenu-notaskgrouping) -- [ADMX_StartMenu/NoToolbarsOnTaskbar](./policy-csp-admx-startmenu.md#admx-startmenu-notoolbarsontaskbar) -- [ADMX_StartMenu/NoTrayContextMenu](./policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) -- [ADMX_StartMenu/NoTrayItemsDisplay](./policy-csp-admx-startmenu.md#admx-startmenu-notrayitemsdisplay) -- [ADMX_StartMenu/NoUninstallFromStart](./policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) -- [ADMX_StartMenu/NoUserFolderOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nouserfolderonstartmenu) -- [ADMX_StartMenu/NoUserNameOnStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-nousernameonstartmenu) -- [ADMX_StartMenu/NoWindowsUpdate](./policy-csp-admx-startmenu.md#admx-startmenu-nowindowsupdate) -- [ADMX_StartMenu/PowerButtonAction](./policy-csp-admx-startmenu.md#admx-startmenu-powerbuttonaction) -- [ADMX_StartMenu/QuickLaunchEnabled](./policy-csp-admx-startmenu.md#admx-startmenu-quicklaunchenabled) -- [ADMX_StartMenu/RemoveUnDockPCButton](./policy-csp-admx-startmenu.md#admx-startmenu-removeundockpcbutton) -- [ADMX_StartMenu/ShowAppsViewOnStart](./policy-csp-admx-startmenu.md#admx-startmenu-showappsviewonstart) -- [ADMX_StartMenu/ShowRunAsDifferentUserInStart](./policy-csp-admx-startmenu.md#admx-startmenu-showrunasdifferentuserinstart) -- [ADMX_StartMenu/ShowRunInStartMenu](./policy-csp-admx-startmenu.md#admx-startmenu-showruninstartmenu) -- [ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey](./policy-csp-admx-startmenu.md#admx-startmenu-showstartondisplaywithforegroundonwinkey) -- [ADMX_StartMenu/StartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-startmenulogoff) -- [ADMX_StartMenu/StartPinAppsWhenInstalled](./policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) -- [ADMX_SystemRestore/SR_DisableConfig](./policy-csp-admx-systemrestore.md#admx-systemrestore-sr-disableconfig) -- [ADMX_TabletShell/DisableInkball_1](./policy-csp-admx-tabletshell.md#admx-tabletshell-disableinkball_1) -- [ADMX_TabletShell/DisableNoteWriterPrinting_1](./policy-csp-admx-tabletshell.md#admx-tabletshell-disablenotewriterprinting_1) -- [ADMX_Taskbar/DisableNotificationCenter](./policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) -- [ADMX_Taskbar/EnableLegacyBalloonNotifications](./policy-csp-admx-taskbar.md#admx-taskbar-enablelegacyballoonnotifications) -- [ADMX_Taskbar/HideSCAHealth](./policy-csp-admx-taskbar.md#admx-taskbar-hidescahealth) -- [ADMX_Taskbar/HideSCANetwork](./policy-csp-admx-taskbar.md#admx-taskbar-hidescanetwork) -- [ADMX_Taskbar/HideSCAPower](./policy-csp-admx-taskbar.md#admx-taskbar-hidescapower) -- [ADMX_Taskbar/HideSCAVolume](./policy-csp-admx-taskbar.md#admx-taskbar-hidescavolume) -- [ADMX_Taskbar/NoBalloonFeatureAdvertisements](./policy-csp-admx-taskbar.md#admx-taskbar-noballoonfeatureadvertisements) -- [ADMX_Taskbar/NoPinningStoreToTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningstoretotaskbar) -- [ADMX_Taskbar/NoPinningToDestinations](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningtodestinations) -- [ADMX_Taskbar/NoPinningToTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-nopinningtotaskbar) -- [ADMX_Taskbar/NoRemoteDestinations](./policy-csp-admx-taskbar.md#admx-taskbar-noremotedestinations) -- [ADMX_Taskbar/NoSystraySystemPromotion](./policy-csp-admx-taskbar.md#admx-taskbar-nosystraysystempromotion) -- [ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar](./policy-csp-admx-taskbar.md#admx-taskbar-showwindowsstoreappsontaskbar) -- [ADMX_Taskbar/TaskbarLockAll](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarlockall) -- [ADMX_Taskbar/TaskbarNoAddRemoveToolbar](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoaddremovetoolbar) -- [ADMX_Taskbar/TaskbarNoDragToolbar](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnodragtoolbar) -- [ADMX_Taskbar/TaskbarNoMultimon](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnomultimon) -- [ADMX_Taskbar/TaskbarNoNotification](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnonotification) -- [ADMX_Taskbar/TaskbarNoPinnedList](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) -- [ADMX_Taskbar/TaskbarNoRedock](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoredock) -- [ADMX_Taskbar/TaskbarNoResize](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoresize) -- [ADMX_Taskbar/TaskbarNoThumbnail](./policy-csp-admx-taskbar.md#admx-taskbar-taskbarnothumbnail) -- [ADMX_tcpip/6to4_Router_Name](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name) -- [ADMX_tcpip/6to4_Router_Name_Resolution_Interval](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name-resolution-interval) -- [ADMX_tcpip/6to4_State](./policy-csp-admx-tcpip.md#admx-tcpip-6to4-state) -- [ADMX_tcpip/IPHTTPS_ClientState](./policy-csp-admx-tcpip.md#admx-tcpip-iphttps-clientstate) -- [ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State](./policy-csp-admx-tcpip.md#admx-tcpip-ip-stateless-autoconfiguration-limits-state) -- [ADMX_tcpip/ISATAP_Router_Name](./policy-csp-admx-tcpip.md#admx-tcpip-isatap-router-name) -- [ADMX_tcpip/ISATAP_State](./policy-csp-admx-tcpip.md#admx-tcpip-isatap-state) -- [ADMX_tcpip/Teredo_Client_Port](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-client-port) -- [ADMX_tcpip/Teredo_Default_Qualified](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-default-qualified) -- [ADMX_tcpip/Teredo_Refresh_Rate](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-refresh-rate) -- [ADMX_tcpip/Teredo_Server_Name](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-server-name) -- [ADMX_tcpip/Teredo_State](./policy-csp-admx-tcpip.md#admx-tcpip-teredo-state) -- [ADMX_tcpip/Windows_Scaling_Heuristics_State](./policy-csp-admx-tcpip.md#admx-tcpip-windows-scaling-heuristics-state) -- [ADMX_TerminalServer/TS_AUTO_RECONNECT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_auto_reconnect) -- [ADMX_TerminalServer/TS_CAMERA_REDIRECTION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_camera_redirection) -- [ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_certificate_template_policy) -- [ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_signed_files_1) -- [ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_signed_files_2) -- [ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_unsigned_files_1) -- [ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_allow_unsigned_files_2) -- [ADMX_TerminalServer/TS_CLIENT_AUDIO](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_audio) -- [ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_audio_capture) -- [ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_audio_quality) -- [ADMX_TerminalServer/TS_CLIENT_CLIPBOARD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_clipboard) -- [ADMX_TerminalServer/TS_CLIENT_COM](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_com) -- [ADMX_TerminalServer/TS_CLIENT_DEFAULT_M](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_default_m) -- [ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_disable_hardware_mode) -- [ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_disable_password_saving_1) -- [ADMX_TerminalServer/TS_CLIENT_LPT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_lpt) -- [ADMX_TerminalServer/TS_CLIENT_PNP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_pnp) -- [ADMX_TerminalServer/TS_CLIENT_PRINTER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_printer) -- [ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_trusted_certificate_thumbprints_1) -- [ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_trusted_certificate_thumbprints_2) -- [ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_client_turn_off_udp) -- [ADMX_TerminalServer/TS_COLORDEPTH](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_colordepth) -- [ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_delete_roaming_user_profiles) -- [ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_disable_remote_desktop_wallpaper) -- [ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_dx_use_full_hwgpu) -- [ADMX_TerminalServer/TS_EASY_PRINT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_easy_print) -- [ADMX_TerminalServer/TS_EASY_PRINT_User](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_easy_print_user) -- [ADMX_TerminalServer/TS_EnableVirtualGraphics](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_enablevirtualgraphics) -- [ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_fallbackprintdrivertype) -- [ADMX_TerminalServer/TS_FORCIBLE_LOGOFF](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_forcible_logoff) -- [ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_gateway_policy_enable) -- [ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_gateway_policy_auth_method) -- [ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_gateway_policy_server) -- [ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_join_session_directory) -- [ADMX_TerminalServer/TS_KEEP_ALIVE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_keep_alive) -- [ADMX_TerminalServer/TS_LICENSE_SECGROUP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_license_secgroup) -- [ADMX_TerminalServer/TS_LICENSE_SERVERS](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_license_servers) -- [ADMX_TerminalServer/TS_LICENSE_TOOLTIP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_license_tooltip) -- [ADMX_TerminalServer/TS_LICENSING_MODE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_licensing_mode) -- [ADMX_TerminalServer/TS_MAX_CON_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_max_con_policy) -- [ADMX_TerminalServer/TS_MAXDISPLAYRES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_maxdisplayres) -- [ADMX_TerminalServer/TS_MAXMONITOR](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_maxmonitor) -- [ADMX_TerminalServer/TS_NoDisconnectMenu](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_nodisconnectmenu) -- [ADMX_TerminalServer/TS_NoSecurityMenu](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_nosecuritymenu) -- [ADMX_TerminalServer/TS_PreventLicenseUpgrade](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_preventlicenseupgrade) -- [ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_promt_creds_client_comp) -- [ADMX_TerminalServer/TS_RADC_DefaultConnection](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_radc_defaultconnection) -- [ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_rdsappx_waitforregistration) -- [ADMX_TerminalServer/TS_RemoteControl_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_remotecontrol_1) -- [ADMX_TerminalServer/TS_RemoteControl_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_remotecontrol_2) -- [ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_remotedesktopvirtualgraphics) -- [ADMX_TerminalServer/TS_SD_ClustName](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sd_clustname) -- [ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sd_expose_address) -- [ADMX_TerminalServer/TS_SD_Loc](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sd_loc) -- [ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_security_layer_policy) -- [ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_select_network_detect) -- [ADMX_TerminalServer/TS_SELECT_TRANSPORT](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_select_transport) -- [ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_advanced_remotefx_remoteapp) -- [ADMX_TerminalServer/TS_SERVER_AUTH](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_auth) -- [ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_avc_hw_encode_preferred) -- [ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_avc444_mode_preferred) -- [ADMX_TerminalServer/TS_SERVER_COMPRESSOR](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_compressor) -- [ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_image_quality) -- [ADMX_TerminalServer/TS_SERVER_LEGACY_RFX](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_legacy_rfx) -- [ADMX_TerminalServer/TS_SERVER_PROFILE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_profile) -- [ADMX_TerminalServer/TS_SERVER_VISEXP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_visexp) -- [ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_server_wddm_graphics_driver) -- [ADMX_TerminalServer/TS_Session_End_On_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_session_end_on_limit_1) -- [ADMX_TerminalServer/TS_Session_End_On_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_session_end_on_limit_2) -- [ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_disconnected_timeout_1) -- [ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_disconnected_timeout_2) -- [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_1) -- [ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_idle_limit_2) -- [ADMX_TerminalServer/TS_SESSIONS_Limits_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limits_1) -- [ADMX_TerminalServer/TS_SESSIONS_Limits_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_sessions_limits_2) -- [ADMX_TerminalServer/TS_SINGLE_SESSION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_single_session) -- [ADMX_TerminalServer/TS_SMART_CARD](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_smart_card) -- [ADMX_TerminalServer/TS_START_PROGRAM_1](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_start_program_1) -- [ADMX_TerminalServer/TS_START_PROGRAM_2](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_start_program_2) -- [ADMX_TerminalServer/TS_TEMP_DELETE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_temp_delete) -- [ADMX_TerminalServer/TS_TEMP_PER_SESSION](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_temp_per_session) -- [ADMX_TerminalServer/TS_TIME_ZONE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_time_zone) -- [ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_tscc_permissions_policy) -- [ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_turnoff_singleapp) -- [ADMX_TerminalServer/TS_UIA](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_uia) -- [ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_usb_redirection_disable) -- [ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_authentication_policy) -- [ADMX_TerminalServer/TS_USER_HOME](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_home) -- [ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_mandatory_profiles) -- [ADMX_TerminalServer/TS_USER_PROFILES](./policy-csp-admx-terminalserver.md#admx-terminalserver-ts_user_profiles) -- [ADMX_Thumbnails/DisableThumbnails](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) -- [ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) -- [ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders](./policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) -- [ADMX_TouchInput/TouchInputOff_1](./policy-csp-admx-touchinput.md#admx-touchinput-touchinputoff_1) -- [ADMX_TouchInput/TouchInputOff_2](./policy-csp-admx-touchinput.md#admx-touchinput-touchinputoff_2) -- [ADMX_TouchInput/PanningEverywhereOff_1](./policy-csp-admx-touchinput.md#admx-touchinput-panningeverywhereoff_1) -- [ADMX_TouchInput/PanningEverywhereOff_2](./policy-csp-admx-touchinput.md#admx-touchinput-panningeverywhereoff_2) -- [ADMX_TPM/BlockedCommandsList_Name](./policy-csp-admx-tpm.md#admx-tpm-blockedcommandslist-name) -- [ADMX_TPM/ClearTPMIfNotReady_Name](./policy-csp-admx-tpm.md#admx-tpm-cleartpmifnotready-name) -- [ADMX_TPM/IgnoreDefaultList_Name](./policy-csp-admx-tpm.md#admx-tpm-ignoredefaultlist-name) -- [ADMX_TPM/IgnoreLocalList_Name](./policy-csp-admx-tpm.md#admx-tpm-ignorelocallist-name) -- [ADMX_TPM/OSManagedAuth_Name](./policy-csp-admx-tpm.md#admx-tpm-osmanagedauth-name) -- [ADMX_TPM/OptIntoDSHA_Name](./policy-csp-admx-tpm.md#admx-tpm-optintodsha-name) -- [ADMX_TPM/StandardUserAuthorizationFailureDuration_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureduration-name) -- [ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureindividualthreshold-name) -- [ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name](./policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailuretotalthreshold-name) -- [ADMX_TPM/UseLegacyDAP_Name](./policy-csp-admx-tpm.md#admx-tpm-uselegacydap-name) -- [ADMX_UserExperienceVirtualization/Calculator](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) -- [ADMX_UserExperienceVirtualization/ConfigureSyncMethod](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) -- [ADMX_UserExperienceVirtualization/ConfigureVdi](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) -- [ADMX_UserExperienceVirtualization/ContactITDescription](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactitdescription) -- [ADMX_UserExperienceVirtualization/ContactITUrl](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactiturl) -- [ADMX_UserExperienceVirtualization/DisableWin8Sync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) -- [ADMX_UserExperienceVirtualization/DisableWindowsOSSettings](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) -- [ADMX_UserExperienceVirtualization/EnableUEV](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-enableuev) -- [ADMX_UserExperienceVirtualization/Finance](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) -- [ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-firstusenotificationenabled) -- [ADMX_UserExperienceVirtualization/Games](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) -- [ADMX_UserExperienceVirtualization/InternetExplorer8](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) -- [ADMX_UserExperienceVirtualization/InternetExplorer9](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) -- [ADMX_UserExperienceVirtualization/InternetExplorer10](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) -- [ADMX_UserExperienceVirtualization/InternetExplorer11](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) -- [ADMX_UserExperienceVirtualization/InternetExplorerCommon](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) -- [ADMX_UserExperienceVirtualization/Maps](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) -- [ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) -- [ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) -- [ADMX_UserExperienceVirtualization/Music](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) -- [ADMX_UserExperienceVirtualization/News](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) -- [ADMX_UserExperienceVirtualization/Notepad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) -- [ADMX_UserExperienceVirtualization/Reader](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) -- [ADMX_UserExperienceVirtualization/RepositoryTimeout](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) -- [ADMX_UserExperienceVirtualization/SettingsStoragePath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) -- [ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingstemplatecatalogpath) -- [ADMX_UserExperienceVirtualization/Sports](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) -- [ADMX_UserExperienceVirtualization/SyncEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) -- [ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) -- [ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) -- [ADMX_UserExperienceVirtualization/SyncProviderPingEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) -- [ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncunlistedwindows8apps) -- [ADMX_UserExperienceVirtualization/Travel](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) -- [ADMX_UserExperienceVirtualization/TrayIconEnabled](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-trayiconenabled) -- [ADMX_UserExperienceVirtualization/Video](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) -- [ADMX_UserExperienceVirtualization/Weather](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) -- [ADMX_UserExperienceVirtualization/Wordpad](./policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) -- [ADMX_UserProfiles/CleanupProfiles](./policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles) -- [ADMX_UserProfiles/DontForceUnloadHive](./policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive) -- [ADMX_UserProfiles/LeaveAppMgmtData](./policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata) -- [ADMX_UserProfiles/LimitSize](./policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize) -- [ADMX_UserProfiles/ProfileErrorAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction) -- [ADMX_UserProfiles/SlowLinkTimeOut](./policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout) -- [ADMX_UserProfiles/USER_HOME](./policy-csp-admx-userprofiles.md#admx-userprofiles-user-home) -- [ADMX_UserProfiles/UserInfoAccessAction](./policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction) -- [ADMX_W32Time/W32TIME_POLICY_CONFIG](./policy-csp-admx-w32time.md#admx-w32time-policy-config) -- [ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-configure-ntpclient) -- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpclient) -- [ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER](./policy-csp-admx-w32time.md#admx-w32time-policy-enable-ntpserver) -- [ADMX_WCM/WCM_DisablePowerManagement](./policy-csp-admx-wcm.md#admx-wcm-wcm-disablepowermanagement) -- [ADMX_WCM/WCM_EnableSoftDisconnect](./policy-csp-admx-wcm.md#admx-wcm-wcm-enablesoftdisconnect) -- [ADMX_WCM/WCM_MinimizeConnections](./policy-csp-admx-wcm.md#admx-wcm-wcm-minimizeconnections) -- [ADMX_WDI/WdiDpsScenarioExecutionPolicy](./policy-csp-admx-wdi.md#admx-wdi-wdidpsscenarioexecutionpolicy) -- [ADMX_WDI/WdiDpsScenarioDataSizeLimitPolicy](./policy-csp-admx-wdi.md#admx-wdi-wdidpsscenariodatasizelimitpolicy) -- [ADMX_WinCal/TurnOffWinCal_1](./policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-1) -- [ADMX_WinCal/TurnOffWinCal_2](./policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-2) -- [ADMX_WindowsConnectNow/WCN_DisableWcnUi_1](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-1) -- [ADMX_WindowsConnectNow/WCN_DisableWcnUi_2](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-2) -- [ADMX_WindowsConnectNow/WCN_EnableRegistrar](./policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-enableregistrar) -- [ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-checksamesourceandtargetforfranddfs) -- [ADMX_WindowsExplorer/ClassicShell](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-classicshell) -- [ADMX_WindowsExplorer/ConfirmFileDelete](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-confirmfiledelete) -- [ADMX_WindowsExplorer/DefaultLibrariesLocation](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) -- [ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) -- [ADMX_WindowsExplorer/DisableIndexedLibraryExperience](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableindexedlibraryexperience) -- [ADMX_WindowsExplorer/DisableKnownFolders](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableknownfolders) -- [ADMX_WindowsExplorer/DisableSearchBoxSuggestions](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablesearchboxsuggestions) -- [ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enableshellshortcuticonremotepath) -- [ADMX_WindowsExplorer/EnableSmartScreen](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enablesmartscreen) -- [ADMX_WindowsExplorer/EnforceShellExtensionSecurity](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enforceshellextensionsecurity) -- [ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) -- [ADMX_WindowsExplorer/HideContentViewModeSnippets](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-hidecontentviewmodesnippets) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) -- [ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) -- [ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-linkresolveignorelinkinfo) -- [ADMX_WindowsExplorer/MaxRecentDocs](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-maxrecentdocs) -- [ADMX_WindowsExplorer/NoBackButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nobackbutton) -- [ADMX_WindowsExplorer/NoCDBurning](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocdburning) -- [ADMX_WindowsExplorer/NoCacheThumbNailPictures](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocachethumbnailpictures) -- [ADMX_WindowsExplorer/NoChangeAnimation](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangeanimation) -- [ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangekeyboardnavigationindicators) -- [ADMX_WindowsExplorer/NoDFSTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodfstab) -- [ADMX_WindowsExplorer/NoDrives](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodrives) -- [ADMX_WindowsExplorer/NoEntireNetwork](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noentirenetwork) -- [ADMX_WindowsExplorer/NoFileMRU](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemru) -- [ADMX_WindowsExplorer/NoFileMenu](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemenu) -- [ADMX_WindowsExplorer/NoFolderOptions](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofolderoptions) -- [ADMX_WindowsExplorer/NoHardwareTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nohardwaretab) -- [ADMX_WindowsExplorer/NoManageMyComputerVerb](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomanagemycomputerverb) -- [ADMX_WindowsExplorer/NoMyComputerSharedDocuments](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomycomputershareddocuments) -- [ADMX_WindowsExplorer/NoNetConnectDisconnect](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonetconnectdisconnect) -- [ADMX_WindowsExplorer/NoNewAppAlert](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonewappalert) -- [ADMX_WindowsExplorer/NoPlacesBar](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noplacesbar) -- [ADMX_WindowsExplorer/NoRecycleFiles](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norecyclefiles) -- [ADMX_WindowsExplorer/NoRunAsInstallPrompt](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norunasinstallprompt) -- [ADMX_WindowsExplorer/NoSearchInternetTryHarderButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosearchinternettryharderbutton) -- [ADMX_WindowsExplorer/NoSecurityTab](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosecuritytab) -- [ADMX_WindowsExplorer/NoShellSearchButton](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noshellsearchbutton) -- [ADMX_WindowsExplorer/NoStrCmpLogical](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) -- [ADMX_WindowsExplorer/NoViewContextMenu](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewcontextmenu) -- [ADMX_WindowsExplorer/NoViewOnDrive](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewondrive) -- [ADMX_WindowsExplorer/NoWindowsHotKeys](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nowindowshotkeys) -- [ADMX_WindowsExplorer/NoWorkgroupContents](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noworkgroupcontents) -- [ADMX_WindowsExplorer/PlacesBar](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-placesbar) -- [ADMX_WindowsExplorer/PromptRunasInstallNetPath](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-promptrunasinstallnetpath) -- [ADMX_WindowsExplorer/RecycleBinSize](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-recyclebinsize) -- [ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-1) -- [ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-2) -- [ADMX_WindowsExplorer/ShowHibernateOption](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showhibernateoption) -- [ADMX_WindowsExplorer/ShowSleepOption](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showsleepoption) -- [ADMX_WindowsExplorer/TryHarderPinnedLibrary](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedlibrary) -- [ADMX_WindowsExplorer/TryHarderPinnedOpenSearch](./policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedopensearch) -- [ADMX_WindowsMediaDRM/DisableOnline](./policy-csp-admx-windowsmediadrm.md#admx-windowsmediadrm-disableonline) -- [ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurehttpproxysettings) -- [ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configuremmsproxysettings) -- [ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurertspproxysettings) -- [ADMX_WindowsMediaPlayer/DisableAutoUpdate](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disableautoupdate) -- [ADMX_WindowsMediaPlayer/DisableNetworkSettings](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablenetworksettings) -- [ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablesetupfirstuseconfiguration) -- [ADMX_WindowsMediaPlayer/DoNotShowAnchor](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-donotshowanchor) -- [ADMX_WindowsMediaPlayer/DontUseFrameInterpolation](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-dontuseframeinterpolation) -- [ADMX_WindowsMediaPlayer/EnableScreenSaver](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-enablescreensaver) -- [ADMX_WindowsMediaPlayer/HidePrivacyTab](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hideprivacytab) -- [ADMX_WindowsMediaPlayer/HideSecurityTab](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hidesecuritytab) -- [ADMX_WindowsMediaPlayer/NetworkBuffering](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-networkbuffering) -- [ADMX_WindowsMediaPlayer/PolicyCodecUpdate](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-policycodecupdate) -- [ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventcddvdmetadataretrieval) -- [ADMX_WindowsMediaPlayer/PreventLibrarySharing](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventlibrarysharing) -- [ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventmusicfilemetadataretrieval) -- [ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventquicklaunchshortcut) -- [ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventradiopresetsretrieval) -- [ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventwmpdesktopshortcut) -- [ADMX_WindowsMediaPlayer/SkinLockDown](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-skinlockdown) -- [ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-windowsstreamingmediaprotocols) -- [ADMX_WindowsRemoteManagement/DisallowKerberos_1](./policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-1) -- [ADMX_WindowsRemoteManagement/DisallowKerberos_2](./policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-2) -- [ADMX_WindowsStore/DisableAutoDownloadWin8](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableautodownloadwin8) -- [ADMX_WindowsStore/DisableOSUpgrade_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-1) -- [ADMX_WindowsStore/DisableOSUpgrade_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-2) -- [ADMX_WindowsStore/RemoveWindowsStore_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-1) -- [ADMX_WindowsStore/RemoveWindowsStore_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-2) -- [ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription](./policy-csp-admx-wininit.md#admx-wininit-disablenamedpipeshutdownpolicydescription) -- [ADMX_WinInit/Hiberboot](./policy-csp-admx-wininit.md#admx-wininit-hiberboot) -- [ADMX_WinInit/ShutdownTimeoutHungSessionsDescription](./policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription) -- [ADMX_WinLogon/CustomShell](./policy-csp-admx-winlogon.md#admx-winlogon-customshell) -- [ADMX_WinLogon/DisplayLastLogonInfoDescription](./policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription) -- [ADMX_WinLogon/LogonHoursNotificationPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription) -- [ADMX_WinLogon/LogonHoursPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription) -- [ADMX_WinLogon/ReportCachedLogonPolicyDescription](./policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) -- [ADMX_WinLogon/SoftwareSASGeneration](./policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration) -- [ADMX_Winsrv/AllowBlockingAppsAtShutdown](./policy-csp-admx-winsrv.md#admx-winsrv-allowblockingappsatshutdown) -- [ADMX_wlansvc/SetCost](./policy-csp-admx-wlansvc.md#admx-wlansvc-setcost) -- [ADMX_wlansvc/SetPINEnforced](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced) -- [ADMX_wlansvc/SetPINPreferred](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) -- [ADMX_WordWheel/CustomSearch](./policy-csp-admx-wordwheel.md#admx-wordwheel-customsearch) -- [ADMX_WorkFoldersClient/Pol_UserEnableTokenBroker](./policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol_userenabletokenbroker) -- [ADMX_WorkFoldersClient/Pol_UserEnableWorkFolders](./policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol_userenableworkfolders) -- [ADMX_WorkFoldersClient/Pol_MachineEnableWorkFolders](./policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol_machineenableworkfolders) -- [ADMX_WPN/NoCallsDuringQuietHours](./policy-csp-admx-wpn.md#admx-wpn-nocallsduringquiethours) -- [ADMX_WPN/NoLockScreenToastNotification](./policy-csp-admx-wpn.md#admx-wpn-nolockscreentoastnotification) -- [ADMX_WPN/NoQuietHours](./policy-csp-admx-wpn.md#admx-wpn-noquiethours) -- [ADMX_WPN/NoToastNotification](./policy-csp-admx-wpn.md#admx-wpn-notoastnotification) -- [ADMX_WPN/QuietHoursDailyBeginMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailybeginminute) -- [ADMX_WPN/QuietHoursDailyEndMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailyendminute) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-disableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DesktopAppInstaller/EnableAdditionalSources](./policy-csp-desktopappinstaller.md#desktopappinstaller-enableadditionalsources) -- [DesktopAppInstaller/EnableAppInstaller](./policy-csp-desktopappinstaller.md#desktopappinstaller-enableappinstaller) -- [DesktopAppInstaller/EnableLocalManifestFiles](./policy-csp-desktopappinstaller.md#desktopappinstaller-enablelocalmanifestfiles) -- [DesktopAppInstaller/EnableHashOverride](./policy-csp-desktopappinstaller.md#desktopappinstaller-enablehashoverride) -- [DesktopAppInstaller/EnableMicrosoftStoreSource](./policy-csp-desktopappinstaller.md#desktopappinstaller-enablemicrosoftstoresource) -- [DesktopAppInstaller/EnableMSAppInstallerProtocol](./policy-csp-desktopappinstaller.md#desktopappinstaller-enablemsappinstallerprotocol) -- [DesktopAppInstaller/EnableSettings](./policy-csp-desktopappinstaller.md#desktopappinstaller-enablesettings) -- [DesktopAppInstaller/EnableAllowedSources](./policy-csp-desktopappinstaller.md#desktopappinstaller-enableallowedsources) -- [DesktopAppInstaller/EnableExperimentalFeatures](./policy-csp-desktopappinstaller.md#desktopappinstaller-enableexperimentalfeatures) -- [DesktopAppInstaller/SourceAutoUpdateInterval](./policy-csp-desktopappinstaller.md#desktopappinstaller-sourceautoupdateinterval) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallationpreventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +This article lists the ADMX-backed policies in Policy CSP. -## Related topics +## ActiveXControls -[Policy CSP](policy-configuration-service-provider.md) +- [ApprovedInstallationSites](policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) + +## ADMX_ActiveXInstallService + +- [AxISURLZonePolicies](policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies) + +## ADMX_AddRemovePrograms + +- [NoServices](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noservices) +- [NoAddPage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddpage) +- [NoWindowsSetupPage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nowindowssetuppage) +- [NoRemovePage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noremovepage) +- [NoAddFromCDorFloppy](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromcdorfloppy) +- [NoAddFromInternet](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfrominternet) +- [NoAddFromNetwork](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromnetwork) +- [NoChooseProgramsPage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nochooseprogramspage) +- [NoAddRemovePrograms](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddremoveprograms) +- [NoSupportInfo](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nosupportinfo) +- [DefaultCategory](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory) + +## ADMX_AdmPwd + +- [POL_AdmPwd_DontAllowPwdExpirationBehindPolicy](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd-dontallowpwdexpirationbehindpolicy) +- [POL_AdmPwd_Enabled](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd-enabled) +- [POL_AdmPwd_AdminName](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd-adminname) +- [POL_AdmPwd](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd) + +## ADMX_AppCompat + +- [AppCompatTurnOffProgramCompatibilityAssistant_1](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant-1) +- [AppCompatPrevent16BitMach](policy-csp-admx-appcompat.md#admx-appcompat-appcompatprevent16bitmach) +- [AppCompatRemoveProgramCompatPropPage](policy-csp-admx-appcompat.md#admx-appcompat-appcompatremoveprogramcompatproppage) +- [AppCompatTurnOffEngine](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffengine) +- [AppCompatTurnOffApplicationImpactTelemetry](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffapplicationimpacttelemetry) +- [AppCompatTurnOffProgramInventory](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprograminventory) +- [AppCompatTurnOffProgramCompatibilityAssistant_2](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant-2) +- [AppCompatTurnOffUserActionRecord](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffuseractionrecord) +- [AppCompatTurnOffSwitchBack](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffswitchback) + +## ADMX_AppxPackageManager + +- [AllowDeploymentInSpecialProfiles](policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles) + +## ADMX_AppXRuntime + +- [AppxRuntimeBlockFileElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) +- [AppxRuntimeBlockProtocolElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) +- [AppxRuntimeBlockFileElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) +- [AppxRuntimeBlockProtocolElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) +- [AppxRuntimeBlockHostedAppAccessWinRT](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt) +- [AppxRuntimeApplicationContentUriRules](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules) + +## ADMX_AttachmentManager + +- [AM_SetFileRiskLevel](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel) +- [AM_SetHighRiskInclusion](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion) +- [AM_SetLowRiskInclusion](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion) +- [AM_SetModRiskInclusion](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion) +- [AM_EstimateFileHandlerRisk](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk) + +## ADMX_AuditSettings + +- [IncludeCmdLine](policy-csp-admx-auditsettings.md#admx-auditsettings-includecmdline) + +## ADMX_Bits + +- [BITS_EnablePeercaching](policy-csp-admx-bits.md#admx-bits-bits-enablepeercaching) +- [BITS_DisableBranchCache](policy-csp-admx-bits.md#admx-bits-bits-disablebranchcache) +- [BITS_DisablePeercachingClient](policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingclient) +- [BITS_DisablePeercachingServer](policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingserver) +- [BITS_MaxContentAge](policy-csp-admx-bits.md#admx-bits-bits-maxcontentage) +- [BITS_MaxCacheSize](policy-csp-admx-bits.md#admx-bits-bits-maxcachesize) +- [BITS_MaxDownloadTime](policy-csp-admx-bits.md#admx-bits-bits-maxdownloadtime) +- [BITS_MaxBandwidthServedForPeers](policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthservedforpeers) +- [BITS_MaxJobsPerUser](policy-csp-admx-bits.md#admx-bits-bits-maxjobsperuser) +- [BITS_MaxJobsPerMachine](policy-csp-admx-bits.md#admx-bits-bits-maxjobspermachine) +- [BITS_MaxFilesPerJob](policy-csp-admx-bits.md#admx-bits-bits-maxfilesperjob) +- [BITS_MaxRangesPerFile](policy-csp-admx-bits.md#admx-bits-bits-maxrangesperfile) +- [BITS_MaxBandwidthV2_Maintenance](policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-maintenance) +- [BITS_MaxBandwidthV2_Work](policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-work) + +## ADMX_CipherSuiteOrder + +- [SSLCurveOrder](policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslcurveorder) +- [SSLCipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslciphersuiteorder) + +## ADMX_COM + +- [AppMgmt_COM_SearchForCLSID_1](policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1) +- [AppMgmt_COM_SearchForCLSID_2](policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2) + +## ADMX_ControlPanel + +- [ForceClassicControlPanel](policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel) +- [DisallowCpls](policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls) +- [NoControlPanel](policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel) +- [RestrictCpls](policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls) + +## ADMX_ControlPanelDisplay + +- [CPL_Display_Disable](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable) +- [CPL_Display_HideSettings](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings) +- [CPL_Personalization_EnableScreenSaver](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver) +- [CPL_Personalization_SetVisualStyle](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle) +- [CPL_Personalization_SetScreenSaver](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver) +- [CPL_Personalization_SetTheme](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) +- [CPL_Personalization_ScreenSaverIsSecure](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure) +- [CPL_Personalization_NoColorAppearanceUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui) +- [CPL_Personalization_DisableColorSchemeChoice](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice) +- [CPL_Personalization_NoDesktopBackgroundUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui) +- [CPL_Personalization_NoDesktopIconsUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui) +- [CPL_Personalization_NoMousePointersUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui) +- [CPL_Personalization_NoScreenSaverUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui) +- [CPL_Personalization_NoSoundSchemeUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui) +- [CPL_Personalization_DisableThemeChange](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange) +- [CPL_Personalization_DisableVisualStyle](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle) +- [CPL_Personalization_LockFontSize](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize) +- [CPL_Personalization_ScreenSaverTimeOut](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout) +- [CPL_Personalization_NoLockScreen](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen) +- [CPL_Personalization_PersonalColors](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors) +- [CPL_Personalization_ForceDefaultLockScreen](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen) +- [CPL_Personalization_StartBackground](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground) +- [CPL_Personalization_SetTheme](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) +- [CPL_Personalization_NoChangingLockScreen](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen) +- [CPL_Personalization_NoChangingStartMenuBackground](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground) + +## ADMX_Cpls + +- [UseDefaultTile](policy-csp-admx-cpls.md#admx-cpls-usedefaulttile) + +## ADMX_CredentialProviders + +- [AllowDomainDelayLock](policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock) +- [DefaultCredentialProvider](policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider) +- [ExcludedCredentialProviders](policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders) + +## ADMX_CredSsp + +- [AllowDefaultCredentials](policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials) +- [AllowDefCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly) +- [AllowFreshCredentials](policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentials) +- [AllowFreshCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentialswhenntlmonly) +- [AllowSavedCredentials](policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentials) +- [AllowSavedCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentialswhenntlmonly) +- [DenyDefaultCredentials](policy-csp-admx-credssp.md#admx-credssp-denydefaultcredentials) +- [DenyFreshCredentials](policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials) +- [DenySavedCredentials](policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials) +- [AllowEncryptionOracle](policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle) +- [RestrictedRemoteAdministration](policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration) + +## ADMX_CredUI + +- [NoLocalPasswordResetQuestions](policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions) +- [EnableSecureCredentialPrompting](policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting) + +## ADMX_CtrlAltDel + +- [DisableChangePassword](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword) +- [DisableLockComputer](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) +- [NoLogoff](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) +- [DisableTaskMgr](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) + +## ADMX_DataCollection + +- [CommercialIdPolicy](policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) + +## ADMX_DCOM + +- [DCOMActivationSecurityCheckAllowLocalList](policy-csp-admx-dcom.md#admx-dcom-dcomactivationsecuritycheckallowlocallist) +- [DCOMActivationSecurityCheckExemptionList](policy-csp-admx-dcom.md#admx-dcom-dcomactivationsecuritycheckexemptionlist) + +## ADMX_Desktop + +- [AD_EnableFilter](policy-csp-admx-desktop.md#admx-desktop-ad-enablefilter) +- [AD_HideDirectoryFolder](policy-csp-admx-desktop.md#admx-desktop-ad-hidedirectoryfolder) +- [AD_QueryLimit](policy-csp-admx-desktop.md#admx-desktop-ad-querylimit) +- [sz_AdminComponents_Title](policy-csp-admx-desktop.md#admx-desktop-sz-admincomponents-title) +- [sz_DWP_NoHTMLPaper](policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) +- [Wallpaper](policy-csp-admx-desktop.md#admx-desktop-wallpaper) +- [NoActiveDesktop](policy-csp-admx-desktop.md#admx-desktop-noactivedesktop) +- [sz_ATC_NoComponents](policy-csp-admx-desktop.md#admx-desktop-sz-atc-nocomponents) +- [ForceActiveDesktopOn](policy-csp-admx-desktop.md#admx-desktop-forceactivedesktopon) +- [sz_ATC_DisableAdd](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableadd) +- [NoActiveDesktopChanges](policy-csp-admx-desktop.md#admx-desktop-noactivedesktopchanges) +- [sz_ATC_DisableClose](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableclose) +- [sz_ATC_DisableDel](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disabledel) +- [sz_ATC_DisableEdit](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableedit) +- [NoRecentDocsNetHood](policy-csp-admx-desktop.md#admx-desktop-norecentdocsnethood) +- [NoSaveSettings](policy-csp-admx-desktop.md#admx-desktop-nosavesettings) +- [NoDesktop](policy-csp-admx-desktop.md#admx-desktop-nodesktop) +- [NoInternetIcon](policy-csp-admx-desktop.md#admx-desktop-nointerneticon) +- [NoNetHood](policy-csp-admx-desktop.md#admx-desktop-nonethood) +- [sz_DB_DragDropClose](policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) +- [sz_DB_Moving](policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) +- [NoMyComputerIcon](policy-csp-admx-desktop.md#admx-desktop-nomycomputericon) +- [NoMyDocumentsIcon](policy-csp-admx-desktop.md#admx-desktop-nomydocumentsicon) +- [NoPropertiesMyComputer](policy-csp-admx-desktop.md#admx-desktop-nopropertiesmycomputer) +- [NoPropertiesMyDocuments](policy-csp-admx-desktop.md#admx-desktop-nopropertiesmydocuments) +- [NoRecycleBinProperties](policy-csp-admx-desktop.md#admx-desktop-norecyclebinproperties) +- [NoRecycleBinIcon](policy-csp-admx-desktop.md#admx-desktop-norecyclebinicon) +- [NoDesktopCleanupWizard](policy-csp-admx-desktop.md#admx-desktop-nodesktopcleanupwizard) +- [NoWindowMinimizingShortcuts](policy-csp-admx-desktop.md#admx-desktop-nowindowminimizingshortcuts) +- [NoDesktop](policy-csp-admx-desktop.md#admx-desktop-nodesktop) + +## ADMX_DeviceCompat + +- [DeviceFlags](policy-csp-admx-devicecompat.md#admx-devicecompat-deviceflags) +- [DriverShims](policy-csp-admx-devicecompat.md#admx-devicecompat-drivershims) + +## ADMX_DeviceGuard + +- [ConfigCIPolicy](policy-csp-admx-deviceguard.md#admx-deviceguard-configcipolicy) + +## ADMX_DeviceInstallation + +- [DeviceInstall_InstallTimeout](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) +- [DeviceInstall_AllowAdminInstall](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) +- [DeviceInstall_DeniedPolicy_SimpleText](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) +- [DeviceInstall_DeniedPolicy_DetailText](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) +- [DeviceInstall_Removable_Deny](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) +- [DeviceInstall_Policy_RebootTime](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) +- [DeviceInstall_SystemRestore](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) +- [DriverInstall_Classes_AllowUser](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-driverinstall-classes-allowuser) + +## ADMX_DeviceSetup + +- [DriverSearchPlaces_SearchOrderConfiguration](policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) +- [DeviceInstall_BalloonTips](policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) + +## ADMX_DFS + +- [DFSDiscoverDC](policy-csp-admx-dfs.md#admx-dfs-dfsdiscoverdc) + +## ADMX_DigitalLocker + +- [Digitalx_DiableApplication_TitleText_1](policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) +- [Digitalx_DiableApplication_TitleText_2](policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) + +## ADMX_DiskDiagnostic + +- [DfdAlertPolicy](policy-csp-admx-diskdiagnostic.md#admx-diskdiagnostic-dfdalertpolicy) +- [WdiScenarioExecutionPolicy](policy-csp-admx-diskdiagnostic.md#admx-diskdiagnostic-wdiscenarioexecutionpolicy) + +## ADMX_DiskNVCache + +- [BootResumePolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-bootresumepolicy) +- [CachePowerModePolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-cachepowermodepolicy) +- [FeatureOffPolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-featureoffpolicy) +- [SolidStatePolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-solidstatepolicy) + +## ADMX_DiskQuota + +- [DQ_RemovableMedia](policy-csp-admx-diskquota.md#admx-diskquota-dq-removablemedia) +- [DQ_Enable](policy-csp-admx-diskquota.md#admx-diskquota-dq-enable) +- [DQ_Enforce](policy-csp-admx-diskquota.md#admx-diskquota-dq-enforce) +- [DQ_LogEventOverLimit](policy-csp-admx-diskquota.md#admx-diskquota-dq-logeventoverlimit) +- [DQ_LogEventOverThreshold](policy-csp-admx-diskquota.md#admx-diskquota-dq-logeventoverthreshold) +- [DQ_Limit](policy-csp-admx-diskquota.md#admx-diskquota-dq-limit) + +## ADMX_DistributedLinkTracking + +- [DLT_AllowDomainMode](policy-csp-admx-distributedlinktracking.md#admx-distributedlinktracking-dlt-allowdomainmode) + +## ADMX_DnsClient + +- [DNS_AppendToMultiLabelName](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-appendtomultilabelname) +- [DNS_AllowFQDNNetBiosQueries](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) +- [DNS_Domain](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domain) +- [DNS_NameServer](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-nameserver) +- [DNS_SearchList](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-searchlist) +- [DNS_RegistrationEnabled](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationenabled) +- [DNS_IdnMapping](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnmapping) +- [DNS_PreferLocalResponsesOverLowerOrderDns](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-preferlocalresponsesoverlowerorderdns) +- [DNS_PrimaryDnsSuffix](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-primarydnssuffix) +- [DNS_UseDomainNameDevolution](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-usedomainnamedevolution) +- [DNS_DomainNameDevolutionLevel](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domainnamedevolutionlevel) +- [DNS_RegisterAdapterName](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registeradaptername) +- [DNS_RegisterReverseLookup](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registerreverselookup) +- [DNS_RegistrationRefreshInterval](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationrefreshinterval) +- [DNS_RegistrationOverwritesInConflict](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationoverwritesinconflict) +- [DNS_RegistrationTtl](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationttl) +- [DNS_IdnEncoding](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnencoding) +- [Turn_Off_Multicast](policy-csp-admx-dnsclient.md#admx-dnsclient-turn-off-multicast) +- [DNS_SmartMultiHomedNameResolution](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartmultihomednameresolution) +- [DNS_SmartProtocolReorder](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartprotocolreorder) +- [DNS_UpdateSecurityLevel](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatesecuritylevel) +- [DNS_UpdateTopLevelDomainZones](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatetopleveldomainzones) + +## ADMX_DWM + +- [DwmDisallowAnimations_1](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-1) +- [DwmDisallowColorizationColorChanges_1](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-1) +- [DwmDefaultColorizationColor_1](policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-1) +- [DwmDisallowAnimations_2](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-2) +- [DwmDisallowColorizationColorChanges_2](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-2) +- [DwmDefaultColorizationColor_2](policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-2) + +## ADMX_EAIME + +- [L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](policy-csp-admx-eaime.md#admx-eaime-l-donotincludenonpublishingstandardglyphinthecandidatelist) +- [L_RestrictCharacterCodeRangeOfConversion](policy-csp-admx-eaime.md#admx-eaime-l-restrictcharactercoderangeofconversion) +- [L_TurnOffCustomDictionary](policy-csp-admx-eaime.md#admx-eaime-l-turnoffcustomdictionary) +- [L_TurnOffHistorybasedPredictiveInput](policy-csp-admx-eaime.md#admx-eaime-l-turnoffhistorybasedpredictiveinput) +- [L_TurnOffInternetSearchIntegration](policy-csp-admx-eaime.md#admx-eaime-l-turnoffinternetsearchintegration) +- [L_TurnOffOpenExtendedDictionary](policy-csp-admx-eaime.md#admx-eaime-l-turnoffopenextendeddictionary) +- [L_TurnOffSavingAutoTuningDataToFile](policy-csp-admx-eaime.md#admx-eaime-l-turnoffsavingautotuningdatatofile) +- [L_TurnOnCloudCandidate](policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidate) +- [L_TurnOnCloudCandidateCHS](policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidatechs) +- [L_TurnOnLexiconUpdate](policy-csp-admx-eaime.md#admx-eaime-l-turnonlexiconupdate) +- [L_TurnOnLiveStickers](policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) +- [L_TurnOnMisconversionLoggingForMisconversionReport](policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) + +## ADMX_EncryptFilesonMove + +- [NoEncryptOnMove](policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) + +## ADMX_EnhancedStorage + +- [RootHubConnectedEnStorDevices](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) +- [ApprovedEnStorDevices](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedenstordevices) +- [ApprovedSilos](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedsilos) +- [DisallowLegacyDiskDevices](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) +- [DisablePasswordAuthentication](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disablepasswordauthentication) +- [LockDeviceOnMachineLock](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) + +## ADMX_ErrorReporting + +- [WerArchive_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-1) +- [WerQueue_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-1) +- [WerExlusion_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-1) +- [WerAutoApproveOSDumps_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-1) +- [WerDefaultConsent_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-1) +- [WerConsentCustomize_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentcustomize-1) +- [WerConsentOverride_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-1) +- [WerNoLogging_1](policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-1) +- [WerDisable_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werdisable-1) +- [WerNoSecondLevelData_1](policy-csp-admx-errorreporting.md#admx-errorreporting-wernosecondleveldata-1) +- [WerBypassDataThrottling_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-1) +- [WerBypassPowerThrottling_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-1) +- [WerBypassNetworkCostThrottling_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-1) +- [WerCER](policy-csp-admx-errorreporting.md#admx-errorreporting-wercer) +- [WerArchive_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-2) +- [WerQueue_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) +- [PCH_AllOrNoneDef](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornonedef) +- [PCH_AllOrNoneInc](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneinc) +- [WerExlusion_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-2) +- [PCH_AllOrNoneEx](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneex) +- [PCH_ReportOperatingSystemFaults](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-reportoperatingsystemfaults) +- [WerAutoApproveOSDumps_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-2) +- [PCH_ConfigureReport](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-configurereport) +- [WerDefaultConsent_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-2) +- [WerConsentOverride_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-2) +- [WerNoLogging_2](policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-2) +- [WerBypassDataThrottling_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-2) +- [WerBypassPowerThrottling_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-2) +- [WerBypassNetworkCostThrottling_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-2) + +## ADMX_EventForwarding + +- [ForwarderResourceUsage](policy-csp-admx-eventforwarding.md#admx-eventforwarding-forwarderresourceusage) +- [SubscriptionManager](policy-csp-admx-eventforwarding.md#admx-eventforwarding-subscriptionmanager) + +## ADMX_EventLog + +- [Channel_Log_AutoBackup_1](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-1) +- [Channel_Log_FileLogAccess_1](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-1) +- [Channel_Log_FileLogAccess_5](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-5) +- [Channel_LogFilePath_1](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-1) +- [Channel_Log_AutoBackup_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-2) +- [Channel_Log_FileLogAccess_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-2) +- [Channel_Log_FileLogAccess_6](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-6) +- [Channel_Log_Retention_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-2) +- [Channel_LogFilePath_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-2) +- [Channel_Log_AutoBackup_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-3) +- [Channel_Log_FileLogAccess_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-3) +- [Channel_Log_FileLogAccess_7](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-7) +- [Channel_Log_Retention_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-3) +- [Channel_LogFilePath_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-3) +- [Channel_LogMaxSize_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-logmaxsize-3) +- [Channel_LogEnabled](policy-csp-admx-eventlog.md#admx-eventlog-channel-logenabled) +- [Channel_Log_AutoBackup_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-4) +- [Channel_Log_FileLogAccess_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-4) +- [Channel_Log_FileLogAccess_8](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-8) +- [Channel_Log_Retention_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-4) +- [Channel_LogFilePath_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-4) + +## ADMX_EventLogging + +- [EnableProtectedEventLogging](policy-csp-admx-eventlogging.md#admx-eventlogging-enableprotectedeventlogging) + +## ADMX_EventViewer + +- [EventViewer_RedirectionProgram](policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer-redirectionprogram) +- [EventViewer_RedirectionProgramCommandLineParameters](policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer-redirectionprogramcommandlineparameters) +- [EventViewer_RedirectionURL](policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer-redirectionurl) + +## ADMX_Explorer + +- [AlwaysShowClassicMenu](policy-csp-admx-explorer.md#admx-explorer-alwaysshowclassicmenu) +- [PreventItemCreationInUsersFilesFolder](policy-csp-admx-explorer.md#admx-explorer-preventitemcreationinusersfilesfolder) +- [TurnOffSPIAnimations](policy-csp-admx-explorer.md#admx-explorer-turnoffspianimations) +- [DisableRoamedProfileInit](policy-csp-admx-explorer.md#admx-explorer-disableroamedprofileinit) +- [AdminInfoUrl](policy-csp-admx-explorer.md#admx-explorer-admininfourl) + +## ADMX_ExternalBoot + +- [PortableOperatingSystem_Hibernate](policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem-hibernate) +- [PortableOperatingSystem_Sleep](policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem-sleep) +- [PortableOperatingSystem_Launcher](policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem-launcher) + +## ADMX_FileRecovery + +- [WdiScenarioExecutionPolicy](policy-csp-admx-filerecovery.md#admx-filerecovery-wdiscenarioexecutionpolicy) + +## ADMX_FileRevocation + +- [DelegatedPackageFamilyNames](policy-csp-admx-filerevocation.md#admx-filerevocation-delegatedpackagefamilynames) + +## ADMX_FileServerVSSProvider + +- [Pol_EncryptProtocol](policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) + +## ADMX_FileSys + +- [DisableDeleteNotification](policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) +- [LongPathsEnabled](policy-csp-admx-filesys.md#admx-filesys-longpathsenabled) +- [DisableCompression](policy-csp-admx-filesys.md#admx-filesys-disablecompression) +- [DisableEncryption](policy-csp-admx-filesys.md#admx-filesys-disableencryption) +- [TxfDeprecatedFunctionality](policy-csp-admx-filesys.md#admx-filesys-txfdeprecatedfunctionality) +- [EnablePagefileEncryption](policy-csp-admx-filesys.md#admx-filesys-enablepagefileencryption) +- [ShortNameCreationSettings](policy-csp-admx-filesys.md#admx-filesys-shortnamecreationsettings) +- [SymlinkEvaluation](policy-csp-admx-filesys.md#admx-filesys-symlinkevaluation) + +## ADMX_FolderRedirection + +- [DisableFRAdminPin](policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpin) +- [DisableFRAdminPinByFolder](policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpinbyfolder) +- [FolderRedirectionEnableCacheRename](policy-csp-admx-folderredirection.md#admx-folderredirection-folderredirectionenablecacherename) +- [PrimaryComputer_FR_1](policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) +- [LocalizeXPRelativePaths_1](policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-1) +- [PrimaryComputer_FR_2](policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) +- [LocalizeXPRelativePaths_2](policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) + +## ADMX_FramePanes + +- [NoReadingPane](policy-csp-admx-framepanes.md#admx-framepanes-noreadingpane) +- [NoPreviewPane](policy-csp-admx-framepanes.md#admx-framepanes-nopreviewpane) + +## ADMX_fthsvc + +- [WdiScenarioExecutionPolicy](policy-csp-admx-fthsvc.md#admx-fthsvc-wdiscenarioexecutionpolicy) + +## ADMX_Globalization + +- [ImplicitDataCollectionOff_1](policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-1) +- [HideAdminOptions](policy-csp-admx-globalization.md#admx-globalization-hideadminoptions) +- [HideCurrentLocation](policy-csp-admx-globalization.md#admx-globalization-hidecurrentlocation) +- [HideLanguageSelection](policy-csp-admx-globalization.md#admx-globalization-hidelanguageselection) +- [HideLocaleSelectAndCustomize](policy-csp-admx-globalization.md#admx-globalization-hidelocaleselectandcustomize) +- [RestrictUILangSelect](policy-csp-admx-globalization.md#admx-globalization-restrictuilangselect) +- [LockUserUILanguage](policy-csp-admx-globalization.md#admx-globalization-lockuseruilanguage) +- [TurnOffAutocorrectMisspelledWords](policy-csp-admx-globalization.md#admx-globalization-turnoffautocorrectmisspelledwords) +- [TurnOffHighlightMisspelledWords](policy-csp-admx-globalization.md#admx-globalization-turnoffhighlightmisspelledwords) +- [TurnOffInsertSpace](policy-csp-admx-globalization.md#admx-globalization-turnoffinsertspace) +- [TurnOffOfferTextPredictions](policy-csp-admx-globalization.md#admx-globalization-turnoffoffertextpredictions) +- [Y2K](policy-csp-admx-globalization.md#admx-globalization-y2k) +- [PreventGeoIdChange_1](policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-1) +- [CustomLocalesNoSelect_1](policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1) +- [PreventUserOverrides_1](policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-1) +- [LocaleUserRestrict_1](policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-1) +- [ImplicitDataCollectionOff_2](policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-2) +- [LockMachineUILanguage](policy-csp-admx-globalization.md#admx-globalization-lockmachineuilanguage) +- [PreventGeoIdChange_2](policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-2) +- [BlockUserInputMethodsForSignIn](policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin) +- [CustomLocalesNoSelect_2](policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2) +- [PreventUserOverrides_2](policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-2) +- [LocaleSystemRestrict](policy-csp-admx-globalization.md#admx-globalization-localesystemrestrict) +- [LocaleUserRestrict_2](policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-2) + +## ADMX_GroupPolicy + +- [GPDCOptions](policy-csp-admx-grouppolicy.md#admx-grouppolicy-gpdcoptions) +- [GPTransferRate_1](policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-1) +- [NewGPOLinksDisabled](policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpolinksdisabled) +- [DenyRsopToInteractiveUser_1](policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-1) +- [EnforcePoliciesOnly](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enforcepoliciesonly) +- [NewGPODisplayName](policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpodisplayname) +- [GroupPolicyRefreshRateUser](policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrateuser) +- [DisableAutoADMUpdate](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableautoadmupdate) +- [ProcessMitigationOptions](policy-csp-admx-grouppolicy.md#admx-grouppolicy-processmitigationoptions) +- [AllowX-ForestPolicy-and-RUP](policy-csp-admx-grouppolicy.md#admx-grouppolicy-allowx-forestpolicy-and-rup) +- [OnlyUseLocalAdminFiles](policy-csp-admx-grouppolicy.md#admx-grouppolicy-onlyuselocaladminfiles) +- [SlowlinkDefaultToAsync](policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaulttoasync) +- [SlowLinkDefaultForDirectAccess](policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaultfordirectaccess) +- [CSE_DiskQuota](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-diskquota) +- [CSE_EFSRecovery](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-efsrecovery) +- [CSE_FolderRedirection](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-folderredirection) +- [EnableLogonOptimization](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimization) +- [GPTransferRate_2](policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-2) +- [CSE_IEM](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-iem) +- [CSE_IPSecurity](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-ipsecurity) +- [LogonScriptDelay](policy-csp-admx-grouppolicy.md#admx-grouppolicy-logonscriptdelay) +- [CSE_Registry](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-registry) +- [CSE_Scripts](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-scripts) +- [CSE_Security](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-security) +- [CSE_AppMgmt](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-appmgmt) +- [UserPolicyMode](policy-csp-admx-grouppolicy.md#admx-grouppolicy-userpolicymode) +- [CSE_Wired](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wired) +- [CSE_Wireless](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wireless) +- [EnableCDP](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablecdp) +- [DenyRsopToInteractiveUser_2](policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-2) +- [ResetDfsClientInfoDuringRefreshPolicy](policy-csp-admx-grouppolicy.md#admx-grouppolicy-resetdfsclientinfoduringrefreshpolicy) +- [EnableLogonOptimizationOnServerSKU](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimizationonserversku) +- [EnableMMX](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablemmx) +- [DisableUsersFromMachGP](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableusersfrommachgp) +- [GroupPolicyRefreshRate](policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrate) +- [GroupPolicyRefreshRateDC](policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshratedc) +- [SyncWaitTime](policy-csp-admx-grouppolicy.md#admx-grouppolicy-syncwaittime) +- [CorpConnSyncWaitTime](policy-csp-admx-grouppolicy.md#admx-grouppolicy-corpconnsyncwaittime) +- [DisableBackgroundPolicy](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablebackgroundpolicy) +- [DisableAOACProcessing](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableaoacprocessing) +- [DisableLGPOProcessing](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablelgpoprocessing) +- [RSoPLogging](policy-csp-admx-grouppolicy.md#admx-grouppolicy-rsoplogging) +- [ProcessMitigationOptions](policy-csp-admx-grouppolicy.md#admx-grouppolicy-processmitigationoptions) +- [FontMitigation](policy-csp-admx-grouppolicy.md#admx-grouppolicy-fontmitigation) + +## ADMX_Help + +- [RestrictRunFromHelp](policy-csp-admx-help.md#admx-help-restrictrunfromhelp) +- [HelpQualifiedRootDir_Comp](policy-csp-admx-help.md#admx-help-helpqualifiedrootdir-comp) +- [RestrictRunFromHelp_Comp](policy-csp-admx-help.md#admx-help-restrictrunfromhelp-comp) +- [DisableHHDEP](policy-csp-admx-help.md#admx-help-disablehhdep) + +## ADMX_HelpAndSupport + +- [HPImplicitFeedback](policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpimplicitfeedback) +- [HPExplicitFeedback](policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpexplicitfeedback) +- [HPOnlineAssistance](policy-csp-admx-helpandsupport.md#admx-helpandsupport-hponlineassistance) +- [ActiveHelp](policy-csp-admx-helpandsupport.md#admx-helpandsupport-activehelp) + +## ADMX_hotspotauth + +- [HotspotAuth_Enable](policy-csp-admx-hotspotauth.md#admx-hotspotauth-hotspotauth-enable) + +## ADMX_ICM + +- [ShellNoUseStoreOpenWith_1](policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-1) +- [DisableWebPnPDownload_1](policy-csp-admx-icm.md#admx-icm-disablewebpnpdownload-1) +- [ShellPreventWPWDownload_1](policy-csp-admx-icm.md#admx-icm-shellpreventwpwdownload-1) +- [ShellNoUseInternetOpenWith_1](policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-1) +- [DisableHTTPPrinting_1](policy-csp-admx-icm.md#admx-icm-disablehttpprinting-1) +- [ShellRemoveOrderPrints_1](policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-1) +- [ShellRemovePublishToWeb_1](policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-1) +- [WinMSG_NoInstrumentation_1](policy-csp-admx-icm.md#admx-icm-winmsg-noinstrumentation-1) +- [InternetManagement_RestrictCommunication_1](policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-1) +- [RemoveWindowsUpdate_ICM](policy-csp-admx-icm.md#admx-icm-removewindowsupdate-icm) +- [ShellNoUseStoreOpenWith_2](policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-2) +- [CertMgr_DisableAutoRootUpdates](policy-csp-admx-icm.md#admx-icm-certmgr-disableautorootupdates) +- [EventViewer_DisableLinks](policy-csp-admx-icm.md#admx-icm-eventviewer-disablelinks) +- [HSS_HeadlinesPolicy](policy-csp-admx-icm.md#admx-icm-hss-headlinespolicy) +- [HSS_KBSearchPolicy](policy-csp-admx-icm.md#admx-icm-hss-kbsearchpolicy) +- [NC_ExitOnISP](policy-csp-admx-icm.md#admx-icm-nc-exitonisp) +- [ShellNoUseInternetOpenWith_2](policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-2) +- [NC_NoRegistration](policy-csp-admx-icm.md#admx-icm-nc-noregistration) +- [SearchCompanion_DisableFileUpdates](policy-csp-admx-icm.md#admx-icm-searchcompanion-disablefileupdates) +- [ShellRemoveOrderPrints_2](policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-2) +- [ShellRemovePublishToWeb_2](policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-2) +- [WinMSG_NoInstrumentation_2](policy-csp-admx-icm.md#admx-icm-winmsg-noinstrumentation-2) +- [CEIPEnable](policy-csp-admx-icm.md#admx-icm-ceipenable) +- [PCH_DoNotReport](policy-csp-admx-icm.md#admx-icm-pch-donotreport) +- [DriverSearchPlaces_DontSearchWindowsUpdate](policy-csp-admx-icm.md#admx-icm-driversearchplaces-dontsearchwindowsupdate) +- [InternetManagement_RestrictCommunication_2](policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-2) + +## ADMX_IIS + +- [PreventIISInstall](policy-csp-admx-iis.md#admx-iis-preventiisinstall) + +## ADMX_iSCSI + +- [iSCSIGeneral_RestrictAdditionalLogins](policy-csp-admx-iscsi.md#admx-iscsi-iscsigeneral-restrictadditionallogins) +- [iSCSIGeneral_ChangeIQNName](policy-csp-admx-iscsi.md#admx-iscsi-iscsigeneral-changeiqnname) +- [iSCSISecurity_ChangeCHAPSecret](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-changechapsecret) +- [iSCSISecurity_RequireIPSec](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-requireipsec) +- [iSCSISecurity_RequireMutualCHAP](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-requiremutualchap) +- [iSCSISecurity_RequireOneWayCHAP](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-requireonewaychap) +- [iSCSIDiscovery_NewStaticTargets](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-newstatictargets) +- [iSCSIDiscovery_ConfigureTargets](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-configuretargets) +- [iSCSIDiscovery_ConfigureiSNSServers](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-configureisnsservers) +- [iSCSIDiscovery_ConfigureTargetPortals](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-configuretargetportals) + +## ADMX_kdc + +- [CbacAndArmor](policy-csp-admx-kdc.md#admx-kdc-cbacandarmor) +- [PKINITFreshness](policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness) +- [emitlili](policy-csp-admx-kdc.md#admx-kdc-emitlili) +- [RequestCompoundId](policy-csp-admx-kdc.md#admx-kdc-requestcompoundid) +- [ForestSearch](policy-csp-admx-kdc.md#admx-kdc-forestsearch) +- [TicketSizeThreshold](policy-csp-admx-kdc.md#admx-kdc-ticketsizethreshold) + +## ADMX_Kerberos + +- [AlwaysSendCompoundId](policy-csp-admx-kerberos.md#admx-kerberos-alwayssendcompoundid) +- [HostToRealm](policy-csp-admx-kerberos.md#admx-kerberos-hosttorealm) +- [MitRealms](policy-csp-admx-kerberos.md#admx-kerberos-mitrealms) +- [KdcProxyDisableServerRevocationCheck](policy-csp-admx-kerberos.md#admx-kerberos-kdcproxydisableserverrevocationcheck) +- [StrictTarget](policy-csp-admx-kerberos.md#admx-kerberos-stricttarget) +- [KdcProxyServer](policy-csp-admx-kerberos.md#admx-kerberos-kdcproxyserver) +- [ServerAcceptsCompound](policy-csp-admx-kerberos.md#admx-kerberos-serveracceptscompound) +- [DevicePKInitEnabled](policy-csp-admx-kerberos.md#admx-kerberos-devicepkinitenabled) + +## ADMX_LanmanServer + +- [Pol_CipherSuiteOrder](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-ciphersuiteorder) +- [Pol_HashPublication](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) +- [Pol_HashSupportVersion](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) +- [Pol_HonorCipherSuiteOrder](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) + +## ADMX_LanmanWorkstation + +- [Pol_CipherSuiteOrder](policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-ciphersuiteorder) +- [Pol_EnableHandleCachingForCAFiles](policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enablehandlecachingforcafiles) +- [Pol_EnableOfflineFilesforCAShares](policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enableofflinefilesforcashares) + +## ADMX_LeakDiagnostic + +- [WdiScenarioExecutionPolicy](policy-csp-admx-leakdiagnostic.md#admx-leakdiagnostic-wdiscenarioexecutionpolicy) + +## ADMX_LinkLayerTopologyDiscovery + +- [LLTD_EnableLLTDIO](policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) +- [LLTD_EnableRspndr](policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) + +## ADMX_LocationProviderAdm + +- [DisableWindowsLocationProvider_1](policy-csp-admx-locationprovideradm.md#admx-locationprovideradm-disablewindowslocationprovider-1) + +## ADMX_Logon + +- [NoWelcomeTips_1](policy-csp-admx-logon.md#admx-logon-nowelcometips-1) +- [DisableExplorerRunLegacy_1](policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-1) +- [DisableExplorerRunOnceLegacy_1](policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-1) +- [Run_1](policy-csp-admx-logon.md#admx-logon-run-1) +- [VerboseStatus](policy-csp-admx-logon.md#admx-logon-verbosestatus) +- [UseOEMBackground](policy-csp-admx-logon.md#admx-logon-useoembackground) +- [SyncForegroundPolicy](policy-csp-admx-logon.md#admx-logon-syncforegroundpolicy) +- [BlockUserFromShowingAccountDetailsOnSignin](policy-csp-admx-logon.md#admx-logon-blockuserfromshowingaccountdetailsonsignin) +- [NoWelcomeTips_2](policy-csp-admx-logon.md#admx-logon-nowelcometips-2) +- [DontEnumerateConnectedUsers](policy-csp-admx-logon.md#admx-logon-dontenumerateconnectedusers) +- [DisableExplorerRunLegacy_2](policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-2) +- [DisableExplorerRunOnceLegacy_2](policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-2) +- [Run_2](policy-csp-admx-logon.md#admx-logon-run-2) +- [DisableAcrylicBackgroundOnLogon](policy-csp-admx-logon.md#admx-logon-disableacrylicbackgroundonlogon) +- [DisableStatusMessages](policy-csp-admx-logon.md#admx-logon-disablestatusmessages) + +## ADMX_MicrosoftDefenderAntivirus + +- [ServiceKeepAlive](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-servicekeepalive) +- [AllowFastServiceStartup](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-allowfastservicestartup) +- [UX_Configuration_CustomDefaultActionToastString](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring) +- [UX_Configuration_UILockdown](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-uilockdown) +- [UX_Configuration_Notification_Suppress](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress) +- [UX_Configuration_SuppressRebootNotification](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification) +- [DisableLocalAdminMerge](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablelocaladminmerge) +- [ProxyBypass](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxybypass) +- [ProxyPacUrl](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxypacurl) +- [ProxyServer](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxyserver) +- [Exclusions_Extensions](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-extensions) +- [Exclusions_Paths](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-paths) +- [Exclusions_Processes](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-processes) +- [DisableAutoExclusions](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableautoexclusions) +- [Spynet_LocalSettingOverrideSpynetReporting](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting) +- [DisableBlockAtFirstSeen](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableblockatfirstseen) +- [SpynetReporting](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynetreporting) +- [ExploitGuard_ASR_Rules](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-rules) +- [ExploitGuard_ASR_ASROnlyExclusions](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions) +- [ExploitGuard_ControlledFolderAccess_AllowedApplications](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications) +- [ExploitGuard_ControlledFolderAccess_ProtectedFolders](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders) +- [MpEngine_EnableFileHashComputation](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation) +- [Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid) +- [Nis_Consumers_IPS_DisableSignatureRetirement](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement) +- [Nis_DisableProtocolRecognition](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition) +- [Quarantine_LocalSettingOverridePurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay) +- [Quarantine_PurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay) +- [RandomizeScheduleTaskTimes](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-randomizescheduletasktimes) +- [RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection) +- [RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection) +- [RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection) +- [RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring) +- [RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring) +- [RealtimeProtection_IOAVMaxSize](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize) +- [RealtimeProtection_DisableOnAccessProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection) +- [RealtimeProtection_DisableIOAVProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection) +- [DisableRealtimeMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablerealtimemonitoring) +- [RealtimeProtection_DisableBehaviorMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring) +- [RealtimeProtection_DisableScanOnRealtimeEnable](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable) +- [RealtimeProtection_DisableRawWriteNotification](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification) +- [Remediation_LocalSettingOverrideScan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime) +- [Remediation_Scan_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduleday) +- [Remediation_Scan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduletime) +- [Reporting_CriticalFailureTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout) +- [Reporting_NonCriticalTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout) +- [Reporting_RecentlyCleanedTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout) +- [Reporting_AdditionalActionTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout) +- [Reporting_DisablegenericrePorts](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disablegenericreports) +- [Reporting_WppTracingComponents](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents) +- [Reporting_WppTracingLevel](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracinglevel) +- [Reporting_DisableEnhancedNotifications](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications) +- [Scan_AllowPause](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-allowpause) +- [Scan_LocalSettingOverrideAvgCPULoadFactor](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor) +- [Scan_LocalSettingOverrideScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday) +- [Scan_LocalSettingOverrideScheduleQuickScantime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime) +- [Scan_LocalSettingOverrideScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime) +- [Scan_LocalSettingOverrideScanParameters](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters) +- [Scan_LowCpuPriority](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-lowcpupriority) +- [Scan_DisableRestorePoint](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablerestorepoint) +- [Scan_MissedScheduledScanCountBeforeCatchup](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup) +- [Scan_DisableScanningMappedNetworkDrivesForFullScan](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan) +- [Scan_DisableArchiveScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablearchivescanning) +- [Scan_DisableScanningNetworkFiles](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles) +- [Scan_DisablePackedExeScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablepackedexescanning) +- [Scan_DisableRemovableDriveScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning) +- [Scan_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduleday) +- [Scan_QuickScanInterval](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-quickscaninterval) +- [Scan_ArchiveMaxDepth](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxdepth) +- [Scan_ArchiveMaxSize](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxsize) +- [Scan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduletime) +- [Scan_ScanOnlyIfIdle](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scanonlyifidle) +- [Scan_DisableEmailScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableemailscanning) +- [Scan_DisableHeuristics](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableheuristics) +- [Scan_PurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay) +- [Scan_DisableReparsePointScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning) +- [SignatureUpdate_SignatureDisableNotification](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification) +- [SignatureUpdate_RealtimeSignatureDelivery](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery) +- [SignatureUpdate_ForceUpdateFromMU](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu) +- [SignatureUpdate_DisableScheduledSignatureUpdateonBattery](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery) +- [SignatureUpdate_UpdateOnStartup](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup) +- [SignatureUpdate_DefinitionUpdateFileSharesSources](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources) +- [SignatureUpdate_SharedSignaturesLocation](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation) +- [SignatureUpdate_SignatureUpdateCatchupInterval](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval) +- [SignatureUpdate_ASSignatureDue](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue) +- [SignatureUpdate_AVSignatureDue](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue) +- [SignatureUpdate_FallbackOrder](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder) +- [SignatureUpdate_DisableUpdateOnStartupWithoutEngine](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine) +- [SignatureUpdate_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduleday) +- [SignatureUpdate_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduletime) +- [SignatureUpdate_DisableScanOnUpdate](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate) +- [Threats_ThreatIdDefaultAction](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-threats-threatiddefaultaction) +- [DisableAntiSpywareDefender](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableantispywaredefender) +- [DisableRoutinelyTakingAction](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableroutinelytakingaction) + +## ADMX_MMC + +- [MMC_Restrict_Author](policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-author) +- [MMC_Restrict_To_Permitted_Snapins](policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-to-permitted-snapins) +- [MMC_ActiveXControl](policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) +- [MMC_ExtendView](policy-csp-admx-mmc.md#admx-mmc-mmc-extendview) +- [MMC_LinkToWeb](policy-csp-admx-mmc.md#admx-mmc-mmc-linktoweb) + +## ADMX_MMCSnapins + +- [MMC_Net_Framework](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-net-framework) +- [MMC_ActiveDirDomTrusts](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirdomtrusts) +- [MMC_ActiveDirSitesServices](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirsitesservices) +- [MMC_ActiveDirUsersComp](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activediruserscomp) +- [MMC_ADSI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-adsi) +- [MMC_CertsTemplate](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certstemplate) +- [MMC_Certs](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certs) +- [MMC_CertAuth](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauth) +- [MMC_ComponentServices](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-componentservices) +- [MMC_ComputerManagement](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-computermanagement) +- [MMC_DeviceManager_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-2) +- [MMC_DiskDefrag](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskdefrag) +- [MMC_DiskMgmt](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskmgmt) +- [MMC_DFS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dfs) +- [MMC_EnterprisePKI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-enterprisepki) +- [MMC_EventViewer_3](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-3) +- [MMC_EventViewer_4](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-4) +- [MMC_AppleTalkRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-appletalkrouting) +- [MMC_AuthMan](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-authman) +- [MMC_CertAuthPolSet](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauthpolset) +- [MMC_ConnectionSharingNAT](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-connectionsharingnat) +- [MMC_DCOMCFG](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dcomcfg) +- [MMC_DeviceManager_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-1) +- [MMC_DHCPRelayMgmt](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dhcprelaymgmt) +- [MMC_EventViewer_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-1) +- [MMC_EventViewer_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-2) +- [MMC_IASLogging](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iaslogging) +- [MMC_IGMPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-igmprouting) +- [MMC_IPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iprouting) +- [MMC_IPXRIPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxriprouting) +- [MMC_IPXRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxrouting) +- [MMC_IPXSAPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxsaprouting) +- [MMC_LogicalMappedDrives](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-logicalmappeddrives) +- [MMC_OSPFRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ospfrouting) +- [MMC_PublicKey](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-publickey) +- [MMC_RAS_DialinUser](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ras-dialinuser) +- [MMC_RemoteAccess](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remoteaccess) +- [MMC_RemStore](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remstore) +- [MMC_RIPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-riprouting) +- [MMC_Routing](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-routing) +- [MMC_SendConsoleMessage](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sendconsolemessage) +- [MMC_ServiceDependencies](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servicedependencies) +- [MMC_SharedFolders_Ext](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders-ext) +- [MMC_SMTPProtocol](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-smtpprotocol) +- [MMC_SNMP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-snmp) +- [MMC_SysProp](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysprop) +- [MMC_FailoverClusters](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-failoverclusters) +- [MMC_FAXService](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-faxservice) +- [MMC_FrontPageExt](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-frontpageext) +- [MMC_GroupPolicyManagementSnapIn](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicymanagementsnapin) +- [MMC_GroupPolicySnapIn](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicysnapin) +- [MMC_ADMComputers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-1) +- [MMC_ADMUsers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-1) +- [MMC_FolderRedirection_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-1) +- [MMC_IEMaintenance_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-1) +- [MMC_IPSecManage_GP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage-gp) +- [MMC_NapSnap_GP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap-gp) +- [MMC_RIS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ris) +- [MMC_ScriptsUser_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-1) +- [MMC_ScriptsMachine_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-1) +- [MMC_SecuritySettings_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-1) +- [MMC_SoftwareInstalationComputers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-1) +- [MMC_SoftwareInstallationUsers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-1) +- [MMC_WindowsFirewall_GP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall-gp) +- [MMC_WiredNetworkPolicy](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirednetworkpolicy) +- [MMC_WirelessNetworkPolicy](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessnetworkpolicy) +- [MMC_GroupPolicyTab](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicytab) +- [MMC_ResultantSetOfPolicySnapIn](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-resultantsetofpolicysnapin) +- [MMC_ADMComputers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-2) +- [MMC_ADMUsers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-2) +- [MMC_FolderRedirection_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-2) +- [MMC_IEMaintenance_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-2) +- [MMC_ScriptsUser_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-2) +- [MMC_ScriptsMachine_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-2) +- [MMC_SecuritySettings_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-2) +- [MMC_SoftwareInstalationComputers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-2) +- [MMC_SoftwareInstallationUsers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-2) +- [MMC_HRA](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-hra) +- [MMC_IndexingService](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-indexingservice) +- [MMC_IAS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ias) +- [MMC_IIS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iis) +- [MMC_IpSecMonitor](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmonitor) +- [MMC_IpSecManage](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage) +- [MMC_LocalUsersGroups](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-localusersgroups) +- [MMC_NapSnap](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap) +- [MMC_NPSUI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-npsui) +- [MMC_OCSP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ocsp) +- [MMC_PerfLogsAlerts](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-perflogsalerts) +- [MMC_QoSAdmission](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-qosadmission) +- [MMC_TerminalServices](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-terminalservices) +- [MMC_RemoteDesktop](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remotedesktop) +- [MMC_RSM](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rsm) +- [MMC_RRA](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rra) +- [MMC_SCA](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sca) +- [MMC_SecurityTemplates](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitytemplates) +- [MMC_ServerManager](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servermanager) +- [MMC_Services](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-services) +- [MMC_SharedFolders](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders) +- [MMC_SysInfo](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysinfo) +- [MMC_Telephony](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-telephony) +- [MMC_TPMManagement](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-tpmmanagement) +- [MMC_WindowsFirewall](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall) +- [MMC_WirelessMon](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessmon) +- [MMC_WMI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wmi) + +## ADMX_MobilePCMobilityCenter + +- [MobilityCenterEnable_1](policy-csp-admx-mobilepcmobilitycenter.md#admx-mobilepcmobilitycenter-mobilitycenterenable-1) +- [MobilityCenterEnable_2](policy-csp-admx-mobilepcmobilitycenter.md#admx-mobilepcmobilitycenter-mobilitycenterenable-2) + +## ADMX_MobilePCPresentationSettings + +- [PresentationSettingsEnable_1](policy-csp-admx-mobilepcpresentationsettings.md#admx-mobilepcpresentationsettings-presentationsettingsenable-1) +- [PresentationSettingsEnable_2](policy-csp-admx-mobilepcpresentationsettings.md#admx-mobilepcpresentationsettings-presentationsettingsenable-2) + +## ADMX_MSAPolicy + +- [MicrosoftAccount_DisableUserAuth](policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) + +## ADMX_msched + +- [ActivationBoundaryPolicy](policy-csp-admx-msched.md#admx-msched-activationboundarypolicy) +- [RandomDelayPolicy](policy-csp-admx-msched.md#admx-msched-randomdelaypolicy) + +## ADMX_MSDT + +- [WdiScenarioExecutionPolicy](policy-csp-admx-msdt.md#admx-msdt-wdiscenarioexecutionpolicy) +- [MsdtToolDownloadPolicy](policy-csp-admx-msdt.md#admx-msdt-msdttooldownloadpolicy) +- [MsdtSupportProvider](policy-csp-admx-msdt.md#admx-msdt-msdtsupportprovider) + +## ADMX_MSI + +- [DisableMedia](policy-csp-admx-msi.md#admx-msi-disablemedia) +- [DisableRollback_1](policy-csp-admx-msi.md#admx-msi-disablerollback-1) +- [SearchOrder](policy-csp-admx-msi.md#admx-msi-searchorder) +- [AllowLockdownBrowse](policy-csp-admx-msi.md#admx-msi-allowlockdownbrowse) +- [AllowLockdownPatch](policy-csp-admx-msi.md#admx-msi-allowlockdownpatch) +- [AllowLockdownMedia](policy-csp-admx-msi.md#admx-msi-allowlockdownmedia) +- [MSI_MaxPatchCacheSize](policy-csp-admx-msi.md#admx-msi-msi-maxpatchcachesize) +- [MSI_EnforceUpgradeComponentRules](policy-csp-admx-msi.md#admx-msi-msi-enforceupgradecomponentrules) +- [MsiDisableEmbeddedUI](policy-csp-admx-msi.md#admx-msi-msidisableembeddedui) +- [SafeForScripting](policy-csp-admx-msi.md#admx-msi-safeforscripting) +- [DisablePatch](policy-csp-admx-msi.md#admx-msi-disablepatch) +- [DisableFlyweightPatching](policy-csp-admx-msi.md#admx-msi-disableflyweightpatching) +- [MSI_DisableLUAPatching](policy-csp-admx-msi.md#admx-msi-msi-disableluapatching) +- [MSI_DisablePatchUninstall](policy-csp-admx-msi.md#admx-msi-msi-disablepatchuninstall) +- [DisableRollback_2](policy-csp-admx-msi.md#admx-msi-disablerollback-2) +- [DisableAutomaticApplicationShutdown](policy-csp-admx-msi.md#admx-msi-disableautomaticapplicationshutdown) +- [MSI_DisableUserInstalls](policy-csp-admx-msi.md#admx-msi-msi-disableuserinstalls) +- [DisableBrowse](policy-csp-admx-msi.md#admx-msi-disablebrowse) +- [TransformsSecure](policy-csp-admx-msi.md#admx-msi-transformssecure) +- [MSILogging](policy-csp-admx-msi.md#admx-msi-msilogging) +- [MSI_DisableSRCheckPoints](policy-csp-admx-msi.md#admx-msi-msi-disablesrcheckpoints) +- [DisableLoggingFromPackage](policy-csp-admx-msi.md#admx-msi-disableloggingfrompackage) +- [DisableSharedComponent](policy-csp-admx-msi.md#admx-msi-disablesharedcomponent) +- [DisableMSI](policy-csp-admx-msi.md#admx-msi-disablemsi) + +## ADMX_MsiFileRecovery + +- [WdiScenarioExecutionPolicy](policy-csp-admx-msifilerecovery.md#admx-msifilerecovery-wdiscenarioexecutionpolicy) + +## ADMX_MSS-legacy + +- [Pol_MSS_AutoAdminLogon](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autoadminlogon) +- [Pol_MSS_AutoReboot](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autoreboot) +- [Pol_MSS_AutoShareServer](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autoshareserver) +- [Pol_MSS_AutoShareWks](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autosharewks) +- [Pol_MSS_DisableSavePassword](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-disablesavepassword) +- [Pol_MSS_EnableDeadGWDetect](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-enabledeadgwdetect) +- [Pol_MSS_HideFromBrowseList](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-hidefrombrowselist) +- [Pol_MSS_KeepAliveTime](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-keepalivetime) +- [Pol_MSS_NoDefaultExempt](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-nodefaultexempt) +- [Pol_MSS_NtfsDisable8dot3NameCreation](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-ntfsdisable8dot3namecreation) +- [Pol_MSS_PerformRouterDiscovery](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-performrouterdiscovery) +- [Pol_MSS_SafeDllSearchMode](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-safedllsearchmode) +- [Pol_MSS_ScreenSaverGracePeriod](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-screensavergraceperiod) +- [Pol_MSS_SynAttackProtect](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-synattackprotect) +- [Pol_MSS_TcpMaxConnectResponseRetransmissions](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-tcpmaxconnectresponseretransmissions) +- [Pol_MSS_TcpMaxDataRetransmissionsIPv6](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-tcpmaxdataretransmissionsipv6) +- [Pol_MSS_TcpMaxDataRetransmissions](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-tcpmaxdataretransmissions) +- [Pol_MSS_WarningLevel](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-warninglevel) + +## ADMX_nca + +- [CorporateResources](policy-csp-admx-nca.md#admx-nca-corporateresources) +- [CustomCommands](policy-csp-admx-nca.md#admx-nca-customcommands) +- [PassiveMode](policy-csp-admx-nca.md#admx-nca-passivemode) +- [FriendlyName](policy-csp-admx-nca.md#admx-nca-friendlyname) +- [DTEs](policy-csp-admx-nca.md#admx-nca-dtes) +- [LocalNamesOn](policy-csp-admx-nca.md#admx-nca-localnameson) +- [SupportEmail](policy-csp-admx-nca.md#admx-nca-supportemail) +- [ShowUI](policy-csp-admx-nca.md#admx-nca-showui) + +## ADMX_NCSI + +- [NCSI_CorpDnsProbeContent](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobecontent) +- [NCSI_CorpDnsProbeHost](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobehost) +- [NCSI_CorpSitePrefixes](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpsiteprefixes) +- [NCSI_CorpWebProbeUrl](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpwebprobeurl) +- [NCSI_DomainLocationDeterminationUrl](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-domainlocationdeterminationurl) +- [NCSI_GlobalDns](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-globaldns) +- [NCSI_PassivePolling](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-passivepolling) + +## ADMX_Netlogon + +- [Netlogon_AllowNT4Crypto](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allownt4crypto) +- [Netlogon_AvoidPdcOnWan](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidpdconwan) +- [Netlogon_IgnoreIncomingMailslotMessages](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ignoreincomingmailslotmessages) +- [Netlogon_AvoidFallbackNetbiosDiscovery](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidfallbacknetbiosdiscovery) +- [Netlogon_ForceRediscoveryInterval](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-forcerediscoveryinterval) +- [Netlogon_AddressTypeReturned](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresstypereturned) +- [Netlogon_LdapSrvPriority](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvpriority) +- [Netlogon_DnsTtl](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsttl) +- [Netlogon_LdapSrvWeight](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvweight) +- [Netlogon_AddressLookupOnPingBehavior](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresslookuponpingbehavior) +- [Netlogon_DnsAvoidRegisterRecords](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsavoidregisterrecords) +- [Netlogon_UseDynamicDns](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-usedynamicdns) +- [Netlogon_DnsRefreshInterval](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsrefreshinterval) +- [Netlogon_NdncSiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ndncsitecoverage) +- [Netlogon_SiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitecoverage) +- [Netlogon_GcSiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-gcsitecoverage) +- [Netlogon_TryNextClosestSite](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-trynextclosestsite) +- [Netlogon_AutoSiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-autositecoverage) +- [Netlogon_AllowDnsSuffixSearch](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowdnssuffixsearch) +- [Netlogon_AllowSingleLabelDnsDomain](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowsinglelabeldnsdomain) +- [Netlogon_DnsSrvRecordUseLowerCaseHostNames](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnssrvrecorduselowercasehostnames) +- [Netlogon_NetlogonShareCompatibilityMode](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-netlogonsharecompatibilitymode) +- [Netlogon_ScavengeInterval](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-scavengeinterval) +- [Netlogon_SysvolShareCompatibilityMode](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sysvolsharecompatibilitymode) +- [Netlogon_ExpectedDialupDelay](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-expecteddialupdelay) +- [Netlogon_DebugFlag](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-debugflag) +- [Netlogon_MaximumLogFileSize](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-maximumlogfilesize) +- [Netlogon_NegativeCachePeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-negativecacheperiod) +- [Netlogon_NonBackgroundSuccessfulRefreshPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-nonbackgroundsuccessfulrefreshperiod) +- [Netlogon_SiteName](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitename) +- [Netlogon_BackgroundRetryQuitTime](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryquittime) +- [Netlogon_BackgroundRetryInitialPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryinitialperiod) +- [Netlogon_BackgroundRetryMaximumPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretrymaximumperiod) +- [Netlogon_BackgroundSuccessfulRefreshPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundsuccessfulrefreshperiod) +- [Netlogon_PingUrgencyMode](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-pingurgencymode) + +## ADMX_NetworkConnections + +- [NC_RasAllUserProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasalluserproperties) +- [NC_DeleteAllUserConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deletealluserconnection) +- [NC_LanConnect](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanconnect) +- [NC_RenameAllUserRasConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamealluserrasconnection) +- [NC_RenameLanConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamelanconnection) +- [NC_RenameConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renameconnection) +- [NC_EnableAdminProhibits](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-enableadminprohibits) +- [NC_LanProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanproperties) +- [NC_LanChangeProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanchangeproperties) +- [NC_RasChangeProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-raschangeproperties) +- [NC_AdvancedSettings](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-advancedsettings) +- [NC_NewConnectionWizard](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-newconnectionwizard) +- [NC_DialupPrefs](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-dialupprefs) +- [NC_AddRemoveComponents](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-addremovecomponents) +- [NC_RasMyProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasmyproperties) +- [NC_RasConnect](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasconnect) +- [NC_DeleteConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deleteconnection) +- [NC_ChangeBindState](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-changebindstate) +- [NC_RenameMyRasConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamemyrasconnection) +- [NC_AllowAdvancedTCPIPConfig](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-allowadvancedtcpipconfig) +- [NC_Statistics](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) +- [NC_IpStateChecking](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-ipstatechecking) +- [NC_DoNotShowLocalOnlyIcon](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-donotshowlocalonlyicon) +- [NC_PersonalFirewallConfig](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-personalfirewallconfig) +- [NC_ShowSharedAccessUI](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) +- [NC_StdDomainUserSetLocation](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) +- [NC_ForceTunneling](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-forcetunneling) + +## ADMX_OfflineFiles + +- [Pol_GoOfflineAction_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-1) +- [Pol_EventLoggingLevel_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-1) +- [Pol_ReminderInitTimeout_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-1) +- [Pol_CustomGoOfflineActions_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-1) +- [Pol_NoCacheViewer_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-1) +- [Pol_NoConfigCache_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-1) +- [Pol_ReminderFreq_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-1) +- [Pol_ReminderTimeout_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-1) +- [Pol_NoMakeAvailableOffline_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-1) +- [Pol_NoPinFiles_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-1) +- [Pol_WorkOfflineDisabled_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-1) +- [Pol_AssignedOfflineFiles_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) +- [Pol_SyncAtLogoff_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-1) +- [Pol_SyncAtLogon_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-1) +- [Pol_SyncAtSuspend_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-1) +- [Pol_NoReminders_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-1) +- [Pol_GoOfflineAction_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-2) +- [Pol_Enabled](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-enabled) +- [Pol_PurgeAtLogoff](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-purgeatlogoff) +- [Pol_BackgroundSyncSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-backgroundsyncsettings) +- [Pol_SlowLinkSpeed](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinkspeed) +- [Pol_SlowLinkSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinksettings) +- [Pol_DefCacheSize](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-defcachesize) +- [Pol_ExclusionListSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-exclusionlistsettings) +- [Pol_SyncOnCostedNetwork](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-synconcostednetwork) +- [Pol_OnlineCachingSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-onlinecachingsettings) +- [Pol_EncryptOfflineFiles](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-encryptofflinefiles) +- [Pol_EventLoggingLevel_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-2) +- [Pol_ExtExclusionList](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-extexclusionlist) +- [Pol_ReminderInitTimeout_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-2) +- [Pol_CacheSize](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-cachesize) +- [Pol_CustomGoOfflineActions_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-2) +- [Pol_NoCacheViewer_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-2) +- [Pol_NoConfigCache_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-2) +- [Pol_ReminderFreq_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-2) +- [Pol_ReminderTimeout_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-2) +- [Pol_NoMakeAvailableOffline_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-2) +- [Pol_NoPinFiles_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-2) +- [Pol_WorkOfflineDisabled_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-2) +- [Pol_AssignedOfflineFiles_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) +- [Pol_AlwaysPinSubFolders](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) +- [Pol_SyncAtLogoff_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-2) +- [Pol_SyncAtLogon_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-2) +- [Pol_SyncAtSuspend_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-2) +- [Pol_NoReminders_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-2) +- [Pol_QuickAdimPin](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-quickadimpin) + +## ADMX_pca + +- [DetectDeprecatedCOMComponentFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectdeprecatedcomcomponentfailurespolicy) +- [DetectDeprecatedComponentFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectdeprecatedcomponentfailurespolicy) +- [DetectInstallFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectinstallfailurespolicy) +- [DetectUndetectedInstallersPolicy](policy-csp-admx-pca.md#admx-pca-detectundetectedinstallerspolicy) +- [DetectUpdateFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectupdatefailurespolicy) +- [DisablePcaUIPolicy](policy-csp-admx-pca.md#admx-pca-disablepcauipolicy) +- [DetectBlockedDriversPolicy](policy-csp-admx-pca.md#admx-pca-detectblockeddriverspolicy) + +## ADMX_PeerToPeerCaching + +- [EnableWindowsBranchCache_SMB](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-smb) +- [SetDowngrading](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdowngrading) +- [EnableWindowsBranchCache_HostedMultipleServers](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedmultipleservers) +- [EnableWindowsBranchCache_HostedCacheDiscovery](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedcachediscovery) +- [SetDataCacheEntryMaxAge](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdatacacheentrymaxage) +- [EnableWindowsBranchCache_Distributed](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-distributed) +- [EnableWindowsBranchCache_Hosted](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hosted) +- [SetCachePercent](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setcachepercent) +- [EnableWindowsBranchCache](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache) + +## ADMX_PenTraining + +- [PenTrainingOff_1](policy-csp-admx-pentraining.md#admx-pentraining-pentrainingoff-1) +- [PenTrainingOff_2](policy-csp-admx-pentraining.md#admx-pentraining-pentrainingoff-2) + +## ADMX_PerformanceDiagnostics + +- [WdiScenarioExecutionPolicy_1](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-1) +- [WdiScenarioExecutionPolicy_3](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-3) +- [WdiScenarioExecutionPolicy_4](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-4) +- [WdiScenarioExecutionPolicy_2](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-2) + +## ADMX_Power + +- [PW_PromptPasswordOnResume](policy-csp-admx-power.md#admx-power-pw-promptpasswordonresume) +- [Dont_PowerOff_AfterShutdown](policy-csp-admx-power.md#admx-power-dont-poweroff-aftershutdown) +- [DCStartMenuButtonAction_2](policy-csp-admx-power.md#admx-power-dcstartmenubuttonaction-2) +- [ACStartMenuButtonAction_2](policy-csp-admx-power.md#admx-power-acstartmenubuttonaction-2) +- [DiskDCPowerDownTimeOut_2](policy-csp-admx-power.md#admx-power-diskdcpowerdowntimeout-2) +- [DiskACPowerDownTimeOut_2](policy-csp-admx-power.md#admx-power-diskacpowerdowntimeout-2) +- [DCBatteryDischargeAction0_2](policy-csp-admx-power.md#admx-power-dcbatterydischargeaction0-2) +- [DCBatteryDischargeLevel0_2](policy-csp-admx-power.md#admx-power-dcbatterydischargelevel0-2) +- [DCBatteryDischargeAction1_2](policy-csp-admx-power.md#admx-power-dcbatterydischargeaction1-2) +- [DCBatteryDischargeLevel1_2](policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1-2) +- [ReserveBatteryNotificationLevel](policy-csp-admx-power.md#admx-power-reservebatterynotificationlevel) +- [DCBatteryDischargeLevel1UINotification_2](policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1uinotification-2) +- [PowerThrottlingTurnOff](policy-csp-admx-power.md#admx-power-powerthrottlingturnoff) +- [InboxActiveSchemeOverride_2](policy-csp-admx-power.md#admx-power-inboxactiveschemeoverride-2) +- [AllowSystemPowerRequestDC](policy-csp-admx-power.md#admx-power-allowsystempowerrequestdc) +- [AllowSystemPowerRequestAC](policy-csp-admx-power.md#admx-power-allowsystempowerrequestac) +- [AllowSystemSleepWithRemoteFilesOpenDC](policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopendc) +- [AllowSystemSleepWithRemoteFilesOpenAC](policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopenac) +- [DCConnectivityInStandby_2](policy-csp-admx-power.md#admx-power-dcconnectivityinstandby-2) +- [ACConnectivityInStandby_2](policy-csp-admx-power.md#admx-power-acconnectivityinstandby-2) +- [DCCriticalSleepTransitionsDisable_2](policy-csp-admx-power.md#admx-power-dccriticalsleeptransitionsdisable-2) +- [ACCriticalSleepTransitionsDisable_2](policy-csp-admx-power.md#admx-power-accriticalsleeptransitionsdisable-2) +- [CustomActiveSchemeOverride_2](policy-csp-admx-power.md#admx-power-customactiveschemeoverride-2) +- [EnableDesktopSlideShowDC](policy-csp-admx-power.md#admx-power-enabledesktopslideshowdc) +- [EnableDesktopSlideShowAC](policy-csp-admx-power.md#admx-power-enabledesktopslideshowac) + +## ADMX_PowerShellExecutionPolicy + +- [EnableUpdateHelpDefaultSourcePath](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) +- [EnableModuleLogging](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) +- [EnableTranscripting](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) +- [EnableScripts](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) +- [EnableUpdateHelpDefaultSourcePath](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) +- [EnableModuleLogging](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) +- [EnableTranscripting](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) +- [EnableScripts](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) + +## ADMX_PreviousVersions + +- [DisableLocalPage_1](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalpage-1) +- [DisableRemotePage_1](policy-csp-admx-previousversions.md#admx-previousversions-disableremotepage-1) +- [HideBackupEntries_1](policy-csp-admx-previousversions.md#admx-previousversions-hidebackupentries-1) +- [DisableLocalRestore_1](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalrestore-1) +- [DisableBackupRestore_1](policy-csp-admx-previousversions.md#admx-previousversions-disablebackuprestore-1) +- [DisableRemoteRestore_1](policy-csp-admx-previousversions.md#admx-previousversions-disableremoterestore-1) +- [DisableLocalPage_2](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalpage-2) +- [DisableRemotePage_2](policy-csp-admx-previousversions.md#admx-previousversions-disableremotepage-2) +- [HideBackupEntries_2](policy-csp-admx-previousversions.md#admx-previousversions-hidebackupentries-2) +- [DisableLocalRestore_2](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalrestore-2) +- [DisableBackupRestore_2](policy-csp-admx-previousversions.md#admx-previousversions-disablebackuprestore-2) +- [DisableRemoteRestore_2](policy-csp-admx-previousversions.md#admx-previousversions-disableremoterestore-2) + +## ADMX_Printing + +- [IntranetPrintersUrl](policy-csp-admx-printing.md#admx-printing-intranetprintersurl) +- [DownlevelBrowse](policy-csp-admx-printing.md#admx-printing-downlevelbrowse) +- [PrinterDirectorySearchScope](policy-csp-admx-printing.md#admx-printing-printerdirectorysearchscope) +- [PackagePointAndPrintOnly](policy-csp-admx-printing.md#admx-printing-packagepointandprintonly) +- [PackagePointAndPrintServerList](policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist) +- [NoDeletePrinter](policy-csp-admx-printing.md#admx-printing-nodeleteprinter) +- [LegacyDefaultPrinterMode](policy-csp-admx-printing.md#admx-printing-legacydefaultprintermode) +- [AllowWebPrinting](policy-csp-admx-printing.md#admx-printing-allowwebprinting) +- [DomainPrinters](policy-csp-admx-printing.md#admx-printing-domainprinters) +- [NonDomainPrinters](policy-csp-admx-printing.md#admx-printing-nondomainprinters) +- [ShowJobTitleInEventLogs](policy-csp-admx-printing.md#admx-printing-showjobtitleineventlogs) +- [ForceSoftwareRasterization](policy-csp-admx-printing.md#admx-printing-forcesoftwarerasterization) +- [EMFDespooling](policy-csp-admx-printing.md#admx-printing-emfdespooling) +- [MXDWUseLegacyOutputFormatMSXPS](policy-csp-admx-printing.md#admx-printing-mxdwuselegacyoutputformatmsxps) +- [PhysicalLocation](policy-csp-admx-printing.md#admx-printing-physicallocation) +- [CustomizedSupportUrl](policy-csp-admx-printing.md#admx-printing-customizedsupporturl) +- [KMPrintersAreBlocked](policy-csp-admx-printing.md#admx-printing-kmprintersareblocked) +- [V4DriverDisallowPrinterExtension](policy-csp-admx-printing.md#admx-printing-v4driverdisallowprinterextension) +- [PrintDriverIsolationExecutionPolicy](policy-csp-admx-printing.md#admx-printing-printdriverisolationexecutionpolicy) +- [DoNotInstallCompatibleDriverFromWindowsUpdate](policy-csp-admx-printing.md#admx-printing-donotinstallcompatibledriverfromwindowsupdate) +- [ApplicationDriverIsolation](policy-csp-admx-printing.md#admx-printing-applicationdriverisolation) +- [PackagePointAndPrintOnly_Win7](policy-csp-admx-printing.md#admx-printing-packagepointandprintonly-win7) +- [PrintDriverIsolationOverrideCompat](policy-csp-admx-printing.md#admx-printing-printdriverisolationoverridecompat) +- [PackagePointAndPrintServerList_Win7](policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist-win7) +- [PhysicalLocationSupport](policy-csp-admx-printing.md#admx-printing-physicallocationsupport) +- [PrinterServerThread](policy-csp-admx-printing.md#admx-printing-printerserverthread) + +## ADMX_Printing2 + +- [RegisterSpoolerRemoteRpcEndPoint](policy-csp-admx-printing2.md#admx-printing2-registerspoolerremoterpcendpoint) +- [ImmortalPrintQueue](policy-csp-admx-printing2.md#admx-printing2-immortalprintqueue) +- [AutoPublishing](policy-csp-admx-printing2.md#admx-printing2-autopublishing) +- [VerifyPublishedState](policy-csp-admx-printing2.md#admx-printing2-verifypublishedstate) +- [PruningInterval](policy-csp-admx-printing2.md#admx-printing2-pruninginterval) +- [PruningPriority](policy-csp-admx-printing2.md#admx-printing2-pruningpriority) +- [PruningRetries](policy-csp-admx-printing2.md#admx-printing2-pruningretries) +- [PruningRetryLog](policy-csp-admx-printing2.md#admx-printing2-pruningretrylog) +- [PruneDownlevel](policy-csp-admx-printing2.md#admx-printing2-prunedownlevel) + +## ADMX_Programs + +- [NoGetPrograms](policy-csp-admx-programs.md#admx-programs-nogetprograms) +- [NoInstalledUpdates](policy-csp-admx-programs.md#admx-programs-noinstalledupdates) +- [NoProgramsAndFeatures](policy-csp-admx-programs.md#admx-programs-noprogramsandfeatures) +- [NoDefaultPrograms](policy-csp-admx-programs.md#admx-programs-nodefaultprograms) +- [NoWindowsFeatures](policy-csp-admx-programs.md#admx-programs-nowindowsfeatures) +- [NoWindowsMarketplace](policy-csp-admx-programs.md#admx-programs-nowindowsmarketplace) +- [NoProgramsCPL](policy-csp-admx-programs.md#admx-programs-noprogramscpl) + +## ADMX_PushToInstall + +- [DisablePushToInstall](policy-csp-admx-pushtoinstall.md#admx-pushtoinstall-disablepushtoinstall) + +## ADMX_QOS + +- [QosServiceTypeBestEffort_C](policy-csp-admx-qos.md#admx-qos-qosservicetypebesteffort-c) +- [QosServiceTypeControlledLoad_C](policy-csp-admx-qos.md#admx-qos-qosservicetypecontrolledload-c) +- [QosServiceTypeGuaranteed_C](policy-csp-admx-qos.md#admx-qos-qosservicetypeguaranteed-c) +- [QosServiceTypeNetworkControl_C](policy-csp-admx-qos.md#admx-qos-qosservicetypenetworkcontrol-c) +- [QosServiceTypeQualitative_C](policy-csp-admx-qos.md#admx-qos-qosservicetypequalitative-c) +- [QosServiceTypeBestEffort_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypebesteffort-nc) +- [QosServiceTypeControlledLoad_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypecontrolledload-nc) +- [QosServiceTypeGuaranteed_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypeguaranteed-nc) +- [QosServiceTypeNetworkControl_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypenetworkcontrol-nc) +- [QosServiceTypeQualitative_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypequalitative-nc) +- [QosServiceTypeBestEffort_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypebesteffort-pv) +- [QosServiceTypeControlledLoad_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypecontrolledload-pv) +- [QosServiceTypeGuaranteed_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypeguaranteed-pv) +- [QosServiceTypeNetworkControl_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypenetworkcontrol-pv) +- [QosServiceTypeNonConforming](policy-csp-admx-qos.md#admx-qos-qosservicetypenonconforming) +- [QosServiceTypeQualitative_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypequalitative-pv) +- [QosMaxOutstandingSends](policy-csp-admx-qos.md#admx-qos-qosmaxoutstandingsends) +- [QosNonBestEffortLimit](policy-csp-admx-qos.md#admx-qos-qosnonbesteffortlimit) +- [QosTimerResolution](policy-csp-admx-qos.md#admx-qos-qostimerresolution) + +## ADMX_Radar + +- [WdiScenarioExecutionPolicy](policy-csp-admx-radar.md#admx-radar-wdiscenarioexecutionpolicy) + +## ADMX_Reliability + +- [ShutdownEventTrackerStateFile](policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) +- [ShutdownReason](policy-csp-admx-reliability.md#admx-reliability-shutdownreason) +- [EE_EnablePersistentTimeStamp](policy-csp-admx-reliability.md#admx-reliability-ee-enablepersistenttimestamp) +- [PCH_ReportShutdownEvents](policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) + +## ADMX_RemoteAssistance + +- [RA_EncryptedTicketOnly](policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-encryptedticketonly) +- [RA_Optimize_Bandwidth](policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-optimize-bandwidth) + +## ADMX_RemovableStorage + +- [RemovableStorageClasses_DenyAll_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-1) +- [CDandDVD_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-1) +- [CDandDVD_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-1) +- [CustomClasses_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-1) +- [CustomClasses_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-1) +- [FloppyDrives_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-1) +- [FloppyDrives_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-1) +- [RemovableDisks_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-1) +- [RemovableDisks_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denywrite-access-1) +- [AccessRights_RebootTime_1](policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-1) +- [TapeDrives_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-1) +- [TapeDrives_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-1) +- [WPDDevices_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-1) +- [WPDDevices_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-1) +- [RemovableStorageClasses_DenyAll_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-2) +- [Removable_Remote_Allow_Access](policy-csp-admx-removablestorage.md#admx-removablestorage-removable-remote-allow-access) +- [CDandDVD_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyexecute-access-2) +- [CDandDVD_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-2) +- [CDandDVD_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-2) +- [CustomClasses_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-2) +- [CustomClasses_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-2) +- [FloppyDrives_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyexecute-access-2) +- [FloppyDrives_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-2) +- [FloppyDrives_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-2) +- [RemovableDisks_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyexecute-access-2) +- [RemovableDisks_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-2) +- [AccessRights_RebootTime_2](policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-2) +- [TapeDrives_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyexecute-access-2) +- [TapeDrives_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-2) +- [TapeDrives_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-2) +- [WPDDevices_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-2) +- [WPDDevices_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-2) + +## ADMX_RPC + +- [RpcIgnoreDelegationFailure](policy-csp-admx-rpc.md#admx-rpc-rpcignoredelegationfailure) +- [RpcStateInformation](policy-csp-admx-rpc.md#admx-rpc-rpcstateinformation) +- [RpcExtendedErrorInformation](policy-csp-admx-rpc.md#admx-rpc-rpcextendederrorinformation) +- [RpcMinimumHttpConnectionTimeout](policy-csp-admx-rpc.md#admx-rpc-rpcminimumhttpconnectiontimeout) + +## ADMX_sam + +- [SamNGCKeyROCAValidation](policy-csp-admx-sam.md#admx-sam-samngckeyrocavalidation) + +## ADMX_Scripts + +- [Run_Logoff_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-logoff-script-visible) +- [Run_Logon_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-logon-script-visible) +- [Run_Legacy_Logon_Script_Hidden](policy-csp-admx-scripts.md#admx-scripts-run-legacy-logon-script-hidden) +- [Run_Logon_Script_Sync_1](policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-1) +- [Run_User_PS_Scripts_First](policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) +- [Allow_Logon_Script_NetbiosDisabled](policy-csp-admx-scripts.md#admx-scripts-allow-logon-script-netbiosdisabled) +- [Run_Shutdown_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-shutdown-script-visible) +- [Run_Startup_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-startup-script-visible) +- [Run_Logon_Script_Sync_2](policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-2) +- [Run_Startup_Script_Sync](policy-csp-admx-scripts.md#admx-scripts-run-startup-script-sync) +- [Run_Computer_PS_Scripts_First](policy-csp-admx-scripts.md#admx-scripts-run-computer-ps-scripts-first) +- [Run_User_PS_Scripts_First](policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) +- [MaxGPOScriptWaitPolicy](policy-csp-admx-scripts.md#admx-scripts-maxgposcriptwaitpolicy) + +## ADMX_sdiageng + +- [ScriptedDiagnosticsSecurityPolicy](policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy) +- [ScriptedDiagnosticsExecutionPolicy](policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticsexecutionpolicy) +- [BetterWhenConnected](policy-csp-admx-sdiageng.md#admx-sdiageng-betterwhenconnected) + +## ADMX_sdiagschd + +- [ScheduledDiagnosticsExecutionPolicy](policy-csp-admx-sdiagschd.md#admx-sdiagschd-scheduleddiagnosticsexecutionpolicy) + +## ADMX_Securitycenter + +- [SecurityCenter_SecurityCenterInDomain](policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain) + +## ADMX_Sensors + +- [DisableLocation_1](policy-csp-admx-sensors.md#admx-sensors-disablelocation-1) +- [DisableLocationScripting_1](policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-1) +- [DisableSensors_1](policy-csp-admx-sensors.md#admx-sensors-disablesensors-1) +- [DisableLocationScripting_2](policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-2) +- [DisableSensors_2](policy-csp-admx-sensors.md#admx-sensors-disablesensors-2) + +## ADMX_ServerManager + +- [Do_not_display_Manage_Your_Server_page](policy-csp-admx-servermanager.md#admx-servermanager-do-not-display-manage-your-server-page) +- [ServerManagerAutoRefreshRate](policy-csp-admx-servermanager.md#admx-servermanager-servermanagerautorefreshrate) +- [DoNotLaunchInitialConfigurationTasks](policy-csp-admx-servermanager.md#admx-servermanager-donotlaunchinitialconfigurationtasks) +- [DoNotLaunchServerManager](policy-csp-admx-servermanager.md#admx-servermanager-donotlaunchservermanager) + +## ADMX_Servicing + +- [Servicing](policy-csp-admx-servicing.md#admx-servicing-servicing) + +## ADMX_SettingSync + +- [DisableSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablesettingsync) +- [DisableApplicationSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disableapplicationsettingsync) +- [DisableAppSyncSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disableappsyncsettingsync) +- [DisableDesktopThemeSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disabledesktopthemesettingsync) +- [DisableSyncOnPaidNetwork](policy-csp-admx-settingsync.md#admx-settingsync-disablesynconpaidnetwork) +- [DisableWindowsSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablewindowssettingsync) +- [DisableCredentialsSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablecredentialssettingsync) +- [DisablePersonalizationSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablepersonalizationsettingsync) +- [DisableStartLayoutSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablestartlayoutsettingsync) + +## ADMX_SharedFolders + +- [PublishDfsRoots](policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) +- [PublishSharedFolders](policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) + +## ADMX_Sharing + +- [NoInplaceSharing](policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) +- [DisableHomeGroup](policy-csp-admx-sharing.md#admx-sharing-disablehomegroup) + +## ADMX_ShellCommandPromptRegEditTools + +- [DisallowApps](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) +- [DisableRegedit](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) +- [DisableCMD](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [RestrictApps](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-restrictapps) + +## ADMX_Smartcard + +- [AllowCertificatesWithNoEKU](policy-csp-admx-smartcard.md#admx-smartcard-allowcertificateswithnoeku) +- [EnumerateECCCerts](policy-csp-admx-smartcard.md#admx-smartcard-enumerateecccerts) +- [AllowIntegratedUnblock](policy-csp-admx-smartcard.md#admx-smartcard-allowintegratedunblock) +- [AllowSignatureOnlyKeys](policy-csp-admx-smartcard.md#admx-smartcard-allowsignatureonlykeys) +- [AllowTimeInvalidCertificates](policy-csp-admx-smartcard.md#admx-smartcard-allowtimeinvalidcertificates) +- [X509HintsNeeded](policy-csp-admx-smartcard.md#admx-smartcard-x509hintsneeded) +- [CertPropRootCleanupString](policy-csp-admx-smartcard.md#admx-smartcard-certproprootcleanupstring) +- [IntegratedUnblockPromptString](policy-csp-admx-smartcard.md#admx-smartcard-integratedunblockpromptstring) +- [FilterDuplicateCerts](policy-csp-admx-smartcard.md#admx-smartcard-filterduplicatecerts) +- [ForceReadingAllCertificates](policy-csp-admx-smartcard.md#admx-smartcard-forcereadingallcertificates) +- [SCPnPNotification](policy-csp-admx-smartcard.md#admx-smartcard-scpnpnotification) +- [DisallowPlaintextPin](policy-csp-admx-smartcard.md#admx-smartcard-disallowplaintextpin) +- [ReverseSubject](policy-csp-admx-smartcard.md#admx-smartcard-reversesubject) +- [CertPropEnabledString](policy-csp-admx-smartcard.md#admx-smartcard-certpropenabledstring) +- [CertPropRootEnabledString](policy-csp-admx-smartcard.md#admx-smartcard-certproprootenabledstring) +- [SCPnPEnabled](policy-csp-admx-smartcard.md#admx-smartcard-scpnpenabled) + +## ADMX_Snmp + +- [SNMP_Communities](policy-csp-admx-snmp.md#admx-snmp-snmp-communities) +- [SNMP_PermittedManagers](policy-csp-admx-snmp.md#admx-snmp-snmp-permittedmanagers) +- [SNMP_Traps_Public](policy-csp-admx-snmp.md#admx-snmp-snmp-traps-public) + +## ADMX_SoundRec + +- [Soundrec_DiableApplication_TitleText_1](policy-csp-admx-soundrec.md#admx-soundrec-soundrec-diableapplication-titletext-1) +- [Soundrec_DiableApplication_TitleText_2](policy-csp-admx-soundrec.md#admx-soundrec-soundrec-diableapplication-titletext-2) + +## ADMX_srmfci + +- [AccessDeniedConfiguration](policy-csp-admx-srmfci.md#admx-srmfci-accessdeniedconfiguration) +- [EnableShellAccessCheck](policy-csp-admx-srmfci.md#admx-srmfci-enableshellaccesscheck) +- [EnableManualUX](policy-csp-admx-srmfci.md#admx-srmfci-enablemanualux) +- [CentralClassificationList](policy-csp-admx-srmfci.md#admx-srmfci-centralclassificationlist) + +## ADMX_StartMenu + +- [MemCheckBoxInRunDlg](policy-csp-admx-startmenu.md#admx-startmenu-memcheckboxinrundlg) +- [ForceStartMenuLogOff](policy-csp-admx-startmenu.md#admx-startmenu-forcestartmenulogoff) +- [AddSearchInternetLinkInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-addsearchinternetlinkinstartmenu) +- [ShowRunInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-showruninstartmenu) +- [PowerButtonAction](policy-csp-admx-startmenu.md#admx-startmenu-powerbuttonaction) +- [ClearRecentDocsOnExit](policy-csp-admx-startmenu.md#admx-startmenu-clearrecentdocsonexit) +- [ClearRecentProgForNewUserInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-clearrecentprogfornewuserinstartmenu) +- [ClearTilesOnExit](policy-csp-admx-startmenu.md#admx-startmenu-cleartilesonexit) +- [NoToolbarsOnTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-notoolbarsontaskbar) +- [NoSearchCommInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomminstartmenu) +- [NoSearchFilesInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchfilesinstartmenu) +- [NoSearchInternetInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchinternetinstartmenu) +- [NoSearchProgramsInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchprogramsinstartmenu) +- [NoResolveSearch](policy-csp-admx-startmenu.md#admx-startmenu-noresolvesearch) +- [NoResolveTrack](policy-csp-admx-startmenu.md#admx-startmenu-noresolvetrack) +- [NoStartPage](policy-csp-admx-startmenu.md#admx-startmenu-nostartpage) +- [GoToDesktopOnSignIn](policy-csp-admx-startmenu.md#admx-startmenu-gotodesktoponsignin) +- [GreyMSIAds](policy-csp-admx-startmenu.md#admx-startmenu-greymsiads) +- [NoTrayItemsDisplay](policy-csp-admx-startmenu.md#admx-startmenu-notrayitemsdisplay) +- [DesktopAppsFirstInAppsView](policy-csp-admx-startmenu.md#admx-startmenu-desktopappsfirstinappsview) +- [LockTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-locktaskbar) +- [StartPinAppsWhenInstalled](policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) +- [NoSetTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) +- [NoTaskGrouping](policy-csp-admx-startmenu.md#admx-startmenu-notaskgrouping) +- [NoChangeStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) +- [NoUninstallFromStart](policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) +- [NoTrayContextMenu](policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) +- [NoMoreProgramsList](policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) +- [NoClose](policy-csp-admx-startmenu.md#admx-startmenu-noclose) +- [NoBalloonTip](policy-csp-admx-startmenu.md#admx-startmenu-noballoontip) +- [NoTaskBarClock](policy-csp-admx-startmenu.md#admx-startmenu-notaskbarclock) +- [NoCommonGroups](policy-csp-admx-startmenu.md#admx-startmenu-nocommongroups) +- [NoSMConfigurePrograms](policy-csp-admx-startmenu.md#admx-startmenu-nosmconfigureprograms) +- [NoSMMyDocuments](policy-csp-admx-startmenu.md#admx-startmenu-nosmmydocuments) +- [NoStartMenuDownload](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenudownload) +- [NoFavoritesMenu](policy-csp-admx-startmenu.md#admx-startmenu-nofavoritesmenu) +- [NoGamesFolderOnStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nogamesfolderonstartmenu) +- [NoHelp](policy-csp-admx-startmenu.md#admx-startmenu-nohelp) +- [NoStartMenuHomegroup](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuhomegroup) +- [NoWindowsUpdate](policy-csp-admx-startmenu.md#admx-startmenu-nowindowsupdate) +- [StartMenuLogOff](policy-csp-admx-startmenu.md#admx-startmenu-startmenulogoff) +- [NoSMMyMusic](policy-csp-admx-startmenu.md#admx-startmenu-nosmmymusic) +- [NoNetAndDialupConnect](policy-csp-admx-startmenu.md#admx-startmenu-nonetanddialupconnect) +- [NoSMMyNetworkPlaces](policy-csp-admx-startmenu.md#admx-startmenu-nosmmynetworkplaces) +- [NoSMMyPictures](policy-csp-admx-startmenu.md#admx-startmenu-nosmmypictures) +- [NoPinnedPrograms](policy-csp-admx-startmenu.md#admx-startmenu-nopinnedprograms) +- [NoSetFolders](policy-csp-admx-startmenu.md#admx-startmenu-nosetfolders) +- [NoRecentDocsMenu](policy-csp-admx-startmenu.md#admx-startmenu-norecentdocsmenu) +- [NoStartMenuRecordedTV](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenurecordedtv) +- [NoRun](policy-csp-admx-startmenu.md#admx-startmenu-norun) +- [NoSearchComputerLinkInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomputerlinkinstartmenu) +- [NoFind](policy-csp-admx-startmenu.md#admx-startmenu-nofind) +- [NoSearchEverywhereLinkInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearcheverywherelinkinstartmenu) +- [RemoveUnDockPCButton](policy-csp-admx-startmenu.md#admx-startmenu-removeundockpcbutton) +- [NoUserFolderOnStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nouserfolderonstartmenu) +- [NoUserNameOnStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nousernameonstartmenu) +- [NoStartMenuSubFolders](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenusubfolders) +- [NoStartMenuVideos](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuvideos) +- [DisableGlobalSearchOnAppsView](policy-csp-admx-startmenu.md#admx-startmenu-disableglobalsearchonappsview) +- [ShowRunAsDifferentUserInStart](policy-csp-admx-startmenu.md#admx-startmenu-showrunasdifferentuserinstart) +- [QuickLaunchEnabled](policy-csp-admx-startmenu.md#admx-startmenu-quicklaunchenabled) +- [ShowStartOnDisplayWithForegroundOnWinKey](policy-csp-admx-startmenu.md#admx-startmenu-showstartondisplaywithforegroundonwinkey) +- [ShowAppsViewOnStart](policy-csp-admx-startmenu.md#admx-startmenu-showappsviewonstart) +- [NoAutoTrayNotify](policy-csp-admx-startmenu.md#admx-startmenu-noautotraynotify) +- [Intellimenus](policy-csp-admx-startmenu.md#admx-startmenu-intellimenus) +- [NoInstrumentation](policy-csp-admx-startmenu.md#admx-startmenu-noinstrumentation) +- [StartPinAppsWhenInstalled](policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) +- [NoSetTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) +- [NoChangeStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) +- [NoUninstallFromStart](policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) +- [NoTrayContextMenu](policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) +- [NoMoreProgramsList](policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) +- [HidePowerOptions](policy-csp-admx-startmenu.md#admx-startmenu-hidepoweroptions) +- [NoRun](policy-csp-admx-startmenu.md#admx-startmenu-norun) + +## ADMX_SystemRestore + +- [SR_DisableConfig](policy-csp-admx-systemrestore.md#admx-systemrestore-sr-disableconfig) + +## ADMX_TabletPCInputPanel + +- [Prediction_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-prediction-1) +- [IPTIPTarget_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptarget-1) +- [IPTIPTouchTarget_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptouchtarget-1) +- [RareChar_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-rarechar-1) +- [EdgeTarget_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-edgetarget-1) +- [AutoComplete_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-autocomplete-1) +- [PasswordSecurity_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-passwordsecurity-1) +- [ScratchOut_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-scratchout-1) +- [Prediction_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-prediction-2) +- [IPTIPTarget_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptarget-2) +- [IPTIPTouchTarget_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptouchtarget-2) +- [RareChar_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-rarechar-2) +- [EdgeTarget_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-edgetarget-2) +- [AutoComplete_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-autocomplete-2) +- [PasswordSecurity_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-passwordsecurity-2) +- [ScratchOut_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-scratchout-2) + +## ADMX_TabletShell + +- [DisableInkball_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disableinkball-1) +- [DisableNoteWriterPrinting_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disablenotewriterprinting-1) +- [DisableSnippingTool_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disablesnippingtool-1) +- [DisableJournal_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disablejournal-1) +- [TurnOffFeedback_1](policy-csp-admx-tabletshell.md#admx-tabletshell-turnofffeedback-1) +- [PreventBackEscMapping_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventbackescmapping-1) +- [PreventLaunchApp_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventlaunchapp-1) +- [PreventPressAndHold_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventpressandhold-1) +- [TurnOffButtons_1](policy-csp-admx-tabletshell.md#admx-tabletshell-turnoffbuttons-1) +- [PreventFlicksLearningMode_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflickslearningmode-1) +- [PreventFlicks_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflicks-1) +- [DisableInkball_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disableinkball-2) +- [DisableNoteWriterPrinting_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disablenotewriterprinting-2) +- [DisableSnippingTool_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disablesnippingtool-2) +- [DisableJournal_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disablejournal-2) +- [TurnOffFeedback_2](policy-csp-admx-tabletshell.md#admx-tabletshell-turnofffeedback-2) +- [PreventBackEscMapping_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventbackescmapping-2) +- [PreventLaunchApp_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventlaunchapp-2) +- [PreventPressAndHold_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventpressandhold-2) +- [TurnOffButtons_2](policy-csp-admx-tabletshell.md#admx-tabletshell-turnoffbuttons-2) +- [PreventFlicksLearningMode_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflickslearningmode-2) +- [PreventFlicks_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflicks-2) + +## ADMX_Taskbar + +- [EnableLegacyBalloonNotifications](policy-csp-admx-taskbar.md#admx-taskbar-enablelegacyballoonnotifications) +- [NoPinningToDestinations](policy-csp-admx-taskbar.md#admx-taskbar-nopinningtodestinations) +- [NoPinningToTaskbar](policy-csp-admx-taskbar.md#admx-taskbar-nopinningtotaskbar) +- [NoPinningStoreToTaskbar](policy-csp-admx-taskbar.md#admx-taskbar-nopinningstoretotaskbar) +- [TaskbarNoMultimon](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnomultimon) +- [NoRemoteDestinations](policy-csp-admx-taskbar.md#admx-taskbar-noremotedestinations) +- [TaskbarLockAll](policy-csp-admx-taskbar.md#admx-taskbar-taskbarlockall) +- [TaskbarNoAddRemoveToolbar](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoaddremovetoolbar) +- [TaskbarNoRedock](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoredock) +- [TaskbarNoDragToolbar](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnodragtoolbar) +- [TaskbarNoResize](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoresize) +- [DisableNotificationCenter](policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) +- [TaskbarNoPinnedList](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) +- [HideSCAPower](policy-csp-admx-taskbar.md#admx-taskbar-hidescapower) +- [HideSCANetwork](policy-csp-admx-taskbar.md#admx-taskbar-hidescanetwork) +- [HideSCAHealth](policy-csp-admx-taskbar.md#admx-taskbar-hidescahealth) +- [HideSCAVolume](policy-csp-admx-taskbar.md#admx-taskbar-hidescavolume) +- [ShowWindowsStoreAppsOnTaskbar](policy-csp-admx-taskbar.md#admx-taskbar-showwindowsstoreappsontaskbar) +- [TaskbarNoNotification](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnonotification) +- [NoSystraySystemPromotion](policy-csp-admx-taskbar.md#admx-taskbar-nosystraysystempromotion) +- [NoBalloonFeatureAdvertisements](policy-csp-admx-taskbar.md#admx-taskbar-noballoonfeatureadvertisements) +- [TaskbarNoThumbnail](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnothumbnail) +- [DisableNotificationCenter](policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) +- [TaskbarNoPinnedList](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) + +## ADMX_tcpip + +- [6to4_Router_Name](policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name) +- [6to4_Router_Name_Resolution_Interval](policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name-resolution-interval) +- [6to4_State](policy-csp-admx-tcpip.md#admx-tcpip-6to4-state) +- [IPHTTPS_ClientState](policy-csp-admx-tcpip.md#admx-tcpip-iphttps-clientstate) +- [ISATAP_Router_Name](policy-csp-admx-tcpip.md#admx-tcpip-isatap-router-name) +- [ISATAP_State](policy-csp-admx-tcpip.md#admx-tcpip-isatap-state) +- [Teredo_Client_Port](policy-csp-admx-tcpip.md#admx-tcpip-teredo-client-port) +- [Teredo_Default_Qualified](policy-csp-admx-tcpip.md#admx-tcpip-teredo-default-qualified) +- [Teredo_Refresh_Rate](policy-csp-admx-tcpip.md#admx-tcpip-teredo-refresh-rate) +- [Teredo_Server_Name](policy-csp-admx-tcpip.md#admx-tcpip-teredo-server-name) +- [Teredo_State](policy-csp-admx-tcpip.md#admx-tcpip-teredo-state) +- [IP_Stateless_Autoconfiguration_Limits_State](policy-csp-admx-tcpip.md#admx-tcpip-ip-stateless-autoconfiguration-limits-state) +- [Windows_Scaling_Heuristics_State](policy-csp-admx-tcpip.md#admx-tcpip-windows-scaling-heuristics-state) + +## ADMX_TerminalServer + +- [TS_GATEWAY_POLICY_ENABLE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-gateway-policy-enable) +- [TS_GATEWAY_POLICY_AUTH_METHOD](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-gateway-policy-auth-method) +- [TS_GATEWAY_POLICY_SERVER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-gateway-policy-server) +- [TS_CLIENT_ALLOW_UNSIGNED_FILES_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-unsigned-files-1) +- [TS_CLIENT_ALLOW_SIGNED_FILES_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-signed-files-1) +- [TS_CLIENT_DISABLE_PASSWORD_SAVING_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-disable-password-saving-1) +- [TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-trusted-certificate-thumbprints-2) +- [TS_RemoteControl_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-remotecontrol-1) +- [TS_EASY_PRINT_User](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-easy-print-user) +- [TS_START_PROGRAM_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-start-program-1) +- [TS_Session_End_On_Limit_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-session-end-on-limit-1) +- [TS_SESSIONS_Idle_Limit_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-idle-limit-1) +- [TS_SESSIONS_Limits_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-limits-1) +- [TS_SESSIONS_Disconnected_Timeout_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-disconnected-timeout-1) +- [TS_RADC_DefaultConnection](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-radc-defaultconnection) +- [TS_LICENSE_SECGROUP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-license-secgroup) +- [TS_PreventLicenseUpgrade](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-preventlicenseupgrade) +- [TS_CLIENT_ALLOW_UNSIGNED_FILES_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-unsigned-files-2) +- [TS_CLIENT_ALLOW_SIGNED_FILES_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-signed-files-2) +- [TS_SERVER_AUTH](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-auth) +- [TS_CLIENT_DISABLE_HARDWARE_MODE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-disable-hardware-mode) +- [TS_PROMT_CREDS_CLIENT_COMP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-promt-creds-client-comp) +- [TS_USB_REDIRECTION_DISABLE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-usb-redirection-disable) +- [TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-trusted-certificate-thumbprints-1) +- [TS_CLIENT_TURN_OFF_UDP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-turn-off-udp) +- [TS_AUTO_RECONNECT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-auto-reconnect) +- [TS_KEEP_ALIVE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-keep-alive) +- [TS_FORCIBLE_LOGOFF](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-forcible-logoff) +- [TS_MAX_CON_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-max-con-policy) +- [TS_SINGLE_SESSION](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-single-session) +- [TS_SELECT_NETWORK_DETECT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-select-network-detect) +- [TS_SELECT_TRANSPORT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-select-transport) +- [TS_RemoteControl_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-remotecontrol-2) +- [TS_RDSAppX_WaitForRegistration](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-rdsappx-waitforregistration) +- [TS_CLIENT_AUDIO](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-audio) +- [TS_CLIENT_AUDIO_CAPTURE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-audio-capture) +- [TS_TIME_ZONE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-time-zone) +- [TS_UIA](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-uia) +- [TS_CLIENT_CLIPBOARD](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-clipboard) +- [TS_CLIENT_COM](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-com) +- [TS_CLIENT_LPT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-lpt) +- [TS_SMART_CARD](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-smart-card) +- [TS_CLIENT_PNP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-pnp) +- [TS_CAMERA_REDIRECTION](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-camera-redirection) +- [TS_CLIENT_AUDIO_QUALITY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-audio-quality) +- [TS_LICENSE_TOOLTIP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-license-tooltip) +- [TS_LICENSING_MODE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-licensing-mode) +- [TS_LICENSE_SERVERS](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-license-servers) +- [TS_CLIENT_PRINTER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-printer) +- [TS_CLIENT_DEFAULT_M](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-default-m) +- [TS_FALLBACKPRINTDRIVERTYPE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-fallbackprintdrivertype) +- [TS_EASY_PRINT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-easy-print) +- [TS_DELETE_ROAMING_USER_PROFILES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-delete-roaming-user-profiles) +- [TS_USER_PROFILES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-profiles) +- [TS_USER_HOME](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-home) +- [TS_USER_MANDATORY_PROFILES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-mandatory-profiles) +- [TS_SD_ClustName](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sd-clustname) +- [TS_SD_Loc](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sd-loc) +- [TS_JOIN_SESSION_DIRECTORY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-join-session-directory) +- [TS_SD_EXPOSE_ADDRESS](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sd-expose-address) +- [TS_TURNOFF_SINGLEAPP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-turnoff-singleapp) +- [TS_SERVER_COMPRESSOR](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-compressor) +- [TS_SERVER_AVC_HW_ENCODE_PREFERRED](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-avc-hw-encode-preferred) +- [TS_SERVER_IMAGE_QUALITY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-image-quality) +- [TS_SERVER_PROFILE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-profile) +- [TS_SERVER_LEGACY_RFX](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-legacy-rfx) +- [TS_DISABLE_REMOTE_DESKTOP_WALLPAPER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-disable-remote-desktop-wallpaper) +- [TS_COLORDEPTH](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-colordepth) +- [TS_MAXDISPLAYRES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-maxdisplayres) +- [TS_MAXMONITOR](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-maxmonitor) +- [TS_SERVER_AVC444_MODE_PREFERRED](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-avc444-mode-preferred) +- [TS_EnableVirtualGraphics](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-enablevirtualgraphics) +- [TS_SERVER_VISEXP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-visexp) +- [TS_RemoteDesktopVirtualGraphics](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-remotedesktopvirtualgraphics) +- [TS_NoDisconnectMenu](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-nodisconnectmenu) +- [TS_NoSecurityMenu](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-nosecuritymenu) +- [TS_START_PROGRAM_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-start-program-2) +- [TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-advanced-remotefx-remoteapp) +- [TS_DX_USE_FULL_HWGPU](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-dx-use-full-hwgpu) +- [TS_SERVER_WDDM_GRAPHICS_DRIVER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-wddm-graphics-driver) +- [TS_TSCC_PERMISSIONS_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-tscc-permissions-policy) +- [TS_SECURITY_LAYER_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-security-layer-policy) +- [TS_USER_AUTHENTICATION_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-authentication-policy) +- [TS_CERTIFICATE_TEMPLATE_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-certificate-template-policy) +- [TS_Session_End_On_Limit_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-session-end-on-limit-2) +- [TS_SESSIONS_Idle_Limit_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-idle-limit-2) +- [TS_SESSIONS_Limits_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-limits-2) +- [TS_SESSIONS_Disconnected_Timeout_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-disconnected-timeout-2) +- [TS_TEMP_DELETE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-temp-delete) +- [TS_TEMP_PER_SESSION](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-temp-per-session) + +## ADMX_Thumbnails + +- [DisableThumbsDBOnNetworkFolders](policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) +- [DisableThumbnailsOnNetworkFolders](policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) +- [DisableThumbnails](policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) + +## ADMX_TouchInput + +- [TouchInputOff_1](policy-csp-admx-touchinput.md#admx-touchinput-touchinputoff-1) +- [PanningEverywhereOff_1](policy-csp-admx-touchinput.md#admx-touchinput-panningeverywhereoff-1) +- [TouchInputOff_2](policy-csp-admx-touchinput.md#admx-touchinput-touchinputoff-2) +- [PanningEverywhereOff_2](policy-csp-admx-touchinput.md#admx-touchinput-panningeverywhereoff-2) + +## ADMX_TPM + +- [OptIntoDSHA_Name](policy-csp-admx-tpm.md#admx-tpm-optintodsha-name) +- [OSManagedAuth_Name](policy-csp-admx-tpm.md#admx-tpm-osmanagedauth-name) +- [BlockedCommandsList_Name](policy-csp-admx-tpm.md#admx-tpm-blockedcommandslist-name) +- [ClearTPMIfNotReady_Name](policy-csp-admx-tpm.md#admx-tpm-cleartpmifnotready-name) +- [UseLegacyDAP_Name](policy-csp-admx-tpm.md#admx-tpm-uselegacydap-name) +- [IgnoreDefaultList_Name](policy-csp-admx-tpm.md#admx-tpm-ignoredefaultlist-name) +- [IgnoreLocalList_Name](policy-csp-admx-tpm.md#admx-tpm-ignorelocallist-name) +- [StandardUserAuthorizationFailureIndividualThreshold_Name](policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureindividualthreshold-name) +- [StandardUserAuthorizationFailureDuration_Name](policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureduration-name) +- [StandardUserAuthorizationFailureTotalThreshold_Name](policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailuretotalthreshold-name) + +## ADMX_UserExperienceVirtualization + +- [MicrosoftOffice2013AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) +- [MicrosoftOffice2016AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) +- [Calculator](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) +- [MicrosoftOffice2013CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) +- [MicrosoftOffice2016CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) +- [MicrosoftOffice2013ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) +- [MicrosoftOffice2016ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) +- [MicrosoftOffice2013InfoPathBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) +- [InternetExplorer10](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) +- [InternetExplorer11](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) +- [InternetExplorer8](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) +- [InternetExplorer9](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) +- [InternetExplorerCommon](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) +- [MicrosoftOffice2013LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) +- [MicrosoftOffice2016LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) +- [MicrosoftOffice2010Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) +- [MicrosoftOffice2013Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) +- [MicrosoftOffice2016Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) +- [MicrosoftOffice2010Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) +- [MicrosoftOffice2013Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) +- [MicrosoftOffice2016Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) +- [MicrosoftOffice2010InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) +- [MicrosoftOffice2013InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) +- [MicrosoftOffice2010Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) +- [MicrosoftOffice2013Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) +- [MicrosoftOffice2016Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) +- [MicrosoftOffice2010Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) +- [MicrosoftOffice2013Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) +- [MicrosoftOffice2013UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) +- [MicrosoftOffice2016Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) +- [MicrosoftOffice2016UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) +- [MicrosoftOffice365Access2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) +- [MicrosoftOffice365Access2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) +- [MicrosoftOffice365Common2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) +- [MicrosoftOffice365Common2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) +- [MicrosoftOffice365Excel2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) +- [MicrosoftOffice365Excel2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) +- [MicrosoftOffice365InfoPath2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) +- [MicrosoftOffice365Lync2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) +- [MicrosoftOffice365Lync2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) +- [MicrosoftOffice365OneNote2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) +- [MicrosoftOffice365OneNote2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) +- [MicrosoftOffice365Outlook2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) +- [MicrosoftOffice365Outlook2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) +- [MicrosoftOffice365PowerPoint2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) +- [MicrosoftOffice365PowerPoint2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) +- [MicrosoftOffice365Project2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) +- [MicrosoftOffice365Project2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) +- [MicrosoftOffice365Publisher2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) +- [MicrosoftOffice365Publisher2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) +- [MicrosoftOffice365SharePointDesigner2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) +- [MicrosoftOffice365Visio2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) +- [MicrosoftOffice365Visio2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) +- [MicrosoftOffice365Word2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) +- [MicrosoftOffice365Word2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) +- [MicrosoftOffice2013OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) +- [MicrosoftOffice2016OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) +- [MicrosoftOffice2010OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) +- [MicrosoftOffice2013OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) +- [MicrosoftOffice2016OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) +- [MicrosoftOffice2010Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) +- [MicrosoftOffice2013Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) +- [MicrosoftOffice2016Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) +- [MicrosoftOffice2010PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) +- [MicrosoftOffice2013PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) +- [MicrosoftOffice2016PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) +- [MicrosoftOffice2010Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) +- [MicrosoftOffice2013Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) +- [MicrosoftOffice2016Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) +- [MicrosoftOffice2010Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) +- [MicrosoftOffice2013Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) +- [MicrosoftOffice2016Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) +- [MicrosoftOffice2010SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) +- [MicrosoftOffice2013SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) +- [MicrosoftOffice2010SharePointWorkspace](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) +- [MicrosoftOffice2010Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) +- [MicrosoftOffice2013Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) +- [MicrosoftOffice2016Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) +- [MicrosoftOffice2010Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) +- [MicrosoftOffice2013Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) +- [MicrosoftOffice2016Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) +- [Notepad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) +- [MicrosoftOffice2013OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) +- [MicrosoftOffice2016OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) +- [MicrosoftOffice2013OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) +- [MicrosoftOffice2016OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) +- [MicrosoftOffice2013PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) +- [MicrosoftOffice2016PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) +- [MicrosoftOffice2013ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) +- [MicrosoftOffice2016ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) +- [MicrosoftOffice2013PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) +- [MicrosoftOffice2016PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) +- [MicrosoftOffice2013SharePointDesignerBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) +- [MicrosoftOffice2013VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) +- [MicrosoftOffice2016VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) +- [MicrosoftOffice2013WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) +- [MicrosoftOffice2016WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) +- [Wordpad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) +- [ConfigureSyncMethod](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) +- [DisableWin8Sync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) +- [SyncProviderPingEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) +- [MaxPackageSizeInBytes](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) +- [SettingsStoragePath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) +- [SyncOverMeteredNetwork](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) +- [SyncOverMeteredNetworkWhenRoaming](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) +- [RepositoryTimeout](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) +- [DisableWindowsOSSettings](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) +- [SyncEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) +- [ConfigureVdi](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) +- [Finance](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) +- [Games](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) +- [Maps](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) +- [Music](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) +- [News](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) +- [Reader](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) +- [Sports](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) +- [Travel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) +- [Video](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) +- [Weather](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) +- [MicrosoftOffice2013AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) +- [MicrosoftOffice2016AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) +- [Calculator](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) +- [MicrosoftOffice2013CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) +- [MicrosoftOffice2016CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) +- [MicrosoftOffice2013ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) +- [MicrosoftOffice2016ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) +- [MicrosoftOffice2013InfoPathBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) +- [InternetExplorer10](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) +- [InternetExplorer11](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) +- [InternetExplorer8](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) +- [InternetExplorer9](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) +- [InternetExplorerCommon](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) +- [MicrosoftOffice2013LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) +- [MicrosoftOffice2016LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) +- [MicrosoftOffice2010Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) +- [MicrosoftOffice2013Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) +- [MicrosoftOffice2016Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) +- [MicrosoftOffice2010Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) +- [MicrosoftOffice2013Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) +- [MicrosoftOffice2016Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) +- [MicrosoftOffice2010InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) +- [MicrosoftOffice2013InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) +- [MicrosoftOffice2010Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) +- [MicrosoftOffice2013Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) +- [MicrosoftOffice2016Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) +- [MicrosoftOffice2010Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) +- [MicrosoftOffice2013Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) +- [MicrosoftOffice2013UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) +- [MicrosoftOffice2016Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) +- [MicrosoftOffice2016UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) +- [MicrosoftOffice365Access2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) +- [MicrosoftOffice365Access2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) +- [MicrosoftOffice365Common2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) +- [MicrosoftOffice365Common2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) +- [MicrosoftOffice365Excel2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) +- [MicrosoftOffice365Excel2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) +- [MicrosoftOffice365InfoPath2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) +- [MicrosoftOffice365Lync2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) +- [MicrosoftOffice365Lync2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) +- [MicrosoftOffice365OneNote2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) +- [MicrosoftOffice365OneNote2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) +- [MicrosoftOffice365Outlook2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) +- [MicrosoftOffice365Outlook2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) +- [MicrosoftOffice365PowerPoint2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) +- [MicrosoftOffice365PowerPoint2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) +- [MicrosoftOffice365Project2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) +- [MicrosoftOffice365Project2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) +- [MicrosoftOffice365Publisher2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) +- [MicrosoftOffice365Publisher2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) +- [MicrosoftOffice365SharePointDesigner2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) +- [MicrosoftOffice365Visio2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) +- [MicrosoftOffice365Visio2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) +- [MicrosoftOffice365Word2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) +- [MicrosoftOffice365Word2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) +- [MicrosoftOffice2013OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) +- [MicrosoftOffice2016OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) +- [MicrosoftOffice2010OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) +- [MicrosoftOffice2013OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) +- [MicrosoftOffice2016OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) +- [MicrosoftOffice2010Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) +- [MicrosoftOffice2013Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) +- [MicrosoftOffice2016Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) +- [MicrosoftOffice2010PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) +- [MicrosoftOffice2013PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) +- [MicrosoftOffice2016PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) +- [MicrosoftOffice2010Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) +- [MicrosoftOffice2013Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) +- [MicrosoftOffice2016Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) +- [MicrosoftOffice2010Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) +- [MicrosoftOffice2013Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) +- [MicrosoftOffice2016Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) +- [MicrosoftOffice2010SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) +- [MicrosoftOffice2013SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) +- [MicrosoftOffice2010SharePointWorkspace](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) +- [MicrosoftOffice2010Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) +- [MicrosoftOffice2013Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) +- [MicrosoftOffice2016Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) +- [MicrosoftOffice2010Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) +- [MicrosoftOffice2013Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) +- [MicrosoftOffice2016Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) +- [Notepad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) +- [MicrosoftOffice2013OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) +- [MicrosoftOffice2016OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) +- [MicrosoftOffice2013OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) +- [MicrosoftOffice2016OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) +- [MicrosoftOffice2013PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) +- [MicrosoftOffice2016PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) +- [MicrosoftOffice2013ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) +- [MicrosoftOffice2016ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) +- [MicrosoftOffice2013PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) +- [MicrosoftOffice2016PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) +- [MicrosoftOffice2013SharePointDesignerBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) +- [MicrosoftOffice2013VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) +- [MicrosoftOffice2016VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) +- [MicrosoftOffice2013WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) +- [MicrosoftOffice2016WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) +- [Wordpad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) +- [ConfigureSyncMethod](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) +- [ContactITDescription](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactitdescription) +- [ContactITUrl](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactiturl) +- [DisableWin8Sync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) +- [EnableUEV](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-enableuev) +- [FirstUseNotificationEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-firstusenotificationenabled) +- [SyncProviderPingEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) +- [MaxPackageSizeInBytes](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) +- [SettingsStoragePath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) +- [SettingsTemplateCatalogPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingstemplatecatalogpath) +- [SyncOverMeteredNetwork](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) +- [SyncOverMeteredNetworkWhenRoaming](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) +- [SyncUnlistedWindows8Apps](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncunlistedwindows8apps) +- [RepositoryTimeout](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) +- [DisableWindowsOSSettings](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) +- [TrayIconEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-trayiconenabled) +- [SyncEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) +- [ConfigureVdi](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) +- [Finance](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) +- [Games](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) +- [Maps](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) +- [Music](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) +- [News](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) +- [Reader](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) +- [Sports](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) +- [Travel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) +- [Video](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) +- [Weather](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) + +## ADMX_UserProfiles + +- [LimitSize](policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize) +- [SlowLinkTimeOut](policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout) +- [CleanupProfiles](policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles) +- [DontForceUnloadHive](policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive) +- [ProfileErrorAction](policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction) +- [LeaveAppMgmtData](policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata) +- [USER_HOME](policy-csp-admx-userprofiles.md#admx-userprofiles-user-home) +- [UserInfoAccessAction](policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction) + +## ADMX_W32Time + +- [W32TIME_POLICY_CONFIG](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-config) +- [W32TIME_POLICY_CONFIGURE_NTPCLIENT](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-configure-ntpclient) +- [W32TIME_POLICY_ENABLE_NTPCLIENT](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-enable-ntpclient) +- [W32TIME_POLICY_ENABLE_NTPSERVER](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-enable-ntpserver) + +## ADMX_WCM + +- [WCM_DisablePowerManagement](policy-csp-admx-wcm.md#admx-wcm-wcm-disablepowermanagement) +- [WCM_EnableSoftDisconnect](policy-csp-admx-wcm.md#admx-wcm-wcm-enablesoftdisconnect) +- [WCM_MinimizeConnections](policy-csp-admx-wcm.md#admx-wcm-wcm-minimizeconnections) + +## ADMX_WDI + +- [WdiDpsScenarioExecutionPolicy](policy-csp-admx-wdi.md#admx-wdi-wdidpsscenarioexecutionpolicy) +- [WdiDpsScenarioDataSizeLimitPolicy](policy-csp-admx-wdi.md#admx-wdi-wdidpsscenariodatasizelimitpolicy) + +## ADMX_WinCal + +- [TurnOffWinCal_1](policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-1) +- [TurnOffWinCal_2](policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-2) + +## ADMX_WindowsColorSystem + +- [ProhibitChangingInstalledProfileList_1](policy-csp-admx-windowscolorsystem.md#admx-windowscolorsystem-prohibitchanginginstalledprofilelist-1) +- [ProhibitChangingInstalledProfileList_2](policy-csp-admx-windowscolorsystem.md#admx-windowscolorsystem-prohibitchanginginstalledprofilelist-2) + +## ADMX_WindowsConnectNow + +- [WCN_DisableWcnUi_1](policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-1) +- [WCN_EnableRegistrar](policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-enableregistrar) +- [WCN_DisableWcnUi_2](policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-2) + +## ADMX_WindowsExplorer + +- [EnforceShellExtensionSecurity](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enforceshellextensionsecurity) +- [NoBackButton](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nobackbutton) +- [NoPlacesBar](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noplacesbar) +- [NoFileMRU](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemru) +- [PlacesBar](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-placesbar) +- [DisableBindDirectlyToPropertySetStorage](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) +- [DisableKnownFolders](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableknownfolders) +- [ConfirmFileDelete](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-confirmfiledelete) +- [NoFolderOptions](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofolderoptions) +- [NoRecycleFiles](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norecyclefiles) +- [NoRunAsInstallPrompt](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norunasinstallprompt) +- [LinkResolveIgnoreLinkInfo](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-linkresolveignorelinkinfo) +- [NoDrives](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodrives) +- [NoManageMyComputerVerb](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomanagemycomputerverb) +- [DefaultLibrariesLocation](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) +- [RecycleBinSize](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-recyclebinsize) +- [MaxRecentDocs](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-maxrecentdocs) +- [NoWorkgroupContents](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noworkgroupcontents) +- [NoEntireNetwork](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noentirenetwork) +- [TryHarderPinnedOpenSearch](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedopensearch) +- [TryHarderPinnedLibrary](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedlibrary) +- [NoViewOnDrive](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewondrive) +- [NoNetConnectDisconnect](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonetconnectdisconnect) +- [NoCDBurning](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocdburning) +- [NoDFSTab](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodfstab) +- [NoViewContextMenu](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewcontextmenu) +- [NoFileMenu](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemenu) +- [NoHardwareTab](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nohardwaretab) +- [NoShellSearchButton](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noshellsearchbutton) +- [NoSecurityTab](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosecuritytab) +- [NoMyComputerSharedDocuments](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomycomputershareddocuments) +- [NoSearchInternetTryHarderButton](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosearchinternettryharderbutton) +- [NoChangeKeyboardNavigationIndicators](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangekeyboardnavigationindicators) +- [NoChangeAnimation](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangeanimation) +- [PromptRunasInstallNetPath](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-promptrunasinstallnetpath) +- [ExplorerRibbonStartsMinimized](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) +- [NoCacheThumbNailPictures](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocachethumbnailpictures) +- [DisableSearchBoxSuggestions](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablesearchboxsuggestions) +- [NoStrCmpLogical](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) +- [ShellProtocolProtectedModeTitle_1](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-1) +- [HideContentViewModeSnippets](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-hidecontentviewmodesnippets) +- [NoWindowsHotKeys](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nowindowshotkeys) +- [DisableIndexedLibraryExperience](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableindexedlibraryexperience) +- [ClassicShell](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-classicshell) +- [IZ_Policy_OpenSearchQuery_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) +- [IZ_Policy_OpenSearchPreview_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) +- [IZ_Policy_OpenSearchQuery_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) +- [IZ_Policy_OpenSearchPreview_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) +- [IZ_Policy_OpenSearchQuery_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) +- [IZ_Policy_OpenSearchPreview_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) +- [IZ_Policy_OpenSearchQuery_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) +- [IZ_Policy_OpenSearchPreview_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) +- [IZ_Policy_OpenSearchQuery_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) +- [IZ_Policy_OpenSearchPreview_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) +- [IZ_Policy_OpenSearchQuery_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) +- [IZ_Policy_OpenSearchPreview_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) +- [IZ_Policy_OpenSearchQuery_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) +- [IZ_Policy_OpenSearchPreview_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) +- [IZ_Policy_OpenSearchQuery_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) +- [IZ_Policy_OpenSearchPreview_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) +- [IZ_Policy_OpenSearchQuery_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) +- [IZ_Policy_OpenSearchPreview_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) +- [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) +- [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) +- [EnableShellShortcutIconRemotePath](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enableshellshortcuticonremotepath) +- [EnableSmartScreen](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enablesmartscreen) +- [DisableBindDirectlyToPropertySetStorage](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) +- [NoNewAppAlert](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonewappalert) +- [DefaultLibrariesLocation](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) +- [ShowHibernateOption](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showhibernateoption) +- [ShowSleepOption](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showsleepoption) +- [ExplorerRibbonStartsMinimized](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) +- [NoStrCmpLogical](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) +- [ShellProtocolProtectedModeTitle_2](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-2) +- [CheckSameSourceAndTargetForFRAndDFS](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-checksamesourceandtargetforfranddfs) +- [IZ_Policy_OpenSearchQuery_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) +- [IZ_Policy_OpenSearchPreview_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) +- [IZ_Policy_OpenSearchQuery_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) +- [IZ_Policy_OpenSearchPreview_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) +- [IZ_Policy_OpenSearchQuery_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) +- [IZ_Policy_OpenSearchPreview_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) +- [IZ_Policy_OpenSearchQuery_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) +- [IZ_Policy_OpenSearchPreview_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) +- [IZ_Policy_OpenSearchQuery_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) +- [IZ_Policy_OpenSearchPreview_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) +- [IZ_Policy_OpenSearchQuery_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) +- [IZ_Policy_OpenSearchPreview_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) +- [IZ_Policy_OpenSearchQuery_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) +- [IZ_Policy_OpenSearchPreview_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) +- [IZ_Policy_OpenSearchQuery_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) +- [IZ_Policy_OpenSearchPreview_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) +- [IZ_Policy_OpenSearchQuery_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) +- [IZ_Policy_OpenSearchPreview_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) +- [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) +- [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) + +## ADMX_WindowsMediaDRM + +- [DisableOnline](policy-csp-admx-windowsmediadrm.md#admx-windowsmediadrm-disableonline) + +## ADMX_WindowsMediaPlayer + +- [ConfigureHTTPProxySettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurehttpproxysettings) +- [ConfigureMMSProxySettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configuremmsproxysettings) +- [NetworkBuffering](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-networkbuffering) +- [ConfigureRTSPProxySettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurertspproxysettings) +- [DisableNetworkSettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablenetworksettings) +- [WindowsStreamingMediaProtocols](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-windowsstreamingmediaprotocols) +- [EnableScreenSaver](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-enablescreensaver) +- [PolicyCodecUpdate](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-policycodecupdate) +- [PreventCDDVDMetadataRetrieval](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventcddvdmetadataretrieval) +- [PreventMusicFileMetadataRetrieval](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventmusicfilemetadataretrieval) +- [PreventRadioPresetsRetrieval](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventradiopresetsretrieval) +- [DoNotShowAnchor](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-donotshowanchor) +- [HidePrivacyTab](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hideprivacytab) +- [HideSecurityTab](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hidesecuritytab) +- [SkinLockDown](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-skinlockdown) +- [DisableSetupFirstUseConfiguration](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablesetupfirstuseconfiguration) +- [DisableAutoUpdate](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disableautoupdate) +- [PreventWMPDeskTopShortcut](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventwmpdesktopshortcut) +- [PreventLibrarySharing](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventlibrarysharing) +- [PreventQuickLaunchShortcut](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventquicklaunchshortcut) +- [DontUseFrameInterpolation](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-dontuseframeinterpolation) + +## ADMX_WindowsRemoteManagement + +- [DisallowKerberos_2](policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-2) +- [DisallowKerberos_1](policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-1) + +## ADMX_WindowsStore + +- [DisableOSUpgrade_1](policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-1) +- [RemoveWindowsStore_1](policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-1) +- [DisableAutoDownloadWin8](policy-csp-admx-windowsstore.md#admx-windowsstore-disableautodownloadwin8) +- [DisableOSUpgrade_2](policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-2) +- [RemoveWindowsStore_2](policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-2) + +## ADMX_WinInit + +- [Hiberboot](policy-csp-admx-wininit.md#admx-wininit-hiberboot) +- [ShutdownTimeoutHungSessionsDescription](policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription) +- [DisableNamedPipeShutdownPolicyDescription](policy-csp-admx-wininit.md#admx-wininit-disablenamedpipeshutdownpolicydescription) + +## ADMX_WinLogon + +- [CustomShell](policy-csp-admx-winlogon.md#admx-winlogon-customshell) +- [LogonHoursNotificationPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription) +- [ReportCachedLogonPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) +- [LogonHoursPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription) +- [SoftwareSASGeneration](policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration) +- [DisplayLastLogonInfoDescription](policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription) +- [ReportCachedLogonPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) + +## ADMX_Winsrv + +- [AllowBlockingAppsAtShutdown](policy-csp-admx-winsrv.md#admx-winsrv-allowblockingappsatshutdown) + +## ADMX_wlansvc + +- [SetPINPreferred](policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) +- [SetPINEnforced](policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced) +- [SetCost](policy-csp-admx-wlansvc.md#admx-wlansvc-setcost) + +## ADMX_WordWheel + +- [CustomSearch](policy-csp-admx-wordwheel.md#admx-wordwheel-customsearch) + +## ADMX_WorkFoldersClient + +- [Pol_UserEnableTokenBroker](policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol-userenabletokenbroker) +- [Pol_UserEnableWorkFolders](policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol-userenableworkfolders) +- [Pol_MachineEnableWorkFolders](policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol-machineenableworkfolders) + +## ADMX_WPN + +- [QuietHoursDailyBeginMinute](policy-csp-admx-wpn.md#admx-wpn-quiethoursdailybeginminute) +- [QuietHoursDailyEndMinute](policy-csp-admx-wpn.md#admx-wpn-quiethoursdailyendminute) +- [NoCallsDuringQuietHours](policy-csp-admx-wpn.md#admx-wpn-nocallsduringquiethours) +- [NoQuietHours](policy-csp-admx-wpn.md#admx-wpn-noquiethours) +- [NoToastNotification](policy-csp-admx-wpn.md#admx-wpn-notoastnotification) +- [NoLockScreenToastNotification](policy-csp-admx-wpn.md#admx-wpn-nolockscreentoastnotification) +- [NoToastNotification](policy-csp-admx-wpn.md#admx-wpn-notoastnotification) + +## AppRuntime + +- [AllowMicrosoftAccountsToBeOptional](policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) + +## AppVirtualization + +- [AllowAppVClient](policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [ClientCoexistenceAllowMigrationmode](policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [IntegrationAllowRootUser](policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [IntegrationAllowRootGlobal](policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AllowRoamingFileExclusions](policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AllowRoamingRegistryExclusions](policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AllowPackageCleanup](policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AllowPublishingRefreshUX](policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [PublishingAllowServer1](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [PublishingAllowServer2](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [PublishingAllowServer3](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [PublishingAllowServer4](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [PublishingAllowServer5](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AllowReportingServer](policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AllowPackageScripts](policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [StreamingAllowHighCostLaunch](policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [StreamingAllowCertificateFilterForClient_SSL](policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [StreamingSupportBranchCache](policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [StreamingAllowLocationProvider](policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [StreamingAllowPackageInstallationRoot](policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [StreamingAllowPackageSourceRoot](policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [StreamingAllowReestablishmentInterval](policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [StreamingAllowReestablishmentRetries](policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [StreamingSharedContentStoreMode](policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AllowStreamingAutoload](policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [StreamingVerifyCertificateRevocationList](policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AllowDynamicVirtualization](policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [VirtualComponentsAllowList](policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) + +## AttachmentManager + +- [DoNotPreserveZoneInformation](policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [HideZoneInfoMechanism](policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [NotifyAntivirusPrograms](policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) + +## Autoplay + +- [DisallowAutoplayForNonVolumeDevices](policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [SetDefaultAutoRunBehavior](policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [TurnOffAutoPlay](policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [DisallowAutoplayForNonVolumeDevices](policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [SetDefaultAutoRunBehavior](policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [TurnOffAutoPlay](policy-csp-autoplay.md#autoplay-turnoffautoplay) + +## Cellular + +- [ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) + +## Connectivity + +- [HardenedUNCPaths](policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [ProhibitInstallationAndConfigurationOfNetworkBridge](policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [DisableDownloadingOfPrintDriversOverHTTP](policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [DiablePrintingOverHTTP](policy-csp-connectivity.md#connectivity-diableprintingoverhttp) + +## CredentialProviders + +- [BlockPicturePassword](policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [AllowPINLogon](policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) + +## CredentialsDelegation + +- [RemoteHostAllowsDelegationOfNonExportableCredentials](policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) + +## CredentialsUI + +- [DisablePasswordReveal](policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [DisablePasswordReveal](policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [EnumerateAdministrators](policy-csp-credentialsui.md#credentialsui-enumerateadministrators) + +## DataUsage + +- [SetCost3G](policy-csp-datausage.md#datausage-setcost3g) +- [SetCost4G](policy-csp-datausage.md#datausage-setcost4g) + +## DeliveryOptimization + +- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) + +## Desktop + +- [PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) + +## DesktopAppInstaller + +- [EnableAppInstaller](policy-csp-desktopappinstaller.md#desktopappinstaller-enableappinstaller) +- [EnableSettings](policy-csp-desktopappinstaller.md#desktopappinstaller-enablesettings) +- [EnableExperimentalFeatures](policy-csp-desktopappinstaller.md#desktopappinstaller-enableexperimentalfeatures) +- [EnableLocalManifestFiles](policy-csp-desktopappinstaller.md#desktopappinstaller-enablelocalmanifestfiles) +- [EnableHashOverride](policy-csp-desktopappinstaller.md#desktopappinstaller-enablehashoverride) +- [EnableDefaultSource](policy-csp-desktopappinstaller.md#desktopappinstaller-enabledefaultsource) +- [EnableMicrosoftStoreSource](policy-csp-desktopappinstaller.md#desktopappinstaller-enablemicrosoftstoresource) +- [SourceAutoUpdateInterval](policy-csp-desktopappinstaller.md#desktopappinstaller-sourceautoupdateinterval) +- [EnableAdditionalSources](policy-csp-desktopappinstaller.md#desktopappinstaller-enableadditionalsources) +- [EnableAllowedSources](policy-csp-desktopappinstaller.md#desktopappinstaller-enableallowedsources) +- [EnableMSAppInstallerProtocol](policy-csp-desktopappinstaller.md#desktopappinstaller-enablemsappinstallerprotocol) + +## DeviceInstallation + +- [PreventInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids) +- [PreventInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md#deviceinstallation-enableinstallationpolicylayering) +- [AllowInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids) +- [PreventDeviceMetadataFromNetwork](policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) + +## DeviceLock + +- [PreventLockScreenSlideShow](policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [PreventEnablingLockScreenCamera](policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) + +## ErrorReporting + +- [DisableWindowsErrorReporting](policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [DisplayErrorNotification](policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [DoNotSendAdditionalData](policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [PreventCriticalErrorDisplay](policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [CustomizeConsentSettings](policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) + +## EventLogService + +- [ControlEventLogBehavior](policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [SpecifyMaximumFileSizeApplicationLog](policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [SpecifyMaximumFileSizeSecurityLog](policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [SpecifyMaximumFileSizeSystemLog](policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) + +## FileExplorer + +- [TurnOffDataExecutionPreventionForExplorer](policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [TurnOffHeapTerminationOnCorruption](policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) + +## InternetExplorer + +- [AddSearchProvider](policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [DisableSecondaryHomePageChange](policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [DisableProxyChange](policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [DisableSearchProviderChange](policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [DisableCustomerExperienceImprovementProgramParticipation](policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [AllowSuggestedSites](policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [DisableFirstRunWizard](policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [DisableFlipAheadFeature](policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [DisableHomePageChange](policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [PreventManagingSmartScreenFilter](policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [SearchProviderList](policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [AllowActiveXFiltering](policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [AllowEnterpriseModeSiteList](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [SendSitesNotInEnterpriseSiteListToEdge](policy-csp-internetexplorer.md#internetexplorer-sendsitesnotinenterprisesitelisttoedge) +- [ConfigureEdgeRedirectChannel](policy-csp-internetexplorer.md#internetexplorer-configureedgeredirectchannel) +- [KeepIntranetSitesInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-keepintranetsitesininternetexplorer) +- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md#internetexplorer-allowsavetargetasiniemode) +- [DisableInternetExplorerApp](policy-csp-internetexplorer.md#internetexplorer-disableinternetexplorerapp) +- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md#internetexplorer-enableextendediemodehotkeys) +- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md#internetexplorer-resetzoomfordialoginiemode) +- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md#internetexplorer-enableglobalwindowlistiniemode) +- [JScriptReplacement](policy-csp-internetexplorer.md#internetexplorer-jscriptreplacement) +- [AllowInternetExplorerStandardsMode](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [AllowInternetExplorer7PolicyList](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [DisableEncryptionSupport](policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [AllowEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [AllowInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [IncludeAllLocalSites](policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [IncludeAllNetworkPaths](policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [AllowIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [AllowLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [AllowLockedDownInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [AllowLockedDownIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [AllowLockedDownLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [AllowLockedDownRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [AllowsLockedDownTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [AllowsRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [AllowSiteToZoneAssignmentList](policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [AllowTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [LockedDownInternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [IntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [LockedDownIntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [TrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [LockedDownTrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [RestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [LockedDownRestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [LocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [LockedDownLocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [LockedDownInternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [IntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [LockedDownIntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [TrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [LockedDownTrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [RestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [LockedDownRestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [LocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [LockedDownLocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [LockedDownInternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [IntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [LockedDownIntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [TrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [LockedDownTrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [RestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [LockedDownRestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [LocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [LockedDownLocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [IntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [LocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [IntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [LocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [LockedDownInternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [IntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [LockedDownIntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [TrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [RestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [LocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [LockedDownInternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [IntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [LockedDownIntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [TrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [LockedDownTrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [RestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [LocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [LockedDownLocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [LockedDownInternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [IntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [LockedDownIntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [TrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [RestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [LocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [LockedDownInternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [IntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [LockedDownIntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [TrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [LockedDownTrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [RestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [LockedDownRestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [LocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [LockedDownLocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [LockedDownInternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [IntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [LockedDownIntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [TrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [LockedDownTrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [RestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [LockedDownRestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [LocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [LockedDownLocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [LockedDownInternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [IntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [LockedDownIntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [TrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [LockedDownTrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [RestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [LocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [LockedDownLocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [AllowAddOnList](policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [DoNotBlockOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [DoNotBlockOutdatedActiveXControlsOnSpecificDomains](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [DisableEnclosureDownloading](policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [DisableBypassOfSmartScreenWarnings](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [DisableBypassOfSmartScreenWarningsAboutUncommonFiles](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [AllowOneWordEntry](policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [AllowEnterpriseModeFromToolsMenu](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [RestrictedSitesZoneAllowActiveScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [RestrictedSitesZoneAllowBinaryAndScriptBehaviors](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [RestrictedSitesZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [AllowDeletingBrowsingHistoryOnExit](policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [RestrictedSitesZoneAllowFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [RestrictedSitesZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [RestrictedSitesZoneAllowMETAREFRESH](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [RestrictedSitesZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [AllowSoftwareWhenSignatureIsInvalid](policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [CheckServerCertificateRevocation](policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [CheckSignaturesOnDownloadedPrograms](policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [DisableConfiguringHistory](policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [DoNotAllowActiveXControlsInProtectedMode](policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [RestrictedSitesZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [RestrictedSitesZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [RestrictedSitesZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [ConsistentMimeHandlingInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [MimeSniffingSafetyFeatureInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [MKProtocolSecurityRestrictionInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [NotificationBarInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [ProtectionFromZoneElevationInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [RestrictActiveXInstallInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [RestrictFileDownloadInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [IntranetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [LocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [LockedDownInternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [LockedDownLocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [LockedDownRestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [LockedDownTrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [RestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [TrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [RestrictedSitesZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [DisableDeletingUserVisitedWebsites](policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [DisableIgnoringCertificateErrors](policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [PreventPerUserInstallationOfActiveXControls](policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [RemoveRunThisTimeButtonForOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [RestrictedSitesZoneRunActiveXControlsAndPlugins](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [RestrictedSitesZoneScriptingOfJavaApplets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [SpecifyUseOfActiveXInstallerService](policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [DisableCrashDetection](policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [DisableInPrivateBrowsing](policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [DisableSecuritySettingsCheck](policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [DisableProcessesInEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [AllowCertificateAddressMismatchWarning](policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [RestrictedSitesZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetZoneEnableProtectedMode](policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [RestrictedSitesZoneTurnOnProtectedMode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [AllowAutoComplete](policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [RestrictedSitesZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [LockedDownIntranetJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [DisableHTMLApplication](policy-csp-internetexplorer.md#internetexplorer-disablehtmlapplication) +- [AddSearchProvider](policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [DisableSecondaryHomePageChange](policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [DisableUpdateCheck](policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [DisableProxyChange](policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [DisableSearchProviderChange](policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [DisableCustomerExperienceImprovementProgramParticipation](policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [AllowSuggestedSites](policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [DisableFirstRunWizard](policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [DisableFlipAheadFeature](policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [PreventManagingSmartScreenFilter](policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [SearchProviderList](policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [DoNotAllowUsersToAddSites](policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [DoNotAllowUsersToChangePolicies](policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [AllowActiveXFiltering](policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [AllowEnterpriseModeSiteList](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [SendSitesNotInEnterpriseSiteListToEdge](policy-csp-internetexplorer.md#internetexplorer-sendsitesnotinenterprisesitelisttoedge) +- [ConfigureEdgeRedirectChannel](policy-csp-internetexplorer.md#internetexplorer-configureedgeredirectchannel) +- [KeepIntranetSitesInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-keepintranetsitesininternetexplorer) +- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md#internetexplorer-allowsavetargetasiniemode) +- [DisableInternetExplorerApp](policy-csp-internetexplorer.md#internetexplorer-disableinternetexplorerapp) +- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md#internetexplorer-enableextendediemodehotkeys) +- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md#internetexplorer-resetzoomfordialoginiemode) +- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md#internetexplorer-enableglobalwindowlistiniemode) +- [JScriptReplacement](policy-csp-internetexplorer.md#internetexplorer-jscriptreplacement) +- [AllowInternetExplorerStandardsMode](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [AllowInternetExplorer7PolicyList](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [DisableEncryptionSupport](policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [AllowEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [AllowInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [IncludeAllLocalSites](policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [IncludeAllNetworkPaths](policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [AllowIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [AllowLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [AllowLockedDownInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [AllowLockedDownIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [AllowLockedDownLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [AllowLockedDownRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [AllowsLockedDownTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [AllowsRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [AllowSiteToZoneAssignmentList](policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [AllowTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [LockedDownInternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [IntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [LockedDownIntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [TrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [LockedDownTrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [RestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [LockedDownRestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [LocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [LockedDownLocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [LockedDownInternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [IntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [LockedDownIntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [TrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [LockedDownTrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [RestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [LockedDownRestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [LocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [LockedDownLocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [LockedDownInternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [IntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [LockedDownIntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [TrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [LockedDownTrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [RestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [LockedDownRestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [LocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [LockedDownLocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [IntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [LocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [IntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [LocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [LockedDownInternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [IntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [LockedDownIntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [TrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [RestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [LocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [LockedDownInternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [IntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [LockedDownIntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [TrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [LockedDownTrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [RestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [LocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [LockedDownLocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [LockedDownInternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [IntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [LockedDownIntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [TrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [RestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [LocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [LockedDownInternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [IntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [LockedDownIntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [TrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [LockedDownTrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [RestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [LockedDownRestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [LocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [LockedDownLocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [LockedDownInternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [IntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [LockedDownIntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [TrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [LockedDownTrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [RestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [LockedDownRestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [LocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [LockedDownLocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [LockedDownInternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [IntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [LockedDownIntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [TrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [LockedDownTrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [RestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [LocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [LockedDownLocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [AllowAddOnList](policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [DoNotBlockOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [DoNotBlockOutdatedActiveXControlsOnSpecificDomains](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [DisableEnclosureDownloading](policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [DisableBypassOfSmartScreenWarnings](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [DisableBypassOfSmartScreenWarningsAboutUncommonFiles](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [AllowOneWordEntry](policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [AllowEnterpriseModeFromToolsMenu](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [RestrictedSitesZoneAllowActiveScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [RestrictedSitesZoneAllowBinaryAndScriptBehaviors](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [RestrictedSitesZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [AllowDeletingBrowsingHistoryOnExit](policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [AllowFallbackToSSL3](policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [RestrictedSitesZoneAllowFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [RestrictedSitesZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [RestrictedSitesZoneAllowMETAREFRESH](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [RestrictedSitesZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [AllowSoftwareWhenSignatureIsInvalid](policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [CheckServerCertificateRevocation](policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [CheckSignaturesOnDownloadedPrograms](policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [DisableConfiguringHistory](policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [DoNotAllowActiveXControlsInProtectedMode](policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [RestrictedSitesZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [RestrictedSitesZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [RestrictedSitesZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [ConsistentMimeHandlingInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [MimeSniffingSafetyFeatureInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [MKProtocolSecurityRestrictionInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [NotificationBarInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [ProtectionFromZoneElevationInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [RestrictActiveXInstallInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [RestrictFileDownloadInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [IntranetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [LocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [LockedDownInternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [LockedDownLocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [LockedDownRestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [LockedDownTrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [RestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [TrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [RestrictedSitesZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [DisableDeletingUserVisitedWebsites](policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [DisableIgnoringCertificateErrors](policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [PreventPerUserInstallationOfActiveXControls](policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [RemoveRunThisTimeButtonForOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [RestrictedSitesZoneRunActiveXControlsAndPlugins](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [RestrictedSitesZoneScriptingOfJavaApplets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [SecurityZonesUseOnlyMachineSettings](policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [SpecifyUseOfActiveXInstallerService](policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [DisableCrashDetection](policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [DisableInPrivateBrowsing](policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [DisableSecuritySettingsCheck](policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [DisableProcessesInEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [AllowCertificateAddressMismatchWarning](policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [RestrictedSitesZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetZoneEnableProtectedMode](policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [RestrictedSitesZoneTurnOnProtectedMode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [RestrictedSitesZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [LockedDownIntranetJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [DisableHTMLApplication](policy-csp-internetexplorer.md#internetexplorer-disablehtmlapplication) + +## Kerberos + +- [RequireKerberosArmoring](policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [KerberosClientSupportsClaimsCompoundArmor](policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [RequireStrictKDCValidation](policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [SetMaximumContextTokenSize](policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [AllowForestSearchOrder](policy-csp-kerberos.md#kerberos-allowforestsearchorder) + +## LocalSecurityAuthority + +- [AllowCustomSSPsAPs](policy-csp-lsa.md#localsecurityauthority-allowcustomsspsaps) + +## MixedReality + +- [ConfigureNtpClient](policy-csp-mixedreality.md#mixedreality-configurentpclient) +- [NtpClientEnabled](policy-csp-mixedreality.md#mixedreality-ntpclientenabled) + +## MSSecurityGuide + +- [ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [ConfigureSMBV1Server](policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [ConfigureSMBV1ClientDriver](policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [EnableStructuredExceptionHandlingOverwriteProtection](policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [WDigestAuthentication](policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) + +## MSSLegacy + +- [IPv6SourceRoutingProtectionLevel](policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [IPSourceRoutingProtectionLevel](policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) + +## Power + +- [AllowStandbyWhenSleepingPluggedIn](policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [RequirePasswordWhenComputerWakesOnBattery](policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [RequirePasswordWhenComputerWakesPluggedIn](policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [StandbyTimeoutPluggedIn](policy-csp-power.md#power-standbytimeoutpluggedin) +- [StandbyTimeoutOnBattery](policy-csp-power.md#power-standbytimeoutonbattery) +- [HibernateTimeoutPluggedIn](policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [HibernateTimeoutOnBattery](policy-csp-power.md#power-hibernatetimeoutonbattery) +- [DisplayOffTimeoutPluggedIn](policy-csp-power.md#power-displayofftimeoutpluggedin) +- [DisplayOffTimeoutOnBattery](policy-csp-power.md#power-displayofftimeoutonbattery) +- [AllowStandbyStatesWhenSleepingOnBattery](policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) + +## Printers + +- [PointAndPrintRestrictions_User](policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [EnableDeviceControlUser](policy-csp-printers.md#printers-enabledevicecontroluser) +- [ApprovedUsbPrintDevicesUser](policy-csp-printers.md#printers-approvedusbprintdevicesuser) +- [PointAndPrintRestrictions](policy-csp-printers.md#printers-pointandprintrestrictions) +- [PublishPrinters](policy-csp-printers.md#printers-publishprinters) +- [EnableDeviceControl](policy-csp-printers.md#printers-enabledevicecontrol) +- [ApprovedUsbPrintDevices](policy-csp-printers.md#printers-approvedusbprintdevices) +- [RestrictDriverInstallationToAdministrators](policy-csp-printers.md#printers-restrictdriverinstallationtoadministrators) +- [ConfigureCopyFilesPolicy](policy-csp-printers.md#printers-configurecopyfilespolicy) +- [ConfigureDriverValidationLevel](policy-csp-printers.md#printers-configuredrivervalidationlevel) +- [ManageDriverExclusionList](policy-csp-printers.md#printers-managedriverexclusionlist) +- [ConfigureRpcListenerPolicy](policy-csp-printers.md#printers-configurerpclistenerpolicy) +- [ConfigureRpcConnectionPolicy](policy-csp-printers.md#printers-configurerpcconnectionpolicy) +- [ConfigureRpcTcpPort](policy-csp-printers.md#printers-configurerpctcpport) +- [ConfigureIppPageCountsPolicy](policy-csp-printers.md#printers-configureipppagecountspolicy) +- [ConfigureRedirectionGuardPolicy](policy-csp-printers.md#printers-configureredirectionguardpolicy) + +## RemoteAssistance + +- [UnsolicitedRemoteAssistance](policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [SolicitedRemoteAssistance](policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [CustomizeWarningMessages](policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [SessionLogging](policy-csp-remoteassistance.md#remoteassistance-sessionlogging) + +## RemoteDesktopServices + +- [DoNotAllowPasswordSaving](policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [AllowUsersToConnectRemotely](policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [DoNotAllowDriveRedirection](policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [PromptForPasswordUponConnection](policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RequireSecureRPCCommunication](policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [ClientConnectionEncryptionLevel](policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [DoNotAllowWebAuthnRedirection](policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowwebauthnredirection) + +## RemoteManagement + +- [AllowBasicAuthentication_Client](policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [AllowBasicAuthentication_Service](policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [AllowUnencryptedTraffic_Client](policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [AllowUnencryptedTraffic_Service](policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [DisallowDigestAuthentication](policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [DisallowStoringOfRunAsCredentials](policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [AllowCredSSPAuthenticationClient](policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [AllowCredSSPAuthenticationService](policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [DisallowNegotiateAuthenticationClient](policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [DisallowNegotiateAuthenticationService](policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [TrustedHosts](policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [AllowRemoteServerManagement](policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [SpecifyChannelBindingTokenHardeningLevel](policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [TurnOnCompatibilityHTTPListener](policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [TurnOnCompatibilityHTTPSListener](policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) + +## RemoteProcedureCall + +- [RPCEndpointMapperClientAuthentication](policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RestrictUnauthenticatedRPCClients](policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) + +## RemoteShell + +- [AllowRemoteShellAccess](policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [SpecifyIdleTimeout](policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [MaxConcurrentUsers](policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [SpecifyMaxMemory](policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [SpecifyMaxProcesses](policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [SpecifyMaxRemoteShells](policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [SpecifyShellTimeout](policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) + +## ServiceControlManager + +- [SvchostProcessMitigation](policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) + +## SettingsSync + +- [DisableAccessibilitySettingSync](policy-csp-settingssync.md#settingssync-disableaccessibilitysettingsync) + +## Storage + +- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md#storage-wpddevicesdenyreadaccessperuser) +- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md#storage-wpddevicesdenywriteaccessperuser) +- [EnhancedStorageDevices](policy-csp-storage.md#storage-enhancedstoragedevices) +- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md#storage-wpddevicesdenyreadaccessperdevice) +- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md#storage-wpddevicesdenywriteaccessperdevice) + +## System + +- [BootStartDriverInitialization](policy-csp-system.md#system-bootstartdriverinitialization) +- [DisableSystemRestore](policy-csp-system.md#system-disablesystemrestore) + +## TenantRestrictions + +- [ConfigureTenantRestrictions](policy-csp-tenantrestrictions.md#tenantrestrictions-configuretenantrestrictions) + +## WindowsConnectionManager + +- [ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) + +## WindowsLogon + +- [DontDisplayNetworkSelectionUI](policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [DisableLockScreenAppNotifications](policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [EnumerateLocalUsersOnDomainJoinedComputers](policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [AllowAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [EnableMPRNotifications](policy-csp-windowslogon.md#windowslogon-enablemprnotifications) + +## WindowsPowerShell + +- [TurnOnPowerShellScriptBlockLogging](policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +- [TurnOnPowerShellScriptBlockLogging](policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index a3a69669c7..c6bf79ea9c 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -1,903 +1,938 @@ --- title: Policies in Policy CSP supported by Group Policy description: Learn about the policies in Policy CSP supported by Group Policy. -ms.reviewer: +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft +ms.date: 11/01/2022 ms.localizationpriority: medium -ms.date: 07/18/2019 +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article --- -# Policies in Policy CSP supported by Group Policy + -- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) -- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) -- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) -- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) -- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) -- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) -- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) -- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) -- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) -- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) -- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) -- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) -- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) -- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) -- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) -- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) -- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) -- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) -- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) -- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) -- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) -- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) -- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) -- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) -- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) -- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) -- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) -- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) -- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) -- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) -- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) -- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) -- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) -- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) -- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) -- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) -- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) -- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) -- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) -- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) -- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) -- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) -- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) -- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) -- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) -- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) -- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) -- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) -- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) -- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) -- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) -- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) -- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) -- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) -- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) -- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) -- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) -- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) -- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) -- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) -- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) -- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) -- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) -- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) -- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) -- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) -- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) -- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) -- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-disableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) -- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) -- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) -- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) -- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) -- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) -- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) -- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) -- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) -- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) -- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) -- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) -- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) -- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) -- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) -- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) -- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) -- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) -- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) -- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) -- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) -- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) -- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) -- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) -- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) -- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODelayCacheServerFallbackBackground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DeliveryOptimization/DODelayCacheServerFallbackForeground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) -- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) -- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) -- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationallowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallationpreventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallationpreventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) -- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) -- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) -- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) -- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) -- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) -- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) -- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) -- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) -- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) -- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) -- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) -- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) -- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) -- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) -- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) -- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) -- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) -- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) -- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) -- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) -- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) -- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) -- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) -- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) -- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) -- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) -- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) -- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) -- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) -- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) -- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) -- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) -- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) -- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) -- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) -- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) -- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) -- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) -- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) -- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) -- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) -- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) -- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) -- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) -- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) -- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) -- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) -- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) -- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) -- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) -- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/SelectLidCloseActionOnBattery](./policy-csp-power.md#power-selectlidcloseactiononbattery) -- [Power/SelectLidCloseActionPluggedIn](./policy-csp-power.md#power-selectlidcloseactionpluggedin) -- [Power/SelectPowerButtonActionOnBattery](./policy-csp-power.md#power-selectpowerbuttonactiononbattery) -- [Power/SelectPowerButtonActionPluggedIn](./policy-csp-power.md#power-selectpowerbuttonactionpluggedin) -- [Power/SelectSleepButtonActionOnBattery](./policy-csp-power.md#power-selectsleepbuttonactiononbattery) -- [Power/SelectSleepButtonActionPluggedIn](./policy-csp-power.md#power-selectsleepbuttonactionpluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Power/TurnOffHybridSleepOnBattery](./policy-csp-power.md#power-turnoffhybridsleeponbattery) -- [Power/TurnOffHybridSleepPluggedIn](./policy-csp-power.md#power-turnoffhybridsleeppluggedin) -- [Power/UnattendedSleepTimeoutOnBattery](./policy-csp-power.md#power-unattendedsleeptimeoutonbattery) -- [Power/UnattendedSleepTimeoutPluggedIn](./policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) -- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) -- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) -- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) -- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) -- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) -- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) -- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) -- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) -- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) -- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) -- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) -- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) -- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) -- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) -- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) -- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) -- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) -- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) -- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) -- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) -- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) -- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) -- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) -- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) -- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) -- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) -- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) -- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) -- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) -- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) -- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) -- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) -- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) -- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) -- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) -- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) -- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) -- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) -- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) -- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) -- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) -- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) -- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) -- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) -- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) -- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) -- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) -- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) -- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) -- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) -- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) -- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) -- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) -- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) -- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) -- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) -- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) -- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) -- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) -- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) -- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) -- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) -- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles) -- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) -- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) -- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) -- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) -- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) -- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) -- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) -- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) -- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) -- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) -- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) -- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) -- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) -- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) -- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) -- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) -- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) -- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) -- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) -- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) -- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) -- [Start/StartLayout](./policy-csp-start.md#start-startlayout) -- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) -- [System/AllowCommercialDataPipeline](./policy-csp-system.md#system-allowcommercialdatapipeline) -- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) -- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) -- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) -- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) -- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) -- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) -- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) -- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) -- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) -- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) -- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) -- [System/TurnOffFileHistory](./policy-csp-system.md#system-turnofffilehistory) -- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) -- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) -- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) -- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) -- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) -- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) -- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) -- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) -- [Troubleshooting/AllowRecommendations](./policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) -- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) -- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) -- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) -- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) -- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) -- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) -- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) -- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) -- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) -- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) -- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) -- [Update/AutomaticMaintenanceWakeUp](./policy-csp-update.md#update-automaticmaintenancewakeup) -- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) -- [Update/ConfigureDeadlineForFeatureUpdates](./policy-csp-update.md#update-configuredeadlineforfeatureupdates) -- [Update/ConfigureDeadlineForQualityUpdates](./policy-csp-update.md#update-configuredeadlineforqualityupdates) -- [Update/ConfigureDeadlineGracePeriod](./policy-csp-update.md#update-configuredeadlinegraceperiod) -- [Update/ConfigureDeadlineNoAutoReboot](./policy-csp-update.md#update-configuredeadlinenoautoreboot) -- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) -- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) -- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) -- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) -- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) -- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) -- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) -- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) -- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) -- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) -- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) -- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) -- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) -- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) -- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) -- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) -- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) -- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) -- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) -- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) -- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) -- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) -- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) -- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) -- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) -- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) -- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) -- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) -- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) -- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) -- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) -- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) -- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) -- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) -- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) -- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) -- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) -- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) -- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) -- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) -- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) -- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) -- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) -- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) -- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) -- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) -- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) -- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) -- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) -- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) -- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) -- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) -- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) -- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) -- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) -- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) -- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) -- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) -- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) -- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) -- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) -- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) -- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) -- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) -- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) -- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) -- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) -- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) -- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) -- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) -- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) -- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) -- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) -- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) -- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) -- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) -- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) -- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) -- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) -- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) -- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) -- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) -- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) -- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) -- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) -- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) -- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) -- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnableFirstLogonAnimation](./policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) -- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) -- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) +# Policies in Policy CSP supported by group policy -## Related topics +This article lists the policies in Policy CSP that have a group policy mapping. -[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file +## AboveLock + +- [AllowCortanaAboveLock](policy-csp-abovelock.md#abovelock-allowcortanaabovelock) + +## Accounts + +- [RestrictToEnterpriseDeviceAuthenticationOnly](policy-csp-accounts.md#accounts-restricttoenterprisedeviceauthenticationonly) + +## ApplicationDefaults + +- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) +- [EnableAppUriHandlers](policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) + +## ApplicationManagement + +- [RequirePrivateStoreOnly](policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) +- [MSIAlwaysInstallWithElevatedPrivileges](policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) +- [AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [AllowAutomaticAppArchiving](policy-csp-applicationmanagement.md#applicationmanagement-allowautomaticapparchiving) +- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [AllowGameDVR](policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) +- [AllowSharedUserAppData](policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) +- [RequirePrivateStoreOnly](policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) +- [MSIAlwaysInstallWithElevatedPrivileges](policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) +- [MSIAllowUserControlOverInstall](policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) +- [RestrictAppDataToSystemVolume](policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) +- [RestrictAppToSystemVolume](policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) +- [DisableStoreOriginatedApps](policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) +- [BlockNonAdminUserInstall](policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall) + +## Audit + +- [AccountLogon_AuditCredentialValidation](policy-csp-audit.md#audit-accountlogon-auditcredentialvalidation) +- [AccountLogon_AuditKerberosAuthenticationService](policy-csp-audit.md#audit-accountlogon-auditkerberosauthenticationservice) +- [AccountLogon_AuditKerberosServiceTicketOperations](policy-csp-audit.md#audit-accountlogon-auditkerberosserviceticketoperations) +- [AccountLogon_AuditOtherAccountLogonEvents](policy-csp-audit.md#audit-accountlogon-auditotheraccountlogonevents) +- [AccountManagement_AuditApplicationGroupManagement](policy-csp-audit.md#audit-accountmanagement-auditapplicationgroupmanagement) +- [AccountManagement_AuditComputerAccountManagement](policy-csp-audit.md#audit-accountmanagement-auditcomputeraccountmanagement) +- [AccountManagement_AuditDistributionGroupManagement](policy-csp-audit.md#audit-accountmanagement-auditdistributiongroupmanagement) +- [AccountManagement_AuditOtherAccountManagementEvents](policy-csp-audit.md#audit-accountmanagement-auditotheraccountmanagementevents) +- [AccountManagement_AuditSecurityGroupManagement](policy-csp-audit.md#audit-accountmanagement-auditsecuritygroupmanagement) +- [AccountManagement_AuditUserAccountManagement](policy-csp-audit.md#audit-accountmanagement-audituseraccountmanagement) +- [DetailedTracking_AuditDPAPIActivity](policy-csp-audit.md#audit-detailedtracking-auditdpapiactivity) +- [DetailedTracking_AuditPNPActivity](policy-csp-audit.md#audit-detailedtracking-auditpnpactivity) +- [DetailedTracking_AuditProcessCreation](policy-csp-audit.md#audit-detailedtracking-auditprocesscreation) +- [DetailedTracking_AuditProcessTermination](policy-csp-audit.md#audit-detailedtracking-auditprocesstermination) +- [DetailedTracking_AuditRPCEvents](policy-csp-audit.md#audit-detailedtracking-auditrpcevents) +- [DetailedTracking_AuditTokenRightAdjusted](policy-csp-audit.md#audit-detailedtracking-audittokenrightadjusted) +- [DSAccess_AuditDetailedDirectoryServiceReplication](policy-csp-audit.md#audit-dsaccess-auditdetaileddirectoryservicereplication) +- [DSAccess_AuditDirectoryServiceAccess](policy-csp-audit.md#audit-dsaccess-auditdirectoryserviceaccess) +- [DSAccess_AuditDirectoryServiceChanges](policy-csp-audit.md#audit-dsaccess-auditdirectoryservicechanges) +- [DSAccess_AuditDirectoryServiceReplication](policy-csp-audit.md#audit-dsaccess-auditdirectoryservicereplication) +- [AccountLogonLogoff_AuditAccountLockout](policy-csp-audit.md#audit-accountlogonlogoff-auditaccountlockout) +- [AccountLogonLogoff_AuditUserDeviceClaims](policy-csp-audit.md#audit-accountlogonlogoff-audituserdeviceclaims) +- [AccountLogonLogoff_AuditGroupMembership](policy-csp-audit.md#audit-accountlogonlogoff-auditgroupmembership) +- [AccountLogonLogoff_AuditIPsecExtendedMode](policy-csp-audit.md#audit-accountlogonlogoff-auditipsecextendedmode) +- [AccountLogonLogoff_AuditIPsecMainMode](policy-csp-audit.md#audit-accountlogonlogoff-auditipsecmainmode) +- [AccountLogonLogoff_AuditIPsecQuickMode](policy-csp-audit.md#audit-accountlogonlogoff-auditipsecquickmode) +- [AccountLogonLogoff_AuditLogoff](policy-csp-audit.md#audit-accountlogonlogoff-auditlogoff) +- [AccountLogonLogoff_AuditLogon](policy-csp-audit.md#audit-accountlogonlogoff-auditlogon) +- [AccountLogonLogoff_AuditNetworkPolicyServer](policy-csp-audit.md#audit-accountlogonlogoff-auditnetworkpolicyserver) +- [AccountLogonLogoff_AuditOtherLogonLogoffEvents](policy-csp-audit.md#audit-accountlogonlogoff-auditotherlogonlogoffevents) +- [AccountLogonLogoff_AuditSpecialLogon](policy-csp-audit.md#audit-accountlogonlogoff-auditspeciallogon) +- [ObjectAccess_AuditApplicationGenerated](policy-csp-audit.md#audit-objectaccess-auditapplicationgenerated) +- [ObjectAccess_AuditCertificationServices](policy-csp-audit.md#audit-objectaccess-auditcertificationservices) +- [ObjectAccess_AuditDetailedFileShare](policy-csp-audit.md#audit-objectaccess-auditdetailedfileshare) +- [ObjectAccess_AuditFileShare](policy-csp-audit.md#audit-objectaccess-auditfileshare) +- [ObjectAccess_AuditFileSystem](policy-csp-audit.md#audit-objectaccess-auditfilesystem) +- [ObjectAccess_AuditFilteringPlatformConnection](policy-csp-audit.md#audit-objectaccess-auditfilteringplatformconnection) +- [ObjectAccess_AuditFilteringPlatformPacketDrop](policy-csp-audit.md#audit-objectaccess-auditfilteringplatformpacketdrop) +- [ObjectAccess_AuditHandleManipulation](policy-csp-audit.md#audit-objectaccess-audithandlemanipulation) +- [ObjectAccess_AuditKernelObject](policy-csp-audit.md#audit-objectaccess-auditkernelobject) +- [ObjectAccess_AuditOtherObjectAccessEvents](policy-csp-audit.md#audit-objectaccess-auditotherobjectaccessevents) +- [ObjectAccess_AuditRegistry](policy-csp-audit.md#audit-objectaccess-auditregistry) +- [ObjectAccess_AuditRemovableStorage](policy-csp-audit.md#audit-objectaccess-auditremovablestorage) +- [ObjectAccess_AuditSAM](policy-csp-audit.md#audit-objectaccess-auditsam) +- [ObjectAccess_AuditCentralAccessPolicyStaging](policy-csp-audit.md#audit-objectaccess-auditcentralaccesspolicystaging) +- [PolicyChange_AuditPolicyChange](policy-csp-audit.md#audit-policychange-auditpolicychange) +- [PolicyChange_AuditAuthenticationPolicyChange](policy-csp-audit.md#audit-policychange-auditauthenticationpolicychange) +- [PolicyChange_AuditAuthorizationPolicyChange](policy-csp-audit.md#audit-policychange-auditauthorizationpolicychange) +- [PolicyChange_AuditFilteringPlatformPolicyChange](policy-csp-audit.md#audit-policychange-auditfilteringplatformpolicychange) +- [PolicyChange_AuditMPSSVCRuleLevelPolicyChange](policy-csp-audit.md#audit-policychange-auditmpssvcrulelevelpolicychange) +- [PolicyChange_AuditOtherPolicyChangeEvents](policy-csp-audit.md#audit-policychange-auditotherpolicychangeevents) +- [PrivilegeUse_AuditNonSensitivePrivilegeUse](policy-csp-audit.md#audit-privilegeuse-auditnonsensitiveprivilegeuse) +- [PrivilegeUse_AuditOtherPrivilegeUseEvents](policy-csp-audit.md#audit-privilegeuse-auditotherprivilegeuseevents) +- [PrivilegeUse_AuditSensitivePrivilegeUse](policy-csp-audit.md#audit-privilegeuse-auditsensitiveprivilegeuse) +- [System_AuditIPsecDriver](policy-csp-audit.md#audit-system-auditipsecdriver) +- [System_AuditOtherSystemEvents](policy-csp-audit.md#audit-system-auditothersystemevents) +- [System_AuditSecurityStateChange](policy-csp-audit.md#audit-system-auditsecuritystatechange) +- [System_AuditSecuritySystemExtension](policy-csp-audit.md#audit-system-auditsecuritysystemextension) +- [System_AuditSystemIntegrity](policy-csp-audit.md#audit-system-auditsystemintegrity) + +## Authentication + +- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) + +## BITS + +- [JobInactivityTimeout](policy-csp-bits.md#bits-jobinactivitytimeout) +- [BandwidthThrottlingStartTime](policy-csp-bits.md#bits-bandwidththrottlingstarttime) +- [BandwidthThrottlingEndTime](policy-csp-bits.md#bits-bandwidththrottlingendtime) +- [BandwidthThrottlingTransferRate](policy-csp-bits.md#bits-bandwidththrottlingtransferrate) +- [CostedNetworkBehaviorForegroundPriority](policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) +- [CostedNetworkBehaviorBackgroundPriority](policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) + +## Browser + +- [AllowAddressBarDropdown](policy-csp-browser.md#browser-allowaddressbardropdown) +- [AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [AllowDeveloperTools](policy-csp-browser.md#browser-allowdevelopertools) +- [AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [AllowExtensions](policy-csp-browser.md#browser-allowextensions) +- [AllowFlash](policy-csp-browser.md#browser-allowflash) +- [AllowFlashClickToRun](policy-csp-browser.md#browser-allowflashclicktorun) +- [AllowFullScreenMode](policy-csp-browser.md#browser-allowfullscreenmode) +- [AllowInPrivate](policy-csp-browser.md#browser-allowinprivate) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) +- [ConfigureTelemetryForMicrosoft365Analytics](policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) +- [AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [AllowPrinting](policy-csp-browser.md#browser-allowprinting) +- [AllowSavingHistory](policy-csp-browser.md#browser-allowsavinghistory) +- [AllowSearchEngineCustomization](policy-csp-browser.md#browser-allowsearchenginecustomization) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [AllowSideloadingOfExtensions](policy-csp-browser.md#browser-allowsideloadingofextensions) +- [AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [AllowWebContentOnNewTabPage](policy-csp-browser.md#browser-allowwebcontentonnewtabpage) +- [AlwaysEnableBooksLibrary](policy-csp-browser.md#browser-alwaysenablebookslibrary) +- [ClearBrowsingDataOnExit](policy-csp-browser.md#browser-clearbrowsingdataonexit) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#browser-configureadditionalsearchengines) +- [ConfigureFavoritesBar](policy-csp-browser.md#browser-configurefavoritesbar) +- [ConfigureHomeButton](policy-csp-browser.md#browser-configurehomebutton) +- [ConfigureOpenMicrosoftEdgeWith](policy-csp-browser.md#browser-configureopenmicrosoftedgewith) +- [DisableLockdownOfStartPages](policy-csp-browser.md#browser-disablelockdownofstartpages) +- [EnableExtendedBooksTelemetry](policy-csp-browser.md#browser-enableextendedbookstelemetry) +- [AllowTabPreloading](policy-csp-browser.md#browser-allowtabpreloading) +- [AllowPrelaunch](policy-csp-browser.md#browser-allowprelaunch) +- [EnterpriseModeSiteList](policy-csp-browser.md#browser-enterprisemodesitelist) +- [PreventTurningOffRequiredExtensions](policy-csp-browser.md#browser-preventturningoffrequiredextensions) +- [HomePages](policy-csp-browser.md#browser-homepages) +- [LockdownFavorites](policy-csp-browser.md#browser-lockdownfavorites) +- [ConfigureKioskMode](policy-csp-browser.md#browser-configurekioskmode) +- [ConfigureKioskResetAfterIdleTimeout](policy-csp-browser.md#browser-configurekioskresetafteridletimeout) +- [PreventAccessToAboutFlagsInMicrosoftEdge](policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) +- [PreventFirstRunPage](policy-csp-browser.md#browser-preventfirstrunpage) +- [PreventCertErrorOverrides](policy-csp-browser.md#browser-preventcerterroroverrides) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md#browser-preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) +- [PreventLiveTileDataCollection](policy-csp-browser.md#browser-preventlivetiledatacollection) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) +- [ProvisionFavorites](policy-csp-browser.md#browser-provisionfavorites) +- [SendIntranetTraffictoInternetExplorer](policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) +- [SetDefaultSearchEngine](policy-csp-browser.md#browser-setdefaultsearchengine) +- [SetHomeButtonURL](policy-csp-browser.md#browser-sethomebuttonurl) +- [SetNewTabPageURL](policy-csp-browser.md#browser-setnewtabpageurl) +- [ShowMessageWhenOpeningSitesInInternetExplorer](policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) +- [SyncFavoritesBetweenIEAndMicrosoftEdge](policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) +- [UnlockHomeButton](policy-csp-browser.md#browser-unlockhomebutton) +- [UseSharedFolderForBooks](policy-csp-browser.md#browser-usesharedfolderforbooks) +- [AllowAddressBarDropdown](policy-csp-browser.md#browser-allowaddressbardropdown) +- [AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [AllowDeveloperTools](policy-csp-browser.md#browser-allowdevelopertools) +- [AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [AllowExtensions](policy-csp-browser.md#browser-allowextensions) +- [AllowFlash](policy-csp-browser.md#browser-allowflash) +- [AllowFlashClickToRun](policy-csp-browser.md#browser-allowflashclicktorun) +- [AllowFullScreenMode](policy-csp-browser.md#browser-allowfullscreenmode) +- [AllowInPrivate](policy-csp-browser.md#browser-allowinprivate) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) +- [ConfigureTelemetryForMicrosoft365Analytics](policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) +- [AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [AllowPrinting](policy-csp-browser.md#browser-allowprinting) +- [AllowSavingHistory](policy-csp-browser.md#browser-allowsavinghistory) +- [AllowSearchEngineCustomization](policy-csp-browser.md#browser-allowsearchenginecustomization) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [AllowSideloadingOfExtensions](policy-csp-browser.md#browser-allowsideloadingofextensions) +- [AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [AllowWebContentOnNewTabPage](policy-csp-browser.md#browser-allowwebcontentonnewtabpage) +- [AlwaysEnableBooksLibrary](policy-csp-browser.md#browser-alwaysenablebookslibrary) +- [ClearBrowsingDataOnExit](policy-csp-browser.md#browser-clearbrowsingdataonexit) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#browser-configureadditionalsearchengines) +- [ConfigureFavoritesBar](policy-csp-browser.md#browser-configurefavoritesbar) +- [ConfigureHomeButton](policy-csp-browser.md#browser-configurehomebutton) +- [ConfigureOpenMicrosoftEdgeWith](policy-csp-browser.md#browser-configureopenmicrosoftedgewith) +- [DisableLockdownOfStartPages](policy-csp-browser.md#browser-disablelockdownofstartpages) +- [EnableExtendedBooksTelemetry](policy-csp-browser.md#browser-enableextendedbookstelemetry) +- [AllowTabPreloading](policy-csp-browser.md#browser-allowtabpreloading) +- [AllowPrelaunch](policy-csp-browser.md#browser-allowprelaunch) +- [EnterpriseModeSiteList](policy-csp-browser.md#browser-enterprisemodesitelist) +- [PreventTurningOffRequiredExtensions](policy-csp-browser.md#browser-preventturningoffrequiredextensions) +- [HomePages](policy-csp-browser.md#browser-homepages) +- [LockdownFavorites](policy-csp-browser.md#browser-lockdownfavorites) +- [ConfigureKioskMode](policy-csp-browser.md#browser-configurekioskmode) +- [ConfigureKioskResetAfterIdleTimeout](policy-csp-browser.md#browser-configurekioskresetafteridletimeout) +- [PreventAccessToAboutFlagsInMicrosoftEdge](policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) +- [PreventFirstRunPage](policy-csp-browser.md#browser-preventfirstrunpage) +- [PreventCertErrorOverrides](policy-csp-browser.md#browser-preventcerterroroverrides) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md#browser-preventsmartscreenpromptoverride) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) +- [PreventLiveTileDataCollection](policy-csp-browser.md#browser-preventlivetiledatacollection) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) +- [ProvisionFavorites](policy-csp-browser.md#browser-provisionfavorites) +- [SendIntranetTraffictoInternetExplorer](policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) +- [SetDefaultSearchEngine](policy-csp-browser.md#browser-setdefaultsearchengine) +- [SetHomeButtonURL](policy-csp-browser.md#browser-sethomebuttonurl) +- [SetNewTabPageURL](policy-csp-browser.md#browser-setnewtabpageurl) +- [ShowMessageWhenOpeningSitesInInternetExplorer](policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) +- [SyncFavoritesBetweenIEAndMicrosoftEdge](policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) +- [UnlockHomeButton](policy-csp-browser.md#browser-unlockhomebutton) +- [UseSharedFolderForBooks](policy-csp-browser.md#browser-usesharedfolderforbooks) + +## Camera + +- [AllowCamera](policy-csp-camera.md#camera-allowcamera) + +## Cellular + +- [LetAppsAccessCellularData](policy-csp-cellular.md#cellular-letappsaccesscellulardata) +- [LetAppsAccessCellularData_ForceAllowTheseApps](policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) +- [LetAppsAccessCellularData_ForceDenyTheseApps](policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) +- [LetAppsAccessCellularData_UserInControlOfTheseApps](policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) + +## Connectivity + +- [AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [AllowPhonePCLinking](policy-csp-connectivity.md#connectivity-allowphonepclinking) +- [DisallowNetworkConnectivityActiveTests](policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) + +## Cryptography + +- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) + +## Defender + +- [AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) +- [AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) +- [AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) +- [AllowEmailScanning](policy-csp-defender.md#allowemailscanning) +- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) +- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) +- [AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) +- [AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) +- [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) +- [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) +- [AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) +- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions) +- [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules) +- [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) +- [CloudBlockLevel](policy-csp-defender.md#cloudblocklevel) +- [CloudExtendedTimeout](policy-csp-defender.md#cloudextendedtimeout) +- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md#controlledfolderaccessallowedapplications) +- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md#checkforsignaturesbeforerunningscan) +- [SecurityIntelligenceLocation](policy-csp-defender.md#securityintelligencelocation) +- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md#controlledfolderaccessprotectedfolders) +- [DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) +- [DisableCatchupFullScan](policy-csp-defender.md#disablecatchupfullscan) +- [DisableCatchupQuickScan](policy-csp-defender.md#disablecatchupquickscan) +- [EnableControlledFolderAccess](policy-csp-defender.md#enablecontrolledfolderaccess) +- [EnableLowCPUPriority](policy-csp-defender.md#enablelowcpupriority) +- [EnableNetworkProtection](policy-csp-defender.md#enablenetworkprotection) +- [ExcludedPaths](policy-csp-defender.md#excludedpaths) +- [ExcludedExtensions](policy-csp-defender.md#excludedextensions) +- [ExcludedProcesses](policy-csp-defender.md#excludedprocesses) +- [PUAProtection](policy-csp-defender.md#puaprotection) +- [RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) +- [ScanParameter](policy-csp-defender.md#scanparameter) +- [ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) +- [ScheduleScanDay](policy-csp-defender.md#schedulescanday) +- [ScheduleScanTime](policy-csp-defender.md#schedulescantime) +- [SignatureUpdateFallbackOrder](policy-csp-defender.md#signatureupdatefallbackorder) +- [SignatureUpdateFileSharesSources](policy-csp-defender.md#signatureupdatefilesharessources) +- [SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) +- [SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) +- [ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) + +## DeliveryOptimization + +- [DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth) +- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth) +- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource) +- [DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) + +## DeviceGuard + +- [EnableVirtualizationBasedSecurity](policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) +- [RequirePlatformSecurityFeatures](policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) +- [LsaCfgFlags](policy-csp-deviceguard.md#deviceguard-lsacfgflags) +- [ConfigureSystemGuardLaunch](policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) + +## DeviceLock + +- [MinimumPasswordAge](policy-csp-devicelock.md#devicelock-minimumpasswordage) +- [MaximumPasswordAge](policy-csp-devicelock.md#devicelock-maximumpasswordage) +- [ClearTextPassword](policy-csp-devicelock.md#devicelock-cleartextpassword) +- [PasswordComplexity](policy-csp-devicelock.md#devicelock-passwordcomplexity) +- [PasswordHistorySize](policy-csp-devicelock.md#devicelock-passwordhistorysize) + +## Display + +- [EnablePerProcessDpi](policy-csp-display.md#display-enableperprocessdpi) +- [TurnOnGdiDPIScalingForApps](policy-csp-display.md#display-turnongdidpiscalingforapps) +- [TurnOffGdiDPIScalingForApps](policy-csp-display.md#display-turnoffgdidpiscalingforapps) +- [EnablePerProcessDpi](policy-csp-display.md#display-enableperprocessdpi) +- [EnablePerProcessDpiForApps](policy-csp-display.md#display-enableperprocessdpiforapps) +- [DisablePerProcessDpiForApps](policy-csp-display.md#display-disableperprocessdpiforapps) + +## DmaGuard + +- [DeviceEnumerationPolicy](policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) + +## Education + +- [AllowGraphingCalculator](policy-csp-education.md#education-allowgraphingcalculator) +- [PreventAddingNewPrinters](policy-csp-education.md#education-preventaddingnewprinters) + +## Experience + +- [AllowSpotlightCollection](policy-csp-experience.md#experience-allowspotlightcollection) +- [AllowThirdPartySuggestionsInWindowsSpotlight](policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) +- [AllowWindowsSpotlight](policy-csp-experience.md#experience-allowwindowsspotlight) +- [AllowWindowsSpotlightOnActionCenter](policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) +- [AllowWindowsSpotlightOnSettings](policy-csp-experience.md#experience-allowwindowsspotlightonsettings) +- [AllowWindowsSpotlightWindowsWelcomeExperience](policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) +- [AllowTailoredExperiencesWithDiagnosticData](policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) +- [ConfigureWindowsSpotlightOnLockScreen](policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) +- [AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [AllowWindowsConsumerFeatures](policy-csp-experience.md#experience-allowwindowsconsumerfeatures) +- [AllowWindowsTips](policy-csp-experience.md#experience-allowwindowstips) +- [DoNotShowFeedbackNotifications](policy-csp-experience.md#experience-donotshowfeedbacknotifications) +- [AllowFindMyDevice](policy-csp-experience.md#experience-allowfindmydevice) +- [AllowClipboardHistory](policy-csp-experience.md#experience-allowclipboardhistory) +- [DoNotSyncBrowserSettings](policy-csp-experience.md#experience-donotsyncbrowsersettings) +- [PreventUsersFromTurningOnBrowserSyncing](policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) +- [ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) +- [DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent) +- [DisableConsumerAccountStateContent](policy-csp-experience.md#experience-disableconsumeraccountstatecontent) +- [ConfigureChatIcon](policy-csp-experience.md#experience-configurechaticon) + +## ExploitGuard + +- [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) + +## FileExplorer + +- [DisableGraphRecentItems](policy-csp-fileexplorer.md#fileexplorer-disablegraphrecentitems) + +## Handwriting + +- [PanelDefaultModeDocked](policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) + +## HumanPresence + +- [ForceInstantWake](policy-csp-humanpresence.md#humanpresence-forceinstantwake) +- [ForceInstantLock](policy-csp-humanpresence.md#humanpresence-forceinstantlock) +- [ForceLockTimeout](policy-csp-humanpresence.md#humanpresence-forcelocktimeout) +- [ForceInstantDim](policy-csp-humanpresence.md#humanpresence-forceinstantdim) + +## Kerberos + +- [PKInitHashAlgorithmConfiguration](policy-csp-kerberos.md#kerberos-pkinithashalgorithmconfiguration) +- [PKInitHashAlgorithmSHA1](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha1) +- [PKInitHashAlgorithmSHA256](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha256) +- [PKInitHashAlgorithmSHA384](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha384) +- [PKInitHashAlgorithmSHA512](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha512) +- [CloudKerberosTicketRetrievalEnabled](policy-csp-kerberos.md#kerberos-cloudkerberosticketretrievalenabled) + +## LanmanWorkstation + +- [EnableInsecureGuestLogons](policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) + +## Licensing + +- [AllowWindowsEntitlementReactivation](policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) +- [DisallowKMSClientOnlineAVSValidation](policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) + +## LocalPoliciesSecurityOptions + +- [Accounts_EnableAdministratorAccountStatus](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableadministratoraccountstatus) +- [Accounts_BlockMicrosoftAccounts](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) +- [Accounts_EnableGuestAccountStatus](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableguestaccountstatus) +- [Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) +- [Accounts_RenameAdministratorAccount](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) +- [Accounts_RenameGuestAccount](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) +- [Devices_AllowUndockWithoutHavingToLogon](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) +- [Devices_AllowedToFormatAndEjectRemovableMedia](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) +- [Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) +- [Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) +- [InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) +- [InteractiveLogon_DoNotRequireCTRLALTDEL](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) +- [InteractiveLogon_DoNotDisplayLastSignedIn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) +- [InteractiveLogon_DoNotDisplayUsernameAtSignIn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) +- [InteractiveLogon_MachineInactivityLimit](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) +- [InteractiveLogon_MessageTextForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) +- [InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) +- [InteractiveLogon_SmartCardRemovalBehavior](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [MicrosoftNetworkClient_DigitallySignCommunicationsAlways](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) +- [MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) +- [MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [MicrosoftNetworkServer_DigitallySignCommunicationsAlways](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) +- [MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) +- [NetworkAccess_AllowAnonymousSIDOrNameTranslation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-allowanonymoussidornametranslation) +- [NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) +- [NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) +- [NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) +- [NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowlocalsystemtousecomputeridentityforntlm) +- [NetworkSecurity_AllowPKU2UAuthenticationRequests](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) +- [NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) +- [NetworkSecurity_ForceLogoffWhenLogonHoursExpire](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-forcelogoffwhenlogonhoursexpire) +- [NetworkSecurity_LANManagerAuthenticationLevel](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) +- [NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) +- [NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) +- [NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) +- [NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) +- [NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) +- [Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) +- [Shutdown_ClearVirtualMemoryPageFile](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) +- [UserAccountControl_UseAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) +- [UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) +- [UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) +- [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) +- [UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) +- [UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) +- [UserAccountControl_RunAllAdministratorsInAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) +- [UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) +- [UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) +- [UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) + +## LocalSecurityAuthority + +- [ConfigureLsaProtectedProcess](policy-csp-lsa.md#localsecurityauthority-configurelsaprotectedprocess) + +## LockDown + +- [AllowEdgeSwipe](policy-csp-lockdown.md#lockdown-allowedgeswipe) + +## Maps + +- [EnableOfflineMapsAutoUpdate](policy-csp-maps.md#maps-enableofflinemapsautoupdate) + +## Messaging + +- [AllowMessageSync](policy-csp-messaging.md#messaging-allowmessagesync) + +## Multitasking + +- [BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) + +## NetworkIsolation + +- [EnterpriseCloudResources](policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) +- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) +- [EnterpriseIPRange](policy-csp-networkisolation.md#networkisolation-enterpriseiprange) +- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) +- [EnterpriseProxyServers](policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) +- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) +- [NeutralResources](policy-csp-networkisolation.md#networkisolation-neutralresources) + +## NewsAndInterests + +- [AllowNewsAndInterests](policy-csp-newsandinterests.md#newsandinterests-allownewsandinterests) + +## Notifications + +- [DisallowNotificationMirroring](policy-csp-notifications.md#notifications-disallownotificationmirroring) +- [DisallowTileNotification](policy-csp-notifications.md#notifications-disallowtilenotification) +- [DisallowCloudNotification](policy-csp-notifications.md#notifications-disallowcloudnotification) +- [WnsEndpoint](policy-csp-notifications.md#notifications-wnsendpoint) + +## Power + +- [EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md#power-energysaverbatterythresholdpluggedin) +- [EnergySaverBatteryThresholdOnBattery](policy-csp-power.md#power-energysaverbatterythresholdonbattery) +- [SelectPowerButtonActionPluggedIn](policy-csp-power.md#power-selectpowerbuttonactionpluggedin) +- [SelectPowerButtonActionOnBattery](policy-csp-power.md#power-selectpowerbuttonactiononbattery) +- [SelectSleepButtonActionPluggedIn](policy-csp-power.md#power-selectsleepbuttonactionpluggedin) +- [SelectSleepButtonActionOnBattery](policy-csp-power.md#power-selectsleepbuttonactiononbattery) +- [SelectLidCloseActionPluggedIn](policy-csp-power.md#power-selectlidcloseactionpluggedin) +- [SelectLidCloseActionOnBattery](policy-csp-power.md#power-selectlidcloseactiononbattery) +- [TurnOffHybridSleepPluggedIn](policy-csp-power.md#power-turnoffhybridsleeppluggedin) +- [TurnOffHybridSleepOnBattery](policy-csp-power.md#power-turnoffhybridsleeponbattery) +- [UnattendedSleepTimeoutPluggedIn](policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) +- [UnattendedSleepTimeoutOnBattery](policy-csp-power.md#power-unattendedsleeptimeoutonbattery) + +## Privacy + +- [DisablePrivacyExperience](policy-csp-privacy.md#privacy-disableprivacyexperience) +- [DisableAdvertisingId](policy-csp-privacy.md#privacy-disableadvertisingid) +- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) +- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) +- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) +- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) +- [LetAppsRunInBackground](policy-csp-privacy.md#privacy-letappsruninbackground) +- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) +- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) +- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) +- [AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [LetAppsAccessAccountInfo](policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [LetAppsAccessCalendar](policy-csp-privacy.md#privacy-letappsaccesscalendar) +- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) +- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) +- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) +- [LetAppsAccessCallHistory](policy-csp-privacy.md#privacy-letappsaccesscallhistory) +- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) +- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) +- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) +- [LetAppsAccessCamera](policy-csp-privacy.md#privacy-letappsaccesscamera) +- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) +- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) +- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) +- [LetAppsAccessContacts](policy-csp-privacy.md#privacy-letappsaccesscontacts) +- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) +- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) +- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) +- [LetAppsAccessEmail](policy-csp-privacy.md#privacy-letappsaccessemail) +- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) +- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) +- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) +- [LetAppsAccessGraphicsCaptureProgrammatic](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic) +- [LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic-forceallowtheseapps) +- [LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic-forcedenytheseapps) +- [LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic-userincontroloftheseapps) +- [LetAppsAccessGraphicsCaptureWithoutBorder](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder) +- [LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder-forceallowtheseapps) +- [LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder-forcedenytheseapps) +- [LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder-userincontroloftheseapps) +- [LetAppsAccessLocation](policy-csp-privacy.md#privacy-letappsaccesslocation) +- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) +- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) +- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) +- [LetAppsAccessMessaging](policy-csp-privacy.md#privacy-letappsaccessmessaging) +- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) +- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) +- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) +- [LetAppsAccessMicrophone](policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) +- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) +- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) +- [LetAppsAccessMotion](policy-csp-privacy.md#privacy-letappsaccessmotion) +- [LetAppsAccessMotion_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) +- [LetAppsAccessMotion_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) +- [LetAppsAccessMotion_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) +- [LetAppsAccessNotifications](policy-csp-privacy.md#privacy-letappsaccessnotifications) +- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) +- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) +- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) +- [LetAppsAccessPhone](policy-csp-privacy.md#privacy-letappsaccessphone) +- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) +- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) +- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) +- [LetAppsAccessRadios](policy-csp-privacy.md#privacy-letappsaccessradios) +- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) +- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) +- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) +- [LetAppsAccessTasks](policy-csp-privacy.md#privacy-letappsaccesstasks) +- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) +- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) +- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) +- [LetAppsAccessTrustedDevices](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) +- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) +- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) +- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) +- [LetAppsSyncWithDevices](policy-csp-privacy.md#privacy-letappssyncwithdevices) +- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) +- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) +- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) +- [EnableActivityFeed](policy-csp-privacy.md#privacy-enableactivityfeed) +- [PublishUserActivities](policy-csp-privacy.md#privacy-publishuseractivities) +- [UploadUserActivities](policy-csp-privacy.md#privacy-uploaduseractivities) +- [AllowCrossDeviceClipboard](policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) +- [DisablePrivacyExperience](policy-csp-privacy.md#privacy-disableprivacyexperience) +- [LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) + +## RemoteDesktop + +- [AutoSubscription](policy-csp-remotedesktop.md#remotedesktop-autosubscription) + +## Search + +- [AllowIndexingEncryptedStoresOrItems](policy-csp-search.md#search-allowindexingencryptedstoresoritems) +- [AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [AllowUsingDiacritics](policy-csp-search.md#search-allowusingdiacritics) +- [AlwaysUseAutoLangDetection](policy-csp-search.md#search-alwaysuseautolangdetection) +- [DisableBackoff](policy-csp-search.md#search-disablebackoff) +- [DisableRemovableDriveIndexing](policy-csp-search.md#search-disableremovabledriveindexing) +- [DisableSearch](policy-csp-search.md#search-disablesearch) +- [PreventIndexingLowDiskSpaceMB](policy-csp-search.md#search-preventindexinglowdiskspacemb) +- [PreventRemoteQueries](policy-csp-search.md#search-preventremotequeries) +- [AllowCloudSearch](policy-csp-search.md#search-allowcloudsearch) +- [DoNotUseWebResults](policy-csp-search.md#search-donotusewebresults) +- [AllowCortanaInAAD](policy-csp-search.md#search-allowcortanainaad) +- [AllowFindMyFiles](policy-csp-search.md#search-allowfindmyfiles) +- [AllowSearchHighlights](policy-csp-search.md#search-allowsearchhighlights) + +## Security + +- [ClearTPMIfNotReady](policy-csp-security.md#security-cleartpmifnotready) + +## Settings + +- [ConfigureTaskbarCalendar](policy-csp-settings.md#settings-configuretaskbarcalendar) +- [PageVisibilityList](policy-csp-settings.md#settings-pagevisibilitylist) +- [PageVisibilityList](policy-csp-settings.md#settings-pagevisibilitylist) +- [AllowOnlineTips](policy-csp-settings.md#settings-allowonlinetips) + +## SmartScreen + +- [EnableSmartScreenInShell](policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) +- [PreventOverrideForFilesInShell](policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) +- [EnableAppInstallControl](policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) + +## Speech + +- [AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) + +## Start + +- [ForceStartSize](policy-csp-start.md#start-forcestartsize) +- [DisableContextMenus](policy-csp-start.md#start-disablecontextmenus) +- [ShowOrHideMostUsedApps](policy-csp-start.md#start-showorhidemostusedapps) +- [HideFrequentlyUsedApps](policy-csp-start.md#start-hidefrequentlyusedapps) +- [HideRecentlyAddedApps](policy-csp-start.md#start-hiderecentlyaddedapps) +- [HidePeopleBar](policy-csp-start.md#start-hidepeoplebar) +- [StartLayout](policy-csp-start.md#start-startlayout) +- [ConfigureStartPins](policy-csp-start.md#start-configurestartpins) +- [HideRecommendedSection](policy-csp-start.md#start-hiderecommendedsection) +- [HideTaskViewButton](policy-csp-start.md#start-hidetaskviewbutton) +- [DisableControlCenter](policy-csp-start.md#start-disablecontrolcenter) +- [ForceStartSize](policy-csp-start.md#start-forcestartsize) +- [DisableContextMenus](policy-csp-start.md#start-disablecontextmenus) +- [ShowOrHideMostUsedApps](policy-csp-start.md#start-showorhidemostusedapps) +- [HideFrequentlyUsedApps](policy-csp-start.md#start-hidefrequentlyusedapps) +- [HideRecentlyAddedApps](policy-csp-start.md#start-hiderecentlyaddedapps) +- [StartLayout](policy-csp-start.md#start-startlayout) +- [ConfigureStartPins](policy-csp-start.md#start-configurestartpins) +- [HideRecommendedSection](policy-csp-start.md#start-hiderecommendedsection) +- [SimplifyQuickSettings](policy-csp-start.md#start-simplifyquicksettings) +- [DisableEditingQuickSettings](policy-csp-start.md#start-disableeditingquicksettings) +- [HideTaskViewButton](policy-csp-start.md#start-hidetaskviewbutton) + +## Storage + +- [AllowDiskHealthModelUpdates](policy-csp-storage.md#storage-allowdiskhealthmodelupdates) +- [RemovableDiskDenyWriteAccess](policy-csp-storage.md#storage-removablediskdenywriteaccess) +- [AllowStorageSenseGlobal](policy-csp-storage.md#storage-allowstoragesenseglobal) +- [ConfigStorageSenseGlobalCadence](policy-csp-storage.md#storage-configstoragesenseglobalcadence) +- [AllowStorageSenseTemporaryFilesCleanup](policy-csp-storage.md#storage-allowstoragesensetemporaryfilescleanup) +- [ConfigStorageSenseRecycleBinCleanupThreshold](policy-csp-storage.md#storage-configstoragesenserecyclebincleanupthreshold) +- [ConfigStorageSenseDownloadsCleanupThreshold](policy-csp-storage.md#storage-configstoragesensedownloadscleanupthreshold) +- [ConfigStorageSenseCloudContentDehydrationThreshold](policy-csp-storage.md#storage-configstoragesensecloudcontentdehydrationthreshold) + +## System + +- [AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [AllowBuildPreview](policy-csp-system.md#system-allowbuildpreview) +- [AllowFontProviders](policy-csp-system.md#system-allowfontproviders) +- [AllowLocation](policy-csp-system.md#system-allowlocation) +- [AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [TelemetryProxy](policy-csp-system.md#system-telemetryproxy) +- [DisableOneDriveFileSync](policy-csp-system.md#system-disableonedrivefilesync) +- [AllowWUfBCloudProcessing](policy-csp-system.md#system-allowwufbcloudprocessing) +- [AllowUpdateComplianceProcessing](policy-csp-system.md#system-allowupdatecomplianceprocessing) +- [AllowDesktopAnalyticsProcessing](policy-csp-system.md#system-allowdesktopanalyticsprocessing) +- [DisableEnterpriseAuthProxy](policy-csp-system.md#system-disableenterpriseauthproxy) +- [LimitEnhancedDiagnosticDataWindowsAnalytics](policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) +- [AllowDeviceNameInDiagnosticData](policy-csp-system.md#system-allowdevicenameindiagnosticdata) +- [ConfigureTelemetryOptInSettingsUx](policy-csp-system.md#system-configuretelemetryoptinsettingsux) +- [ConfigureTelemetryOptInChangeNotification](policy-csp-system.md#system-configuretelemetryoptinchangenotification) +- [DisableDeviceDelete](policy-csp-system.md#system-disabledevicedelete) +- [DisableDiagnosticDataViewer](policy-csp-system.md#system-disablediagnosticdataviewer) +- [ConfigureMicrosoft365UploadEndpoint](policy-csp-system.md#system-configuremicrosoft365uploadendpoint) +- [TurnOffFileHistory](policy-csp-system.md#system-turnofffilehistory) +- [DisableDirectXDatabaseUpdate](policy-csp-system.md#system-disabledirectxdatabaseupdate) +- [AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline) +- [LimitDiagnosticLogCollection](policy-csp-system.md#system-limitdiagnosticlogcollection) +- [LimitDumpCollection](policy-csp-system.md#system-limitdumpcollection) +- [EnableOneSettingsAuditing](policy-csp-system.md#system-enableonesettingsauditing) +- [DisableOneSettingsDownloads](policy-csp-system.md#system-disableonesettingsdownloads) +- [HideUnsupportedHardwareNotifications](policy-csp-system.md#system-hideunsupportedhardwarenotifications) + +## SystemServices + +- [ConfigureHomeGroupListenerServiceStartupMode](policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) +- [ConfigureHomeGroupProviderServiceStartupMode](policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) +- [ConfigureXboxAccessoryManagementServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) +- [ConfigureXboxLiveAuthManagerServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) +- [ConfigureXboxLiveGameSaveServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) +- [ConfigureXboxLiveNetworkingServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) + +## TextInput + +- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [AllowLinguisticDataCollection](policy-csp-textinput.md#textinput-allowlinguisticdatacollection) +- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#textinput-configuresimplifiedchineseimeversion) +- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#textinput-configuretraditionalchineseimeversion) +- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md#textinput-configurejapaneseimeversion) +- [ConfigureKoreanIMEVersion](policy-csp-textinput.md#textinput-configurekoreanimeversion) + +## TimeLanguageSettings + +- [RestrictLanguagePacksAndFeaturesInstall](policy-csp-timelanguagesettings.md#timelanguagesettings-restrictlanguagepacksandfeaturesinstall) +- [BlockCleanupOfUnusedPreinstalledLangPacks](policy-csp-timelanguagesettings.md#timelanguagesettings-blockcleanupofunusedpreinstalledlangpacks) +- [MachineUILanguageOverwrite](policy-csp-timelanguagesettings.md#timelanguagesettings-machineuilanguageoverwrite) +- [RestrictLanguagePacksAndFeaturesInstall](policy-csp-timelanguagesettings.md#timelanguagesettings-restrictlanguagepacksandfeaturesinstall) + +## Troubleshooting + +- [AllowRecommendations](policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) + +## Update + +- [ActiveHoursEnd](policy-csp-update.md#update-activehoursend) +- [ActiveHoursStart](policy-csp-update.md#update-activehoursstart) +- [ActiveHoursMaxRange](policy-csp-update.md#update-activehoursmaxrange) +- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md#update-autorestartrequirednotificationdismissal) +- [AutoRestartNotificationSchedule](policy-csp-update.md#update-autorestartnotificationschedule) +- [SetAutoRestartNotificationDisable](policy-csp-update.md#update-setautorestartnotificationdisable) +- [ScheduleRestartWarning](policy-csp-update.md#update-schedulerestartwarning) +- [ScheduleImminentRestartWarning](policy-csp-update.md#update-scheduleimminentrestartwarning) +- [AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md#update-autorestartdeadlineperiodindays) +- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) +- [EngagedRestartTransitionSchedule](policy-csp-update.md#update-engagedrestarttransitionschedule) +- [EngagedRestartSnoozeSchedule](policy-csp-update.md#update-engagedrestartsnoozeschedule) +- [EngagedRestartDeadline](policy-csp-update.md#update-engagedrestartdeadline) +- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) +- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) +- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) +- [DetectionFrequency](policy-csp-update.md#update-detectionfrequency) +- [ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) +- [BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) +- [ProductVersion](policy-csp-update.md#update-productversion) +- [TargetReleaseVersion](policy-csp-update.md#update-targetreleaseversion) +- [AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [DeferUpdatePeriod](policy-csp-update.md#update-deferupdateperiod) +- [DeferUpgradePeriod](policy-csp-update.md#update-deferupgradeperiod) +- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#update-excludewudriversinqualityupdate) +- [PauseDeferrals](policy-csp-update.md#update-pausedeferrals) +- [PauseFeatureUpdates](policy-csp-update.md#update-pausefeatureupdates) +- [PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) +- [PauseFeatureUpdatesStartTime](policy-csp-update.md#update-pausefeatureupdatesstarttime) +- [PauseQualityUpdatesStartTime](policy-csp-update.md#update-pausequalityupdatesstarttime) +- [RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [AllowMUUpdateService](policy-csp-update.md#update-allowmuupdateservice) +- [ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [ScheduledInstallEveryWeek](policy-csp-update.md#update-scheduledinstalleveryweek) +- [ScheduledInstallFirstWeek](policy-csp-update.md#update-scheduledinstallfirstweek) +- [ScheduledInstallSecondWeek](policy-csp-update.md#update-scheduledinstallsecondweek) +- [ScheduledInstallThirdWeek](policy-csp-update.md#update-scheduledinstallthirdweek) +- [ScheduledInstallFourthWeek](policy-csp-update.md#update-scheduledinstallfourthweek) +- [UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [UpdateServiceUrlAlternate](policy-csp-update.md#update-updateserviceurlalternate) +- [FillEmptyContentUrls](policy-csp-update.md#update-fillemptycontenturls) +- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#update-setproxybehaviorforupdatedetection) +- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#update-donotenforceenterprisetlscertpinningforupdatedetection) +- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourceforfeatureupdates) +- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourceforqualityupdates) +- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourcefordriverupdates) +- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourceforotherupdates) +- [SetEDURestart](policy-csp-update.md#update-setedurestart) +- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) +- [SetDisableUXWUAccess](policy-csp-update.md#update-setdisableuxwuaccess) +- [SetDisablePauseUXAccess](policy-csp-update.md#update-setdisablepauseuxaccess) +- [UpdateNotificationLevel](policy-csp-update.md#update-updatenotificationlevel) +- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md#update-noupdatenotificationsduringactivehours) +- [DisableDualScan](policy-csp-update.md#update-disabledualscan) +- [AutomaticMaintenanceWakeUp](policy-csp-update.md#update-automaticmaintenancewakeup) +- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md#update-configuredeadlinegraceperiodforfeatureupdates) +- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#update-configuredeadlinenoautorebootforfeatureupdates) +- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#update-configuredeadlinenoautorebootforqualityupdates) + +## UserRights + +- [AccessCredentialManagerAsTrustedCaller](policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) +- [AccessFromNetwork](policy-csp-userrights.md#userrights-accessfromnetwork) +- [ActAsPartOfTheOperatingSystem](policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) +- [AllowLocalLogOn](policy-csp-userrights.md#userrights-allowlocallogon) +- [BackupFilesAndDirectories](policy-csp-userrights.md#userrights-backupfilesanddirectories) +- [ChangeSystemTime](policy-csp-userrights.md#userrights-changesystemtime) +- [CreatePageFile](policy-csp-userrights.md#userrights-createpagefile) +- [CreateToken](policy-csp-userrights.md#userrights-createtoken) +- [CreateGlobalObjects](policy-csp-userrights.md#userrights-createglobalobjects) +- [CreatePermanentSharedObjects](policy-csp-userrights.md#userrights-createpermanentsharedobjects) +- [CreateSymbolicLinks](policy-csp-userrights.md#userrights-createsymboliclinks) +- [DebugPrograms](policy-csp-userrights.md#userrights-debugprograms) +- [DenyAccessFromNetwork](policy-csp-userrights.md#userrights-denyaccessfromnetwork) +- [DenyLocalLogOn](policy-csp-userrights.md#userrights-denylocallogon) +- [DenyRemoteDesktopServicesLogOn](policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) +- [EnableDelegation](policy-csp-userrights.md#userrights-enabledelegation) +- [RemoteShutdown](policy-csp-userrights.md#userrights-remoteshutdown) +- [GenerateSecurityAudits](policy-csp-userrights.md#userrights-generatesecurityaudits) +- [ImpersonateClient](policy-csp-userrights.md#userrights-impersonateclient) +- [IncreaseSchedulingPriority](policy-csp-userrights.md#userrights-increaseschedulingpriority) +- [LoadUnloadDeviceDrivers](policy-csp-userrights.md#userrights-loadunloaddevicedrivers) +- [LockMemory](policy-csp-userrights.md#userrights-lockmemory) +- [ManageAuditingAndSecurityLog](policy-csp-userrights.md#userrights-manageauditingandsecuritylog) +- [ModifyObjectLabel](policy-csp-userrights.md#userrights-modifyobjectlabel) +- [ModifyFirmwareEnvironment](policy-csp-userrights.md#userrights-modifyfirmwareenvironment) +- [ManageVolume](policy-csp-userrights.md#userrights-managevolume) +- [ProfileSingleProcess](policy-csp-userrights.md#userrights-profilesingleprocess) +- [RestoreFilesAndDirectories](policy-csp-userrights.md#userrights-restorefilesanddirectories) +- [TakeOwnership](policy-csp-userrights.md#userrights-takeownership) +- [BypassTraverseChecking](policy-csp-userrights.md#userrights-bypasstraversechecking) +- [ReplaceProcessLevelToken](policy-csp-userrights.md#userrights-replaceprocessleveltoken) +- [ChangeTimeZone](policy-csp-userrights.md#userrights-changetimezone) +- [ShutDownTheSystem](policy-csp-userrights.md#userrights-shutdownthesystem) +- [LogOnAsBatchJob](policy-csp-userrights.md#userrights-logonasbatchjob) +- [ProfileSystemPerformance](policy-csp-userrights.md#userrights-profilesystemperformance) +- [DenyLogOnAsBatchJob](policy-csp-userrights.md#userrights-denylogonasbatchjob) +- [LogOnAsService](policy-csp-userrights.md#userrights-logonasservice) +- [IncreaseProcessWorkingSet](policy-csp-userrights.md#userrights-increaseprocessworkingset) + +## VirtualizationBasedTechnology + +- [HypervisorEnforcedCodeIntegrity](policy-csp-virtualizationbasedtechnology.md#virtualizationbasedtechnology-hypervisorenforcedcodeintegrity) +- [RequireUEFIMemoryAttributesTable](policy-csp-virtualizationbasedtechnology.md#virtualizationbasedtechnology-requireuefimemoryattributestable) + +## WebThreatDefense + +- [ServiceEnabled](policy-csp-webthreatdefense.md#webthreatdefense-serviceenabled) +- [NotifyMalicious](policy-csp-webthreatdefense.md#webthreatdefense-notifymalicious) +- [NotifyPasswordReuse](policy-csp-webthreatdefense.md#webthreatdefense-notifypasswordreuse) +- [NotifyUnsafeApp](policy-csp-webthreatdefense.md#webthreatdefense-notifyunsafeapp) + +## Wifi + +- [AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) + +## WindowsDefenderSecurityCenter + +- [CompanyName](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) +- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) +- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) +- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) +- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) +- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) +- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) +- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) +- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) +- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) +- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) +- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) +- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) +- [Email](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) +- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) +- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) +- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) +- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) +- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) +- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) +- [Phone](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) +- [URL](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) + +## WindowsInkWorkspace + +- [AllowWindowsInkWorkspace](policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) +- [AllowSuggestedAppsInWindowsInkWorkspace](policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) + +## WindowsLogon + +- [HideFastUserSwitching](policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) +- [EnableFirstLogonAnimation](policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) + +## WindowsSandbox + +- [AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu) +- [AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking) +- [AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput) +- [AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) +- [AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection) +- [AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection) + +## WirelessDisplay + +- [AllowProjectionToPC](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [RequirePinForPairing](policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index c23b7be9a8..9b84b9e141 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,2439 +1,2795 @@ --- -title: Policy CSP - Defender -description: Learn how to use the Policy CSP - Defender setting so you can allow or disallow scanning of archives. -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage +title: Defender Policy CSP +description: Learn more about the Defender CSP Policy author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 05/12/2022 -ms.reviewer: manager: aaroncz -ms.collection: highpri +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article --- + + + # Policy CSP - Defender + + + + + +## AllowArchiveScanning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowArchiveScanning +``` + + + +This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. + +If you enable or do not configure this setting, archive files will be scanned. + +If you disable this setting, archive files will not be scanned. However, archives are always scanned during directed scans. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. Turns off scanning on archived files. | +| 1 (Default) | Allowed. Scans the archive files. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_DisableArchiveScanning | +| Friendly Name | Scan archive files | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableArchiveScanning | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowBehaviorMonitoring + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + - -
- - -## Defender policies - -
-
- Defender/AllowArchiveScanning -
-
- Defender/AllowBehaviorMonitoring -
-
- Defender/AllowCloudProtection -
-
- Defender/AllowEmailScanning -
-
- Defender/AllowFullScanOnMappedNetworkDrives -
-
- Defender/AllowFullScanRemovableDriveScanning -
-
- Defender/AllowIOAVProtection -
-
- Defender/AllowOnAccessProtection -
-
- Defender/AllowRealtimeMonitoring -
-
- Defender/AllowScanningNetworkFiles -
-
- Defender/AllowScriptScanning -
-
- Defender/AllowUserUIAccess -
-
- Defender/AttackSurfaceReductionOnlyExclusions -
-
- Defender/AttackSurfaceReductionRules -
-
- Defender/AvgCPULoadFactor -
-
- Defender/CheckForSignaturesBeforeRunningScan -
-
- Defender/CloudBlockLevel -
-
- Defender/CloudExtendedTimeout -
-
- Defender/ControlledFolderAccessAllowedApplications -
-
- Defender/ControlledFolderAccessProtectedFolders -
-
- Defender/DaysToRetainCleanedMalware -
-
- Defender/DisableCatchupFullScan -
-
- Defender/DisableCatchupQuickScan -
-
- Defender/EnableControlledFolderAccess -
-
- Defender/EnableLowCPUPriority -
-
- Defender/EnableNetworkProtection -
-
- Defender/ExcludedExtensions -
-
- Defender/ExcludedPaths -
-
- Defender/ExcludedProcesses -
-
- Defender/PUAProtection -
-
- Defender/RealTimeScanDirection -
-
- Defender/ScanParameter -
-
- Defender/ScheduleQuickScanTime -
-
- Defender/ScheduleScanDay -
-
- Defender/ScheduleScanTime -
-
- Defender/SecurityIntelligenceLocation -
-
- Defender/SignatureUpdateFallbackOrder -
-
- Defender/SignatureUpdateFileSharesSources -
-
- Defender/SignatureUpdateInterval -
-
- Defender/SubmitSamplesConsent -
-
- Defender/ThreatSeverityDefaultAction -
-
- - -
- - -**Defender/AllowArchiveScanning** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - - -Allows or disallows scanning of archives. - - - -ADMX Info: -- GP Friendly name: *Scan archive files* -- GP name: *Scan_DisableArchiveScanning* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Turns off scanning on archived files. -- 1 (default) – Allowed. Scans the archive files. - - - - -
- - -**Defender/AllowBehaviorMonitoring** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - - -Allows or disallows Windows Defender Behavior Monitoring functionality. - - - -ADMX Info: -- GP Friendly name: *Turn on behavior monitoring* -- GP name: *RealtimeProtection_DisableBehaviorMonitoring* -- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Turns off behavior monitoring. -- 1 (default) – Allowed. Turns on real-time behavior monitoring. - - - - -
- - -**Defender/AllowCloudProtection** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. - - - -ADMX Info: -- GP Friendly name: *Join Microsoft MAPS* -- GP name: *SpynetReporting* -- GP element: *SpynetReporting* -- GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Turns off the Microsoft Active Protection Service. -- 1 (default) – Allowed. Turns on the Microsoft Active Protection Service. - - - - -
- - -**Defender/AllowEmailScanning** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows scanning of email. - - - -ADMX Info: -- GP Friendly name: *Turn on e-mail scanning* -- GP name: *Scan_DisableEmailScanning* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) – Not allowed. Turns off email scanning. -- 1 – Allowed. Turns on email scanning. - - - - -
- - -**Defender/AllowFullScanOnMappedNetworkDrives** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows a full scan of mapped network drives. - - - -ADMX Info: -- GP Friendly name: *Run full scan on mapped network drives* -- GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) – Not allowed. Disables scanning on mapped network drives. -- 1 – Allowed. Scans mapped network drives. - - - - -
- - -**Defender/AllowFullScanRemovableDriveScanning** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. - - - -ADMX Info: -- GP Friendly name: *Scan removable drives* -- GP name: *Scan_DisableRemovableDriveScanning* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Turns off scanning on removable drives. -- 1 (default) – Allowed. Scans removable drives. - - - - -
- - -**Defender/AllowIOAVProtection** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows Windows Defender IOAVP Protection functionality. - - - -ADMX Info: -- GP Friendly name: *Scan all downloaded files and attachments* -- GP name: *RealtimeProtection_DisableIOAVProtection* -- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
- - -**Defender/AllowOnAccessProtection** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows Windows Defender On Access Protection functionality. - - - -ADMX Info: -- GP Friendly name: *Monitor file and program activity on your computer* -- GP name: *RealtimeProtection_DisableOnAccessProtection* -- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -> [!IMPORTANT] -> AllowOnAccessProtection is officially being deprecated. - -
- - -**Defender/AllowRealtimeMonitoring** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows Windows Defender real-time Monitoring functionality. - - - -ADMX Info: -- GP Friendly name: *Turn off real-time protection* -- GP name: *DisableRealtimeMonitoring* -- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Turns off the real-time monitoring service. -- 1 (default) – Allowed. Turns on and runs the real-time monitoring service. - - - - -
- - -**Defender/AllowScanningNetworkFiles** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows a scanning of network files. - - - -ADMX Info: -- GP Friendly name: *Scan network files* -- GP name: *Scan_DisableScanningNetworkFiles* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Turns off scanning of network files. -- 1 (default) – Allowed. Scans network files. - - - - -
- - -**Defender/AllowScriptScanning** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowBehaviorMonitoring +``` + + + +This policy setting allows you to configure behavior monitoring. + +If you enable or do not configure this setting, behavior monitoring will be enabled. + +If you disable this setting, behavior monitoring will be disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. Turns off behavior monitoring. | +| 1 (Default) | Allowed. Turns on real-time behavior monitoring. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | RealtimeProtection_DisableBehaviorMonitoring | +| Friendly Name | Turn on behavior monitoring | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | +| Registry Value Name | DisableBehaviorMonitoring | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowCloudProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowCloudProtection +``` + + + +This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. + +You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new security intelligence and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. + +Possible options are: +(0x0) Disabled (default) +(0x1) Basic membership +(0x2) Advanced membership + +Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. + +Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer. + +If you enable this setting, you will join Microsoft MAPS with the membership specified. + +If you disable or do not configure this setting, you will not join Microsoft MAPS. + +In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. Turns off the Microsoft Active Protection Service. | +| 1 (Default) | Allowed. Turns on the Microsoft Active Protection Service. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SpynetReporting | +| Friendly Name | Join Microsoft MAPS | +| Element Name | Join Microsoft MAPS | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > MAPS | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet | +| Registry Value Name | SpynetReporting | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowEmailScanning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowEmailScanning +``` + + + +This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). Email scanning is not supported on modern email clients. + +If you enable this setting, e-mail scanning will be enabled. + +If you disable or do not configure this setting, e-mail scanning will be disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed. Turns off email scanning. | +| 1 | Allowed. Turns on email scanning. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_DisableEmailScanning | +| Friendly Name | Turn on e-mail scanning | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableEmailScanning | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowFullScanOnMappedNetworkDrives + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowFullScanOnMappedNetworkDrives +``` + + + +This policy setting allows you to configure scanning mapped network drives. + +If you enable this setting, mapped network drives will be scanned. + +If you disable or do not configure this setting, mapped network drives will not be scanned. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed. Disables scanning on mapped network drives. | +| 1 | Allowed. Scans mapped network drives. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_DisableScanningMappedNetworkDrivesForFullScan | +| Friendly Name | Run full scan on mapped network drives | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableScanningMappedNetworkDrivesForFullScan | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowFullScanRemovableDriveScanning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowFullScanRemovableDriveScanning +``` + + + +This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan. + +If you enable this setting, removable drives will be scanned during any type of scan. + +If you disable or do not configure this setting, removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. Turns off scanning on removable drives. | +| 1 (Default) | Allowed. Scans removable drives. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_DisableRemovableDriveScanning | +| Friendly Name | Scan removable drives | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableRemovableDriveScanning | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowIntrusionPreventionSystem + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowIntrusionPreventionSystem +``` + + + +Allows or disallows Windows Defender Intrusion Prevention functionality. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + + + + + + + + +## AllowIOAVProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowIOAVProtection +``` + + + +This policy setting allows you to configure scanning for all downloaded files and attachments. + +If you enable or do not configure this setting, scanning for all downloaded files and attachments will be enabled. + +If you disable this setting, scanning for all downloaded files and attachments will be disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | RealtimeProtection_DisableIOAVProtection | +| Friendly Name | Scan all downloaded files and attachments | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | +| Registry Value Name | DisableIOAVProtection | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowOnAccessProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowOnAccessProtection +``` + + + +This policy setting allows you to configure monitoring for file and program activity. + +If you enable or do not configure this setting, monitoring for file and program activity will be enabled. + +If you disable this setting, monitoring for file and program activity will be disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | RealtimeProtection_DisableOnAccessProtection | +| Friendly Name | Monitor file and program activity on your computer | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | +| Registry Value Name | DisableOnAccessProtection | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowRealtimeMonitoring + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowRealtimeMonitoring +``` + + + +This policy turns off real-time protection in Microsoft Defender Antivirus. + +Real-time protection consists of always-on scanning with file and process behavior monitoring and heuristics. When real-time protection is on, Microsoft Defender Antivirus detects malware and potentially unwanted software that attempts to install itself or run on your device, and prompts you to take action on malware detections. + +If you enable this policy setting, real-time protection is turned off. + +If you either disable or do not configure this policy setting, real-time protection is turned on. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. Turns off the real-time monitoring service. | +| 1 (Default) | Allowed. Turns on and runs the real-time monitoring service. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableRealtimeMonitoring | +| Friendly Name | Turn off real-time protection | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | +| Registry Value Name | DisableRealtimeMonitoring | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowScanningNetworkFiles + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowScanningNetworkFiles +``` + + + +This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. + +If you enable this setting, network files will be scanned. + +If you disable or do not configure this setting, network files will not be scanned. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not allowed. Turns off scanning of network files. | +| 1 | Allowed. Scans network files. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_DisableScanningNetworkFiles | +| Friendly Name | Scan network files | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableScanningNetworkFiles | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AllowScriptScanning + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowScriptScanning +``` + + + Allows or disallows Windows Defender Script Scanning functionality. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
- - -**Defender/AllowUserUIAccess** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows or disallows user access to the Windows Defender UI. I disallowed, all Windows Defender notifications will also be suppressed. - - - -ADMX Info: -- GP Friendly name: *Enable headless UI mode* -- GP name: *UX_Configuration_UILockdown* -- GP path: *Windows Components/Microsoft Defender Antivirus/Client Interface* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. Prevents users from accessing UI. -- 1 (default) – Allowed. Lets users access UI. - - - - -
- - -**Defender/AttackSurfaceReductionOnlyExclusions** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -This policy setting allows you to prevent Attack Surface reduction rules from matching on files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". - -Value type is string. - - - -ADMX Info: -- GP Friendly name: *Exclude files and paths from Attack Surface Reduction Rules* -- GP name: *ExploitGuard_ASR_ASROnlyExclusions* -- GP element: *ExploitGuard_ASR_ASROnlyExclusions* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/AttackSurfaceReductionRules** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -This policy setting enables setting the state (Block/Audit/Off) for each attack surface reduction (ASR) rule. Each ASR rule listed can be set to one of the following states (Block/Audit/Off). The ASR rule ID and state should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid ASR rule ID, while the value contains the status ID indicating the status of the rule. - -For more information about ASR rule ID and status ID, see [Enable Attack Surface Reduction](/windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction). - -Value type is string. - - - -ADMX Info: -- GP Friendly name: *Configure Attack Surface Reduction rules* -- GP name: *ExploitGuard_ASR_Rules* -- GP element: *ExploitGuard_ASR_Rules* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/AvgCPULoadFactor** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Represents the average CPU load factor for the Windows Defender scan (in percent). - -The default value is 50. - - - -ADMX Info: -- GP Friendly name: *Specify the maximum percentage of CPU utilization during a scan* -- GP name: *Scan_AvgCPULoadFactor* -- GP element: *Scan_AvgCPULoadFactor* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -Valid values: 0–100 - - - - -
- - -**Defender/CheckForSignaturesBeforeRunningScan** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. - -This setting applies to scheduled scans and the command line "mpcmdrun -SigUpdate", but it has no effect on scans initiated manually from the user interface. - -If you enable this setting, a check for new definitions will occur before running a scan. - -If you disable this setting or don't configure this setting, the scan will start using the existing definitions. - -Supported values: - -- 0 (default) - Disabled -- 1 - Enabled - -OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/CheckForSignaturesBeforeRunningScan - - - -ADMX Info: -- GP Friendly name: *Check for the latest virus and spyware definitions before running a scheduled scan* -- GP name: *CheckForSignaturesBeforeRunningScan* -- GP element: *CheckForSignaturesBeforeRunningScan* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - - - - - - - - - - - -
- - -**Defender/CloudBlockLevel** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -This policy setting determines how aggressive Microsoft Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. - -If this setting is on, Microsoft Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. - -For more information about specific values that are supported, see the Microsoft Defender Antivirus documentation site. - -> [!NOTE] -> This feature requires the "Join Microsoft MAPS" setting enabled in order to function. - - - -ADMX Info: -- GP Friendly name: *Select cloud protection level* -- GP name: *MpEngine_MpCloudBlockLevel* -- GP element: *MpCloudBlockLevel* -- GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0x0 - Default windows defender blocking level -- 0x2 - High blocking level - aggressively block unknowns while optimizing client performance (greater chance of false positives)       -- 0x4 - High+ blocking level – aggressively block unknowns and apply more protection measures (may impact  client performance) -- 0x6 - Zero tolerance blocking level – block all unknown executables - - - - -
- - -**Defender/CloudExtendedTimeout** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -This feature allows Microsoft Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. - -The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an extra 50 seconds. - -For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. - -> [!NOTE] -> This feature depends on three other MAPS settings the must all be enabled- "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required". - - - -ADMX Info: -- GP Friendly name: *Configure extended cloud check* -- GP name: *MpEngine_MpBafsExtendedTimeout* -- GP element: *MpBafsExtendedTimeout* -- GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/ControlledFolderAccessAllowedApplications** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersAllowedApplications and changed to ControlledFolderAccessAllowedApplications. - -Added in Windows 10, version 1709. This policy setting allows user-specified applications to the controlled folder access feature. Adding an allowed application means the controlled folder access feature will allow the application to modify or delete content in certain folders such as My Documents. In most cases it won't be necessary to add entries. Microsoft Defender Antivirus will automatically detect and dynamically add applications that are friendly. Value type is string. Use the | as the substring separator. - - - -ADMX Info: -- GP Friendly name: *Configure allowed applications* -- GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* -- GP element: *ExploitGuard_ControlledFolderAccess_AllowedApplications* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/ControlledFolderAccessProtectedFolders** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. The previous name was GuardedFoldersList and changed to ControlledFolderAccessProtectedFolders. - -This policy setting allows adding user-specified folder locations to the controlled folder access feature. These folders will complement the system defined folders such as My Documents and My Pictures. The list of system folders will be displayed in the user interface and can't be changed. Value type is string. Use the | as the substring separator. - - - -ADMX Info: -- GP Friendly name: *Configure protected folders* -- GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* -- GP element: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/DaysToRetainCleanedMalware** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Time period (in days) that quarantine items will be stored on the system. - -The default value is 0, which keeps items in quarantine, and doesn't automatically remove them. - - - -ADMX Info: -- GP Friendly name: *Configure removal of items from Quarantine folder* -- GP name: *Quarantine_PurgeItemsAfterDelay* -- GP element: *Quarantine_PurgeItemsAfterDelay* -- GP path: *Windows Components/Microsoft Defender Antivirus/Quarantine* -- GP ADMX file name: *WindowsDefender.admx* - - - -Valid values: 0–90 - - - - -
- - -**Defender/DisableCatchupFullScan** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. | +| 1 (Default) | Allowed. | + + + + + + + + + +## AllowUserUIAccess + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AllowUserUIAccess +``` + + + +This policy setting allows you to configure whether or not to display AM UI to the users. +If you enable this setting AM UI won't be available to users. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not allowed. Prevents users from accessing UI. | +| 1 (Default) | Allowed. Lets users access UI. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | UX_Configuration_UILockdown | +| Friendly Name | Enable headless UI mode | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Client Interface | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\UX Configuration | +| Registry Value Name | UILockdown | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AttackSurfaceReductionOnlyExclusions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions +``` + + + +Exclude files and paths from Attack Surface Reduction (ASR) rules. + +Enabled: +Specify the folders or files and resources that should be excluded from ASR rules in the Options section. +Enter each rule on a new line as a name-value pair: +- Name column: Enter a folder path or a fully qualified resource name. For example, ""C:\Windows"" will exclude all files in that directory. ""C:\Windows\App.exe"" will exclude only that specific file in that specific folder +- Value column: Enter ""0"" for each item + +Disabled: +No exclusions will be applied to the ASR rules. + +Not configured: +Same as Disabled. + +You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExploitGuard_ASR_ASROnlyExclusions | +| Friendly Name | Exclude files and paths from Attack Surface Reduction Rules | +| Element Name | Exclusions from ASR rules | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR | +| Registry Value Name | ExploitGuard_ASR_ASROnlyExclusions | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AttackSurfaceReductionRules + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules +``` + + + +Set the state for each Attack Surface Reduction (ASR) rule. + +After enabling this setting, you can set each rule to the following in the Options section: +- Block: the rule will be applied +- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) +- Off: the rule will not be applied +- Not Configured: the rule is enabled with default values +- Warn: the rule will be applied and the end-user will have the option to bypass the block + +Unless the ASR rule is disabled, a subsample of audit events are collected for ASR rules will the value of not configured. + +Enabled: +Specify the state for each ASR rule under the Options section for this setting. +Enter each rule on a new line as a name-value pair: +- Name column: Enter a valid ASR rule ID +- Value column: Enter the status ID that relates to state you want to specify for the associated rule + +The following status IDs are permitted under the value column: +- 1 (Block) +- 0 (Off) +- 2 (Audit) +- 5 (Not Configured) +- 6 (Warn) + + +Example: +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2 + +Disabled: +No ASR rules will be configured. + +Not configured: +Same as Disabled. + +You can exclude folders or files in the ""Exclude files and paths from Attack Surface Reduction Rules"" GP setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExploitGuard_ASR_Rules | +| Friendly Name | Configure Attack Surface Reduction rules | +| Element Name | Set the state for each ASR rule | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR | +| Registry Value Name | ExploitGuard_ASR_Rules | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## AvgCPULoadFactor + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/AvgCPULoadFactor +``` + + + +This policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization. The default value is 50. + +If you enable this setting, CPU utilization will not exceed the percentage specified. + +If you disable or do not configure this setting, CPU utilization will not exceed the default value. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-100]` | +| Default Value | 50 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_AvgCPULoadFactor | +| Friendly Name | Specify the maximum percentage of CPU utilization during a scan | +| Element Name | Specify the maximum percentage of CPU utilization during a scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | AvgCPULoadFactor | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## CheckForSignaturesBeforeRunningScan + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/CheckForSignaturesBeforeRunningScan +``` + + + +This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur before running a scan. + +This setting applies to scheduled scans, but it has no effect on scans initiated manually from the user interface or to the ones started from the command line using "mpcmdrun -Scan". + +If you enable this setting, a check for new security intelligence will occur before running a scan. + +If you disable this setting or do not configure this setting, the scan will start using the existing security intelligence. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled | +| 1 | Enabled | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | CheckForSignaturesBeforeRunningScan | +| Friendly Name | Check for the latest virus and spyware security intelligence before running a scheduled scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | CheckForSignaturesBeforeRunningScan | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## CloudBlockLevel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/CloudBlockLevel +``` + + + +This policy setting determines how aggressive Windows Defender Antivirus will be in blocking and scanning suspicious files. Value type is integer. If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see the Windows Defender Antivirus documentation site. NoteThis feature requires the Join Microsoft MAPS setting enabled in order to function. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | NotConfigured | +| 2 | High | +| 4 | HighPlus | +| 6 | ZeroTolerance | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | MpCloudBlockLevel | +| Friendly Name | Select cloud protection level | +| Element Name | Select cloud blocking level | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > MpEngine | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine | +| Registry Value Name | MpCloudBlockLevel | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## CloudExtendedTimeout + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/CloudExtendedTimeout +``` + + + +This feature allows Windows Defender Antivirus to block a suspicious file for up to 60 seconds, and scan it in the cloud to make sure it's safe. Value type is integer, range is 0 - 50. The typical cloud check timeout is 10 seconds. To enable the extended cloud check feature, specify the extended time in seconds, up to an additional 50 seconds. For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. NoteThis feature depends on three other MAPS settings the must all be enabled- Configure the 'Block at First Sight' feature; Join Microsoft MAPS; Send file samples when further analysis is required. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-50]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | MpBafsExtendedTimeout | +| Friendly Name | Configure extended cloud check | +| Element Name | Specify the extended cloud check time in seconds | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > MpEngine | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\MpEngine | +| Registry Value Name | MpBafsExtendedTimeout | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ControlledFolderAccessAllowedApplications + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ControlledFolderAccessAllowedApplications +``` + + + +Add additional applications that should be considered "trusted" by controlled folder access. + +These applications are allowed to modify or delete files in controlled folder access folders. + +Microsoft Defender Antivirus automatically determines which applications should be trusted. You can configure this setting to add additional applications. + +Enabled: +Specify additional allowed applications in the Options section.. + +Disabled: +No additional applications will be added to the trusted list. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Default system folders are automatically guarded, but you can add folders in the configure protected folders GP setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExploitGuard_ControlledFolderAccess_AllowedApplications | +| Friendly Name | Configure allowed applications | +| Element Name | Enter the applications that should be trusted | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | +| Registry Value Name | ExploitGuard_ControlledFolderAccess_AllowedApplications | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ControlledFolderAccessProtectedFolders + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ControlledFolderAccessProtectedFolders +``` + + + +Specify additional folders that should be guarded by the Controlled folder access feature. + +Files in these folders cannot be modified or deleted by untrusted applications. + +Default system folders are automatically protected. You can configure this setting to add additional folders. +The list of default system folders that are protected is shown in Windows Security. + +Enabled: +Specify additional folders that should be protected in the Options section. + +Disabled: +No additional folders will be protected. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExploitGuard_ControlledFolderAccess_ProtectedFolders | +| Friendly Name | Configure protected folders | +| Element Name | Enter the folders that should be guarded | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | +| Registry Value Name | ExploitGuard_ControlledFolderAccess_ProtectedFolders | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## DaysToRetainCleanedMalware + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/DaysToRetainCleanedMalware +``` + + + +This policy setting defines the number of days items should be kept in the Quarantine folder before being removed. + +If you enable this setting, items will be removed from the Quarantine folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the quarantine folder indefinitely and will not be automatically removed. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-90]` | +| Default Value | 0 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Quarantine_PurgeItemsAfterDelay | +| Friendly Name | Configure removal of items from Quarantine folder | +| Element Name | Configure removal of items from Quarantine folder | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Quarantine | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Quarantine | +| Registry Value Name | PurgeItemsAfterDelay | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## DisableCatchupFullScan + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan +``` + + + This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. -If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone signs in to the computer. If there's no scheduled scan configured, there will be no catch-up scan run. +If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. -If you disable or don't configure this setting, catch-up scans for scheduled full scans will be turned off. +If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned off. + -Supported values: + + + -- 1 - Disabled (default) -- 0 - Enabled + +**Description framework properties**: -OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + - - -ADMX Info: -- GP Friendly name: *Turn on catch-up full scan* -- GP name: *Scan_DisableCatchupFullScan* -- GP element: *Scan_DisableCatchupFullScan* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* + +**Allowed values**: - - +| Value | Description | +|:--|:--| +| 0 | Enabled | +| 1 (Default) | Disabled | + - - + +**Group policy mapping**: - - +| Name | Value | +|:--|:--| +| Name | Scan_DisableCatchupFullScan | +| Friendly Name | Turn on catch-up full scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableCatchupFullScan | +| ADMX File Name | WindowsDefender.admx | + - - + + + -
+ - -**Defender/DisableCatchupQuickScan** + +## DisableCatchupQuickScan - + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan +``` + + + +This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. + +If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. + +If you disable or do not configure this setting, catch-up scans for scheduled quick scans will be turned off. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Enabled | +| 1 (Default) | Disabled | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_DisableCatchupQuickScan | +| Friendly Name | Turn on catch-up quick scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | DisableCatchupQuickScan | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## EnableControlledFolderAccess + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/EnableControlledFolderAccess +``` + + + +Enable or disable controlled folder access for untrusted applications. You can choose to block, audit, or allow attempts by untrusted apps to: +- Modify or delete files in protected folders, such as the Documents folder +- Write to disk sectors + +You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders. + +Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. +Default system folders are automatically protected, but you can add folders in the Configure protected folders GP setting. + +Block: +The following will be blocked: +- Attempts by untrusted apps to modify or delete files in protected folders +- Attempts by untrusted apps to write to disk sectors +The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. - -If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone signs in to the computer. If there's no scheduled scan configured, there will be no catch-up scan run. - -If you disable or don't configure this setting, catch-up scans for scheduled quick scans will be turned off. - -Supported values: - -- 1 - Disabled (default) -- 0 - Enabled - -OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan - - - -ADMX Info: -- GP Friendly name: *Turn on catch-up quick scan* -- GP name: *Scan_DisableCatchupQuickScan* -- GP element: *Scan_DisableCatchupQuickScan* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - - - - - - - - - - - -
- - -**Defender/EnableControlledFolderAccess** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +Disabled: +The following will not be blocked and will be allowed to run: +- Attempts by untrusted apps to modify or delete files in protected folders +- Attempts by untrusted apps to write to disk sectors +These attempts will not be recorded in the Windows event log. - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. The previous name was EnableGuardMyFolders and changed to EnableControlledFolderAccess. - -This policy enables setting the state (On/Off/Audit) for the controlled folder access feature. The controlled folder access feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2. - - - -ADMX Info: -- GP Friendly name: *Configure Controlled folder access* -- GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* -- GP element: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) - Disabled -- 1 - Enabled -- 2 - Audit Mode - - - - -
- - -**Defender/EnableLowCPUPriority** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +Audit Mode: +The following will not be blocked and will be allowed to run: +- Attempts by untrusted apps to modify or delete files in protected folders +- Attempts by untrusted apps to write to disk sectors +The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124. - -
+Block disk modification only: +The following will be blocked: +- Attempts by untrusted apps to write to disk sectors +The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. - -[Scope](./policy-configuration-service-provider.md#policy-scope): +The following will not be blocked and will be allowed to run: +- Attempts by untrusted apps to modify or delete files in protected folders +These attempts will not be recorded in the Windows event log. -> [!div class = "checklist"] -> * Device -
+Audit disk modification only: +The following will not be blocked and will be allowed to run: +- Attempts by untrusted apps to write to disk sectors +- Attempts by untrusted apps to modify or delete files in protected folders +Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124). +Attempts to modify or delete files in protected folders will not be recorded. - - +Not configured: +Same as Disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled | +| 1 | Enabled | +| 2 | Audit Mode | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess | +| Friendly Name | Configure Controlled folder access | +| Element Name | Configure the guard my folders feature | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access | +| Registry Value Name | EnableControlledFolderAccess | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## EnableLowCPUPriority + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/EnableLowCPUPriority +``` + + + This policy setting allows you to enable or disable low CPU priority for scheduled scans. If you enable this setting, low CPU priority will be used during scheduled scans. -If you disable or don't configure this setting, no changes will be made to CPU priority for scheduled scans. - -Supported values: - -- 0 - Disabled (default) -- 1 - Enabled - - - -ADMX Info: -- GP Friendly name: *Configure low CPU priority for scheduled scans* -- GP name: *Scan_LowCpuPriority* -- GP element: *Scan_LowCpuPriority* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - - - - - - - - - - - -
- - -**Defender/EnableNetworkProtection** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -This policy allows you to turn on network protection (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This protection includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. - -If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. -If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You'll be able to see this activity in Windows Defender Security Center. -If you enable this policy with the ""Audit"" option, users/apps won't be blocked from connecting to dangerous domains. However, you'll still see this activity in Windows Defender Security Center. -If you disable this policy, users/apps won't be blocked from connecting to dangerous domains. You'll not see any network activity in Windows Defender Security Center. -If you don't configure this policy, network blocking will be disabled by default. - - - -ADMX Info: -- GP Friendly name: *Prevent users and apps from accessing dangerous websites* -- GP name: *ExploitGuard_EnableNetworkProtection* -- GP element: *ExploitGuard_EnableNetworkProtection* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Network Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) - Disabled -- 1 - Enabled (block mode) -- 2 - Enabled (audit mode) - - - - -
- - -**Defender/ExcludedExtensions** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a **|**. For example, "lib|obj". - - - -ADMX Info: -- GP Friendly name: *Path Exclusions* -- GP name: *Exclusions_Paths* -- GP element: *Exclusions_PathsList* -- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/ExcludedPaths** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a **|**. For example, "C:\\Example|C:\\Example1". - - - -ADMX Info: -- GP Friendly name: *Extension Exclusions* -- GP name: *Exclusions_Extensions* -- GP element: *Exclusions_ExtensionsList* -- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/ExcludedProcesses** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows an administrator to specify a list of files opened by processes to ignore during a scan. - -> [!IMPORTANT] -> The process itself is not excluded from the scan, but can be by using the **Defender/ExcludedPaths** policy to exclude its path. - -Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\Example1.exe". - - - -ADMX Info: -- GP Friendly name: *Process Exclusions* -- GP name: *Exclusions_Processes* -- GP element: *Exclusions_ProcessesList* -- GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* -- GP ADMX file name: *WindowsDefender.admx* - - - - -
- - -**Defender/PUAProtection** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - - -Specifies the level of detection for potentially unwanted applications (PUAs). Windows Defender alerts you when potentially unwanted software is being downloaded or attempts to install itself on your computer. - -> [!NOTE] -> Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. For more information about PUA, see [Detect and block potentially unwanted applications](/microsoft-365/security/defender-endpoint/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). - - - -ADMX Info: -- GP Friendly name: *Configure detection for potentially unwanted applications* -- GP name: *Root_PUAProtection* -- GP element: *Root_PUAProtection* -- GP path: *Windows Components/Microsoft Defender Antivirus* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) – PUA Protection off. Windows Defender won't protect against potentially unwanted applications. -- 1 – PUA Protection on. Detected items are blocked. They'll show in history along with other threats. -- 2 – Audit mode. Windows Defender will detect potentially unwanted applications, but take no action. You can review information about the applications Windows Defender would have taken action against by searching for events created by Windows Defender in the Event Viewer. - - - - -
- - -**Defender/RealTimeScanDirection** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Controls which sets of files should be monitored. - -> [!NOTE] -> If **AllowOnAccessProtection** is not allowed, then this configuration can be used to monitor specific files. - - - -ADMX Info: -- GP Friendly name: *Configure monitoring for incoming and outgoing file and program activity* -- GP name: *RealtimeProtection_RealtimeScanDirection* -- GP element: *RealtimeProtection_RealtimeScanDirection* -- GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) – Monitor all files (bi-directional). -- 1 – Monitor incoming files. -- 2 – Monitor outgoing files. - - - - -
- - -**Defender/ScanParameter** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Selects whether to perform a quick scan or full scan. - - - -ADMX Info: -- GP Friendly name: *Specify the scan type to use for a scheduled scan* -- GP name: *Scan_ScanParameters* -- GP element: *Scan_ScanParameters* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 1 (default) – Quick scan -- 2 – Full scan - - - - -
- - -**Defender/ScheduleQuickScanTime** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Selects the time of day that the Windows Defender quick scan should run. The Windows Defender quick scan runs daily if a time is specified. - - - -For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. - -The default value is 120 - - - -ADMX Info: -- GP Friendly name: *Specify the time for a daily quick scan* -- GP name: *Scan_ScheduleQuickScantime* -- GP element: *Scan_ScheduleQuickScantime* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -Valid values: 0–1380 - - - - -
- - -**Defender/ScheduleScanDay** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Selects the day that the Windows Defender scan should run. - -> [!NOTE] -> The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting. - - - -ADMX Info: -- GP Friendly name: *Specify the day of the week to run a scheduled scan* -- GP name: *Scan_ScheduleDay* -- GP element: *Scan_ScheduleDay* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 (default) – Every day -- 1 – Sunday -- 2 – Monday -- 3 – Tuesday -- 4 – Wednesday -- 5 – Thursday -- 6 – Friday -- 7 – Saturday -- 8 – No scheduled scan - - - - -
- - -**Defender/ScheduleScanTime** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Selects the time of day that the Windows Defender scan should run. - -> [!NOTE] -> The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting. - -For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. - -The default value is 120. - - - -ADMX Info: -- GP Friendly name: *Specify the time of day to run a scheduled scan* -- GP name: *Scan_ScheduleTime* -- GP element: *Scan_ScheduleTime* -- GP path: *Windows Components/Microsoft Defender Antivirus/Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -Valid values: 0–1380. - - - - -
- - -**Defender/SecurityIntelligenceLocation** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - +If you disable or do not configure this setting, not changes will be made to CPU priority for scheduled scans. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled | +| 1 | Enabled | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_LowCpuPriority | +| Friendly Name | Configure low CPU priority for scheduled scans | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | LowCpuPriority | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## EnableNetworkProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/EnableNetworkProtection +``` + + + +Enable or disable Microsoft Defender Exploit Guard network protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploit-hosting sites, and other malicious content on the Internet. + +Enabled: +Specify the mode in the Options section: +-Block: Users and applications will not be able to access dangerous domains +-Audit Mode: Users and applications can connect to dangerous domains, however if this feature would have blocked access if it were set to Block, then a record of the event will be in the event logs. + +Disabled: +Users and applications will not be blocked from connecting to dangerous domains. + +Not configured: +Same as Disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled | +| 1 | Enabled (block mode) | +| 2 | Enabled (audit mode) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | ExploitGuard_EnableNetworkProtection | +| Friendly Name | Prevent users and apps from accessing dangerous websites | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Network Protection | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection | +| Registry Value Name | EnableNetworkProtection | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ExcludedExtensions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedExtensions +``` + + + +Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a |. For example, lib|obj. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Exclusions_Extensions | +| Friendly Name | Extension Exclusions | +| Element Name | Extension Exclusions | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Exclusions | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | +| Registry Value Name | Exclusions_Extensions | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ExcludedPaths + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedPaths +``` + + + +Allows an administrator to specify a list of directory paths to ignore during a scan. Each path in the list must be separated by a |. For example, C:\Example|C:\Example1. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Exclusions_Paths | +| Friendly Name | Path Exclusions | +| Element Name | Path Exclusions | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Exclusions | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | +| Registry Value Name | Exclusions_Paths | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ExcludedProcesses + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ExcludedProcesses +``` + + + +Allows an administrator to specify a list of files opened by processes to ignore during a scan. ImportantThe process itself is not excluded from the scan, but can be by using the Defender/ExcludedPaths policy to exclude its path. Each file type must be separated by a |. For example, C:\Example. exe|C:\Example1.exe. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Exclusions_Processes | +| Friendly Name | Process Exclusions | +| Element Name | Process Exclusions | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Exclusions | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Exclusions | +| Registry Value Name | Exclusions_Processes | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## PUAProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/PUAProtection +``` + + + +Enable or disable detection for potentially unwanted applications. You can choose to block, audit, or allow when potentially unwanted software is being downloaded or attempts to install itself on your computer. + +Enabled: +Specify the mode in the Options section: +-Block: Potentially unwanted software will be blocked. +-Audit Mode: Potentially unwanted software will not be blocked, however if this feature would have blocked access if it were set to Block, then a record of the event will be in the event logs. + +Disabled: +Potentially unwanted software will not be blocked. + +Not configured: +Same as Disabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | PUA Protection off. Windows Defender will not protect against potentially unwanted applications. | +| 1 | PUA Protection on. Detected items are blocked. They will show in history along with other threats. | +| 2 | Audit mode. Windows Defender will detect potentially unwanted applications, but take no action. You can review information about the applications Windows Defender would have taken action against by searching for events created by Windows Defender in the Event Viewer. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Root_PUAProtection | +| Friendly Name | Configure detection for potentially unwanted applications | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender | +| Registry Value Name | PUAProtection | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## RealTimeScanDirection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/RealTimeScanDirection +``` + + + +This policy setting allows you to configure monitoring for incoming and outgoing files, without having to turn off monitoring entirely. It is recommended for use on servers where there is a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. + +Note that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. + +The options for this setting are mutually exclusive: +0 = Scan incoming and outgoing files (default) +1 = Scan incoming files only +2 = Scan outgoing files only + +Any other value, or if the value does not exist, resolves to the default (0). + +If you enable this setting, the specified type of monitoring will be enabled. + +If you disable or do not configure this setting, monitoring for incoming and outgoing files will be enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Monitor all files (bi-directional). | +| 1 | Monitor incoming files. | +| 2 | Monitor outgoing files. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | RealtimeProtection_RealtimeScanDirection | +| Friendly Name | Configure monitoring for incoming and outgoing file and program activity | +| Element Name | Configure monitoring for incoming and outgoing file and program activity | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Real-time Protection | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Real-Time Protection | +| Registry Value Name | RealtimeScanDirection | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ScanParameter + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ScanParameter +``` + + + +This policy setting allows you to specify the scan type to use during a scheduled scan. Scan type options are: +1 = Quick Scan (default) +2 = Full Scan + +If you enable this setting, the scan type will be set to the specified value. + +If you disable or do not configure this setting, the default scan type will used. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 (Default) | Quick scan | +| 2 | Full scan | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_ScanParameters | +| Friendly Name | Specify the scan type to use for a scheduled scan | +| Element Name | Specify the scan type to use for a scheduled scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | ScanParameters | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ScheduleQuickScanTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ScheduleQuickScanTime +``` + + + +This policy setting allows you to specify the time of day at which to perform a daily quick scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to disabled. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a daily quick scan will run at the time of day specified. + +If you disable or do not configure this setting, daily quick scan controlled by this config will not be run. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-1380]` | +| Default Value | 120 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_ScheduleQuickScantime | +| Friendly Name | Specify the time for a daily quick scan | +| Element Name | Specify the time for a daily quick scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | ScheduleQuickScanTime | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ScheduleScanDay + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ScheduleScanDay +``` + + + +This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: +(0x0) Every Day +(0x1) Sunday +(0x2) Monday +(0x3) Tuesday +(0x4) Wednesday +(0x5) Thursday +(0x6) Friday +(0x7) Saturday +(0x8) Never (default) + +If you enable this setting, a scheduled scan will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default frequency. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Every day | +| 1 | Sunday | +| 2 | Monday | +| 3 | Tuesday | +| 4 | Wednesday | +| 5 | Thursday | +| 6 | Friday | +| 7 | Saturday | +| 8 | No scheduled scan | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_ScheduleDay | +| Friendly Name | Specify the day of the week to run a scheduled scan | +| Element Name | Specify the day of the week to run a scheduled scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | ScheduleDay | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ScheduleScanTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ScheduleScanTime +``` + + + +This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled scan will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default time. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-1380]` | +| Default Value | 120 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Scan_ScheduleTime | +| Friendly Name | Specify the time of day to run a scheduled scan | +| Element Name | Specify the time of day to run a scheduled scan | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Scan | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Scan | +| Registry Value Name | ScheduleTime | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## SecurityIntelligenceLocation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/SecurityIntelligenceLocation +``` + + + This policy setting allows you to define the security intelligence location for VDI-configured computers. -If you disable or don't configure this setting, security intelligence will be referred from the default local source. - - - -ADMX Info: -- GP Friendly name: *Specify the signature (Security intelligence) delivery optimization for Defender in Virtual Environments* -- GP name: *SecurityIntelligenceLocation* -- GP element: *SecurityIntelligenceLocation* -- GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender* -- GP ADMX file name: *WindowsDefender.admx* - - - - -- Empty string - no policy is set -- Non-empty string - the policy is set and security intelligence is gathered from the location. - - - - -
- - -**Defender/SignatureUpdateFallbackOrder** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to define the order in which different definition update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the definition update sources in order. - -Possible values are: - -- InternalDefinitionUpdateServer -- MicrosoftUpdateServer -- MMPC -- FileShares - -For example: InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC - -If you enable this setting, definition update sources will be contacted in the order specified. Once definition updates have been successfully downloaded from one specified source, the remaining sources in the list won't be contacted. - -If you disable or don't configure this setting, definition update sources will be contacted in a default order. - -OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder - - - -ADMX Info: -- GP Friendly name: *Define the order of sources for downloading definition updates* -- GP name: *SignatureUpdate_FallbackOrder* -- GP element: *SignatureUpdate_FallbackOrder* -- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* -- GP ADMX file name: *WindowsDefender.admx* - - - - - - - - - - - - - -
- - -**Defender/SignatureUpdateFileSharesSources** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting allows you to configure UNC file share sources for downloading definition updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the definition update sources. - -For example: \\unc1\Signatures | \\unc2\Signatures - -The list is empty by default. - -If you enable this setting, the specified sources will be contacted for definition updates. Once definition updates have been successfully downloaded from one specified source, the remaining sources in the list won't be contacted. - -If you disable or don't configure this setting, the list will remain empty by default and no sources will be contacted. - -OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFileSharesSources - - - -ADMX Info: -- GP Friendly name: *Define file shares for downloading definition updates* -- GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* -- GP element: *SignatureUpdate_DefinitionUpdateFileSharesSources* -- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* -- GP ADMX file name: *WindowsDefender.admx* - - - - - - - - - - - - - -
- - -**Defender/SignatureUpdateInterval** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. - -A value of 0 means no check for new signatures, a value of 1 means to check every hour, a value of 2 means to check every two hours, and so on, up to a value of 24, which means to check every day. - -The default value is 8. - -OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateInterval - - - -ADMX Info: -- GP Friendly name: *Specify the interval to check for definition updates* -- GP name: *SignatureUpdate_SignatureUpdateInterval* -- GP element: *SignatureUpdate_SignatureUpdateInterval* -- GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* -- GP ADMX file name: *WindowsDefender.admx* - - - -Valid values: 0–24. - - - - -
- - -**Defender/SubmitSamplesConsent** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not (and if the user has specified never to ask), the UI is launched to ask for user consent (when **Defender/AllowCloudProtection** is allowed) before sending data. - - - -ADMX Info: -- GP Friendly name: *Send file samples when further analysis is required* -- GP name: *SubmitSamplesConsent* -- GP element: *SubmitSamplesConsent* -- GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* -- GP ADMX file name: *WindowsDefender.admx* - - - -The following list shows the supported values: - -- 0 – Always prompt. -- 1 (default) – Send safe samples automatically. -- 2 – Never send. -- 3 – Send all samples automatically. - - - - -
- - -**Defender/ThreatSeverityDefaultAction** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -> [!NOTE] -> This policy is only enforced in Windows 10 for desktop. - -Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. - -This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format "*threat level*=*action*|*threat level*=*action*". For example, "1=6|2=2|4=10|5=3". - -The following list shows the supported values for threat severity levels: - -- 1 – Low severity threats -- 2 – Moderate severity threats -- 4 – High severity threats -- 5 – Severe threats - -The following list shows the supported values for possible actions: - -- 1 – Clean. Service tries to recover files and try to disinfect. -- 2 – Quarantine. Moves files to quarantine. -- 3 – Remove. Removes files from system. -- 6 – Allow. Allows file/does none of the above actions. -- 8 – User defined. Requires user to make a decision on which action to take. -- 10 – Block. Blocks file execution. - - - -ADMX Info: -- GP Friendly name: *Specify threat alert levels at which default action should not be taken when detected* -- GP name: *Threats_ThreatSeverityDefaultAction* -- GP element: *Threats_ThreatSeverityDefaultActionList* -- GP path: *Windows Components/Microsoft Defender Antivirus/Threats* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - - - - -## Related topics +If you disable or do not configure this setting, security intelligence will be referred from the default local source. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SignatureUpdate_SharedSignaturesLocation | +| Friendly Name | Define security intelligence location for VDI clients. | +| Element Name | Define file share for downloading security intelligence updates in virtual environments | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## SignatureUpdateFallbackOrder + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder +``` + + + +This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: “InternalDefinitionUpdateServer”, “MicrosoftUpdateServer”, “MMPC”, and “FileShares” + +For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } + +If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, security intelligence update sources will be contacted in a default order. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SignatureUpdate_FallbackOrder | +| Friendly Name | Define the order of sources for downloading security intelligence updates | +| Element Name | Define the order of sources for downloading security intelligence updates | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## SignatureUpdateFileSharesSources + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFileSharesSources +``` + + + +This policy setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: "{\\unc1 | \\unc2 }". The list is empty by default. + +If you enable this setting, the specified sources will be contacted for security intelligence updates. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, the list will remain empty by default and no sources will be contacted. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SignatureUpdate_DefinitionUpdateFileSharesSources | +| Friendly Name | Define file shares for downloading security intelligence updates | +| Element Name | Define file shares for downloading security intelligence updates | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## SignatureUpdateInterval + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/SignatureUpdateInterval +``` + + + +This policy setting allows you to specify an interval at which to check for security intelligence updates. The time value is represented as the number of hours between update checks. Valid values range from 1 (every hour) to 24 (once per day). + +If you enable this setting, checks for security intelligence updates will occur at the interval specified. + +If you disable or do not configure this setting, checks for security intelligence updates will occur at the default interval. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[0-24]` | +| Default Value | 8 | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SignatureUpdate_SignatureUpdateInterval | +| Friendly Name | Specify the interval to check for security intelligence updates | +| Element Name | Specify the interval to check for security intelligence updates | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Security Intelligence Updates | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Signature Updates | +| Registry Value Name | SignatureUpdateInterval | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## SubmitSamplesConsent + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/SubmitSamplesConsent +``` + + + +This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. + +Possible options are: +(0x0) Always prompt +(0x1) Send safe samples automatically +(0x2) Never send +(0x3) Send all samples automatically + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Always prompt. | +| 1 (Default) | Send safe samples automatically. | +| 2 | Never send. | +| 3 | Send all samples automatically. | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | SubmitSamplesConsent | +| Friendly Name | Send file samples when further analysis is required | +| Element Name | Send file samples when further analysis is required | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > MAPS | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Spynet | +| Registry Value Name | SubmitSamplesConsent | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + +## ThreatSeverityDefaultAction + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Defender/ThreatSeverityDefaultAction +``` + + + +Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format threat level=action|threat level=action. For example, 1=6|2=2|4=10|5=3. The following list shows the supported values for threat severity levels:1 – Low severity threats2 – Moderate severity threats4 – High severity threats5 – Severe threatsThe following list shows the supported values for possible actions:1 – Clean. Service tries to recover files and try to disinfect. 2 – Quarantine. Moves files to quarantine. 3 – Remove. Removes files from system. 6 – Allow. Allows file/does none of the above actions. 8 – User defined. Requires user to make a decision on which action to take. 10 – Block. Blocks file execution. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr | +| Access Type | Add, Delete, Get, Replace | + + + +**Group policy mapping**: + +| Name | Value | +|:--|:--| +| Name | Threats_ThreatSeverityDefaultAction | +| Friendly Name | Specify threat alert levels at which default action should not be taken when detected | +| Element Name | Specify threat alert levels at which default action should not be taken when detected | +| Location | Computer Configuration | +| Path | Windows Components > Microsoft Defender Antivirus > Threats | +| Registry Key Name | Software\Policies\Microsoft\Windows Defender\Threats | +| Registry Value Name | Threats_ThreatSeverityDefaultAction | +| ADMX File Name | WindowsDefender.admx | + + + + + + + + + + + + + + +## Related articles [Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 888db084cb..8a09a4ba72 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -1,920 +1,920 @@ items: - - name: Configuration service provider reference - href: index.yml +- name: Configuration service provider reference + href: index.yml + expanded: true + items: + - name: Device description framework (DDF) files + href: configuration-service-provider-ddf.md + - name: Support scenarios + href: configuration-service-provider-support.md + - name: WMI Bridge provider + items: + - name: Using PowerShell scripting with the WMI Bridge Provider + href: ../using-powershell-scripting-with-the-wmi-bridge-provider.md + - name: WMI providers supported in Windows 10 + href: ../wmi-providers-supported-in-windows.md + - name: Understanding ADMX policies + href: ../understanding-admx-backed-policies.md + items: + - name: Enable ADMX policies in MDM + href: ../enable-admx-backed-policies-in-mdm.md + - name: Win32 and Desktop Bridge app policy configuration + href: ../win32-and-centennial-app-policy-configuration.md + - name: OMA DM protocol support + href: ../oma-dm-protocol-support.md + items: + - name: Structure of OMA DM provisioning files + href: ../structure-of-oma-dm-provisioning-files.md + - name: Server requirements for OMA DM + href: ../server-requirements-windows-mdm.md + - name: Configuration service providers (CSPs) expanded: true items: - - name: Device description framework (DDF) files - href: configuration-service-provider-ddf.md - - name: Support scenarios - href: configuration-service-provider-support.md - - name: WMI Bridge provider + - name: Policy + href: policy-configuration-service-provider.md items: - - name: Using PowerShell scripting with the WMI Bridge Provider - href: ../using-powershell-scripting-with-the-wmi-bridge-provider.md - - name: WMI providers supported in Windows 10 - href: ../wmi-providers-supported-in-windows.md - - name: Understanding ADMX policies - href: ../understanding-admx-backed-policies.md + - name: Policy CSP DDF file + href: policy-ddf-file.md + - name: Policy CSP support scenarios + items: + - name: ADMX policies in Policy CSP + href: policies-in-policy-csp-admx-backed.md + - name: Policies in Policy CSP supported by Group Policy + href: policies-in-policy-csp-supported-by-group-policy.md + - name: Policies in Policy CSP supported by HoloLens 2 + href: policies-in-policy-csp-supported-by-hololens2.md + - name: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite + href: policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md + - name: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition + href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md + - name: Policies in Policy CSP supported by Windows 10 IoT Core + href: policies-in-policy-csp-supported-by-iot-core.md + - name: Policies in Policy CSP supported by Microsoft Surface Hub + href: policies-in-policy-csp-supported-by-surface-hub.md + - name: Policy CSPs that can be set using Exchange Active Sync (EAS) + href: policies-in-policy-csp-that-can-be-set-using-eas.md + - name: Policy CSP areas + expanded: true + items: + - name: AboveLock + href: policy-csp-abovelock.md + - name: Accounts + href: policy-csp-accounts.md + - name: ActiveXControls + href: policy-csp-activexcontrols.md + - name: ADMX_ActiveXInstallService + href: policy-csp-admx-activexinstallservice.md + - name: ADMX_AddRemovePrograms + href: policy-csp-admx-addremoveprograms.md + - name: ADMX_AdmPwd + href: policy-csp-admx-admpwd.md + - name: ADMX_AppCompat + href: policy-csp-admx-appcompat.md + - name: ADMX_AppxPackageManager + href: policy-csp-admx-appxpackagemanager.md + - name: ADMX_AppXRuntime + href: policy-csp-admx-appxruntime.md + - name: ADMX_AttachmentManager + href: policy-csp-admx-attachmentmanager.md + - name: ADMX_AuditSettings + href: policy-csp-admx-auditsettings.md + - name: ADMX_Bits + href: policy-csp-admx-bits.md + - name: ADMX_CipherSuiteOrder + href: policy-csp-admx-ciphersuiteorder.md + - name: ADMX_COM + href: policy-csp-admx-com.md + - name: ADMX_ControlPanel + href: policy-csp-admx-controlpanel.md + - name: ADMX_ControlPanelDisplay + href: policy-csp-admx-controlpaneldisplay.md + - name: ADMX_Cpls + href: policy-csp-admx-cpls.md + - name: ADMX_CredentialProviders + href: policy-csp-admx-credentialproviders.md + - name: ADMX_CredSsp + href: policy-csp-admx-credssp.md + - name: ADMX_CredUI + href: policy-csp-admx-credui.md + - name: ADMX_CtrlAltDel + href: policy-csp-admx-ctrlaltdel.md + - name: ADMX_DataCollection + href: policy-csp-admx-datacollection.md + - name: ADMX_DCOM + href: policy-csp-admx-dcom.md + - name: ADMX_Desktop + href: policy-csp-admx-desktop.md + - name: ADMX_DeviceCompat + href: policy-csp-admx-devicecompat.md + - name: ADMX_DeviceGuard + href: policy-csp-admx-deviceguard.md + - name: ADMX_DeviceInstallation + href: policy-csp-admx-deviceinstallation.md + - name: ADMX_DeviceSetup + href: policy-csp-admx-devicesetup.md + - name: ADMX_DFS + href: policy-csp-admx-dfs.md + - name: ADMX_DigitalLocker + href: policy-csp-admx-digitallocker.md + - name: ADMX_DiskDiagnostic + href: policy-csp-admx-diskdiagnostic.md + - name: ADMX_DistributedLinkTracking + href: policy-csp-admx-distributedlinktracking.md + - name: ADMX_DnsClient + href: policy-csp-admx-dnsclient.md + - name: ADMX_DWM + href: policy-csp-admx-dwm.md + - name: ADMX_EAIME + href: policy-csp-admx-eaime.md + - name: ADMX_EncryptFilesonMove + href: policy-csp-admx-encryptfilesonmove.md + - name: ADMX_EnhancedStorage + href: policy-csp-admx-enhancedstorage.md + - name: ADMX_ErrorReporting + href: policy-csp-admx-errorreporting.md + - name: ADMX_EventForwarding + href: policy-csp-admx-eventforwarding.md + - name: ADMX_EventLog + href: policy-csp-admx-eventlog.md + - name: ADMX_EventLogging + href: policy-csp-admx-eventlogging.md + - name: ADMX_EventViewer + href: policy-csp-admx-eventviewer.md + - name: ADMX_Explorer + href: policy-csp-admx-explorer.md + - name: ADMX_ExternalBoot + href: policy-csp-admx-externalboot.md + - name: ADMX_FileRecovery + href: policy-csp-admx-filerecovery.md + - name: ADMX_FileRevocation + href: policy-csp-admx-filerevocation.md + - name: ADMX_FileServerVSSProvider + href: policy-csp-admx-fileservervssprovider.md + - name: ADMX_FileSys + href: policy-csp-admx-filesys.md + - name: ADMX_FolderRedirection + href: policy-csp-admx-folderredirection.md + - name: ADMX_FramePanes + href: policy-csp-admx-framepanes.md + - name: ADMX_FTHSVC + href: policy-csp-admx-fthsvc.md + - name: ADMX_Globalization + href: policy-csp-admx-globalization.md + - name: ADMX_GroupPolicy + href: policy-csp-admx-grouppolicy.md + - name: ADMX_Help + href: policy-csp-admx-help.md + - name: ADMX_HelpAndSupport + href: policy-csp-admx-helpandsupport.md + - name: ADMX_HotSpotAuth + href: policy-csp-admx-hotspotauth.md + - name: ADMX_ICM + href: policy-csp-admx-icm.md + - name: ADMX_IIS + href: policy-csp-admx-iis.md + - name: ADMX_iSCSI + href: policy-csp-admx-iscsi.md + - name: ADMX_kdc + href: policy-csp-admx-kdc.md + - name: ADMX_Kerberos + href: policy-csp-admx-kerberos.md + - name: ADMX_LanmanServer + href: policy-csp-admx-lanmanserver.md + - name: ADMX_LanmanWorkstation + href: policy-csp-admx-lanmanworkstation.md + - name: ADMX_LeakDiagnostic + href: policy-csp-admx-leakdiagnostic.md + - name: ADMX_LinkLayerTopologyDiscovery + href: policy-csp-admx-linklayertopologydiscovery.md + - name: ADMX_LocationProviderAdm + href: policy-csp-admx-locationprovideradm.md + - name: ADMX_Logon + href: policy-csp-admx-logon.md + - name: ADMX_MicrosoftDefenderAntivirus + href: policy-csp-admx-microsoftdefenderantivirus.md + - name: ADMX_MMC + href: policy-csp-admx-mmc.md + - name: ADMX_MMCSnapins + href: policy-csp-admx-mmcsnapins.md + - name: ADMX_MobilePCMobilityCenter + href: policy-csp-admx-mobilepcmobilitycenter.md + - name: ADMX_MobilePCPresentationSettings + href: policy-csp-admx-mobilepcpresentationsettings.md + - name: ADMX_MSAPolicy + href: policy-csp-admx-msapolicy.md + - name: ADMX_msched + href: policy-csp-admx-msched.md + - name: ADMX_MSDT + href: policy-csp-admx-msdt.md + - name: ADMX_MSI + href: policy-csp-admx-msi.md + - name: ADMX_MsiFileRecovery + href: policy-csp-admx-msifilerecovery.md + - name: ADMX_nca + href: policy-csp-admx-nca.md + - name: ADMX_NCSI + href: policy-csp-admx-ncsi.md + - name: ADMX_Netlogon + href: policy-csp-admx-netlogon.md + - name: ADMX_NetworkConnections + href: policy-csp-admx-networkconnections.md + - name: ADMX_OfflineFiles + href: policy-csp-admx-offlinefiles.md + - name: ADMX_pca + href: policy-csp-admx-pca.md + - name: ADMX_PeerToPeerCaching + href: policy-csp-admx-peertopeercaching.md + - name: ADMX_PenTraining + href: policy-csp-admx-pentraining.md + - name: ADMX_PerformanceDiagnostics + href: policy-csp-admx-performancediagnostics.md + - name: ADMX_Power + href: policy-csp-admx-power.md + - name: ADMX_PowerShellExecutionPolicy + href: policy-csp-admx-powershellexecutionpolicy.md + - name: ADMX_PreviousVersions + href: policy-csp-admx-previousversions.md + - name: ADMX_Printing + href: policy-csp-admx-printing.md + - name: ADMX_Printing2 + href: policy-csp-admx-printing2.md + - name: ADMX_Programs + href: policy-csp-admx-programs.md + - name: ADMX_Reliability + href: policy-csp-admx-reliability.md + - name: ADMX_RemoteAssistance + href: policy-csp-admx-remoteassistance.md + - name: ADMX_RemovableStorage + href: policy-csp-admx-removablestorage.md + - name: ADMX_RPC + href: policy-csp-admx-rpc.md + - name: ADMX_Scripts + href: policy-csp-admx-scripts.md + - name: ADMX_sdiageng + href: policy-csp-admx-sdiageng.md + - name: ADMX_sdiagschd + href: policy-csp-admx-sdiagschd.md + - name: ADMX_Securitycenter + href: policy-csp-admx-securitycenter.md + - name: ADMX_Sensors + href: policy-csp-admx-sensors.md + - name: ADMX_ServerManager + href: policy-csp-admx-servermanager.md + - name: ADMX_Servicing + href: policy-csp-admx-servicing.md + - name: ADMX_SettingSync + href: policy-csp-admx-settingsync.md + - name: ADMX_SharedFolders + href: policy-csp-admx-sharedfolders.md + - name: ADMX_Sharing + href: policy-csp-admx-sharing.md + - name: ADMX_ShellCommandPromptRegEditTools + href: policy-csp-admx-shellcommandpromptregedittools.md + - name: ADMX_Smartcard + href: policy-csp-admx-smartcard.md + - name: ADMX_Snmp + href: policy-csp-admx-snmp.md + - name: ADMX_StartMenu + href: policy-csp-admx-startmenu.md + - name: ADMX_SystemRestore + href: policy-csp-admx-systemrestore.md + - name: ADMX_TabletShell + href: policy-csp-admx-tabletshell.md + - name: ADMX_Taskbar + href: policy-csp-admx-taskbar.md + - name: ADMX_tcpip + href: policy-csp-admx-tcpip.md + - name: ADMX_TerminalServer + href: policy-csp-admx-terminalserver.md + - name: ADMX_Thumbnails + href: policy-csp-admx-thumbnails.md + - name: ADMX_TouchInput + href: policy-csp-admx-touchinput.md + - name: ADMX_TPM + href: policy-csp-admx-tpm.md + - name: ADMX_UserExperienceVirtualization + href: policy-csp-admx-userexperiencevirtualization.md + - name: ADMX_UserProfiles + href: policy-csp-admx-userprofiles.md + - name: ADMX_W32Time + href: policy-csp-admx-w32time.md + - name: ADMX_WCM + href: policy-csp-admx-wcm.md + - name: ADMX_WDI + href: policy-csp-admx-wdi.md + - name: ADMX_WinCal + href: policy-csp-admx-wincal.md + - name: ADMX_WindowsConnectNow + href: policy-csp-admx-windowsconnectnow.md + - name: ADMX_WindowsExplorer + href: policy-csp-admx-windowsexplorer.md + - name: ADMX_WindowsMediaDRM + href: policy-csp-admx-windowsmediadrm.md + - name: ADMX_WindowsMediaPlayer + href: policy-csp-admx-windowsmediaplayer.md + - name: ADMX_WindowsRemoteManagement + href: policy-csp-admx-windowsremotemanagement.md + - name: ADMX_WindowsStore + href: policy-csp-admx-windowsstore.md + - name: ADMX_WinInit + href: policy-csp-admx-wininit.md + - name: ADMX_WinLogon + href: policy-csp-admx-winlogon.md + - name: ADMX_wlansvc + href: policy-csp-admx-wlansvc.md + - name: ADMX_WordWheel + href: policy-csp-admx-wordwheel.md + - name: ADMX_WorkFoldersClient + href: policy-csp-admx-workfoldersclient.md + - name: ADMX_WPN + href: policy-csp-admx-wpn.md + - name: ADMX-Winsrv + href: policy-csp-admx-winsrv.md + - name: ApplicationDefaults + href: policy-csp-applicationdefaults.md + - name: ApplicationManagement + href: policy-csp-applicationmanagement.md + - name: AppRuntime + href: policy-csp-appruntime.md + - name: AppVirtualization + href: policy-csp-appvirtualization.md + - name: AttachmentManager + href: policy-csp-attachmentmanager.md + - name: Audit + href: policy-csp-audit.md + - name: Authentication + href: policy-csp-authentication.md + - name: Autoplay + href: policy-csp-autoplay.md + - name: BitLocker + href: policy-csp-bitlocker.md + - name: BITS + href: policy-csp-bits.md + - name: Bluetooth + href: policy-csp-bluetooth.md + - name: Browser + href: policy-csp-browser.md + - name: Camera + href: policy-csp-camera.md + - name: Cellular + href: policy-csp-cellular.md + - name: Connectivity + href: policy-csp-connectivity.md + - name: ControlPolicyConflict + href: policy-csp-controlpolicyconflict.md + - name: CredentialProviders + href: policy-csp-credentialproviders.md + - name: CredentialsDelegation + href: policy-csp-credentialsdelegation.md + - name: CredentialsUI + href: policy-csp-credentialsui.md + - name: Cryptography + href: policy-csp-cryptography.md + - name: DataProtection + href: policy-csp-dataprotection.md + - name: DataUsage + href: policy-csp-datausage.md + - name: Defender + href: policy-csp-defender.md + - name: DeliveryOptimization + href: policy-csp-deliveryoptimization.md + - name: Desktop + href: policy-csp-desktop.md + - name: DesktopAppInstaller + href: policy-csp-desktopappinstaller.md + - name: DeviceGuard + href: policy-csp-deviceguard.md + - name: DeviceHealthMonitoring + href: policy-csp-devicehealthmonitoring.md + - name: DeviceInstallation + href: policy-csp-deviceinstallation.md + - name: DeviceLock + href: policy-csp-devicelock.md + - name: Display + href: policy-csp-display.md + - name: DmaGuard + href: policy-csp-dmaguard.md + - name: EAP + href: policy-csp-eap.md + - name: Education + href: policy-csp-education.md + - name: EnterpriseCloudPrint + href: policy-csp-enterprisecloudprint.md + - name: ErrorReporting + href: policy-csp-errorreporting.md + - name: EventLogService + href: policy-csp-eventlogservice.md + - name: Experience + href: policy-csp-experience.md + - name: ExploitGuard + href: policy-csp-exploitguard.md + - name: Federated Authentication + href: policy-csp-federatedauthentication.md + - name: Feeds + href: policy-csp-feeds.md + - name: FileExplorer + href: policy-csp-fileexplorer.md + - name: Games + href: policy-csp-games.md + - name: Handwriting + href: policy-csp-handwriting.md + - name: HumanPresence + href: policy-csp-humanpresence.md + - name: InternetExplorer + href: policy-csp-internetexplorer.md + - name: Kerberos + href: policy-csp-kerberos.md + - name: KioskBrowser + href: policy-csp-kioskbrowser.md + - name: LanmanWorkstation + href: policy-csp-lanmanworkstation.md + - name: Licensing + href: policy-csp-licensing.md + - name: LocalPoliciesSecurityOptions + href: policy-csp-localpoliciessecurityoptions.md + - name: LocalSecurityAuthority + href: policy-csp-lsa.md + - name: LocalUsersAndGroups + href: policy-csp-localusersandgroups.md + - name: LockDown + href: policy-csp-lockdown.md + - name: Maps + href: policy-csp-maps.md + - name: MemoryDump + href: policy-csp-memorydump.md + - name: Messaging + href: policy-csp-messaging.md + - name: MixedReality + href: policy-csp-mixedreality.md + - name: MSSecurityGuide + href: policy-csp-mssecurityguide.md + - name: MSSLegacy + href: policy-csp-msslegacy.md + - name: Multitasking + href: policy-csp-multitasking.md + - name: NetworkIsolation + href: policy-csp-networkisolation.md + - name: NetworkListManager + href: policy-csp-networklistmanager.md + - name: NewsAndInterests + href: policy-csp-newsandinterests.md + - name: Notifications + href: policy-csp-notifications.md + - name: Power + href: policy-csp-power.md + - name: Printers + href: policy-csp-printers.md + - name: Privacy + href: policy-csp-privacy.md + - name: RemoteAssistance + href: policy-csp-remoteassistance.md + - name: RemoteDesktop + href: policy-csp-remotedesktop.md + - name: RemoteDesktopServices + href: policy-csp-remotedesktopservices.md + - name: RemoteManagement + href: policy-csp-remotemanagement.md + - name: RemoteProcedureCall + href: policy-csp-remoteprocedurecall.md + - name: RemoteShell + href: policy-csp-remoteshell.md + - name: RestrictedGroups + href: policy-csp-restrictedgroups.md + - name: Search + href: policy-csp-search.md + - name: Security + href: policy-csp-security.md + - name: ServiceControlManager + href: policy-csp-servicecontrolmanager.md + - name: Settings + href: policy-csp-settings.md + - name: Speech + href: policy-csp-speech.md + - name: Start + href: policy-csp-start.md + - name: Storage + href: policy-csp-storage.md + - name: System + href: policy-csp-system.md + - name: SystemServices + href: policy-csp-systemservices.md + - name: TaskManager + href: policy-csp-taskmanager.md + - name: TaskScheduler + href: policy-csp-taskscheduler.md + - name: TextInput + href: policy-csp-textinput.md + - name: TimeLanguageSettings + href: policy-csp-timelanguagesettings.md + - name: Troubleshooting + href: policy-csp-troubleshooting.md + - name: Update + href: policy-csp-update.md + - name: UserRights + href: policy-csp-userrights.md + - name: VirtualizationBasedTechnology + href: policy-csp-virtualizationbasedtechnology.md + - name: WebThreatDefense + href: policy-csp-webthreatdefense.md + - name: Wifi + href: policy-csp-wifi.md + - name: WindowsAutoPilot + href: policy-csp-windowsautopilot.md + - name: WindowsConnectionManager + href: policy-csp-windowsconnectionmanager.md + - name: WindowsDefenderSecurityCenter + href: policy-csp-windowsdefendersecuritycenter.md + - name: WindowsDefenderSmartScreen + href: policy-csp-smartscreen.md + - name: WindowsInkWorkspace + href: policy-csp-windowsinkworkspace.md + - name: WindowsLogon + href: policy-csp-windowslogon.md + - name: WindowsPowerShell + href: policy-csp-windowspowershell.md + - name: WindowsSandbox + href: policy-csp-windowssandbox.md + - name: WirelessDisplay + href: policy-csp-wirelessdisplay.md + - name: AccountManagement + href: accountmanagement-csp.md items: - - name: Enable ADMX policies in MDM - href: ../enable-admx-backed-policies-in-mdm.md - - name: Win32 and Desktop Bridge app policy configuration - href: ../win32-and-centennial-app-policy-configuration.md - - name: OMA DM protocol support - href: ../oma-dm-protocol-support.md + - name: AccountManagement DDF file + href: accountmanagement-ddf.md + - name: Accounts + href: accounts-csp.md items: - - name: Structure of OMA DM provisioning files - href: ../structure-of-oma-dm-provisioning-files.md - - name: Server requirements for OMA DM - href: ../server-requirements-windows-mdm.md - - name: Configuration service providers (CSPs) - expanded: true + - name: Accounts DDF file + href: accounts-ddf-file.md + - name: ActiveSync + href: activesync-csp.md items: - - name: Policy - href: policy-configuration-service-provider.md - items: - - name: Policy CSP DDF file - href: policy-ddf-file.md - - name: Policy CSP support scenarios - items: - - name: ADMX policies in Policy CSP - href: policies-in-policy-csp-admx-backed.md - - name: Policies in Policy CSP supported by Group Policy - href: policies-in-policy-csp-supported-by-group-policy.md - - name: Policies in Policy CSP supported by HoloLens 2 - href: policies-in-policy-csp-supported-by-hololens2.md - - name: Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite - href: policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md - - name: Policies in Policy CSP supported by HoloLens (1st gen) Development Edition - href: policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md - - name: Policies in Policy CSP supported by Windows 10 IoT Core - href: policies-in-policy-csp-supported-by-iot-core.md - - name: Policies in Policy CSP supported by Microsoft Surface Hub - href: policies-in-policy-csp-supported-by-surface-hub.md - - name: Policy CSPs that can be set using Exchange Active Sync (EAS) - href: policies-in-policy-csp-that-can-be-set-using-eas.md - - name: Policy CSP areas - expanded: true - items: - - name: AboveLock - href: policy-csp-abovelock.md - - name: Accounts - href: policy-csp-accounts.md - - name: ActiveXControls - href: policy-csp-activexcontrols.md - - name: ADMX_ActiveXInstallService - href: policy-csp-admx-activexinstallservice.md - - name: ADMX_AddRemovePrograms - href: policy-csp-admx-addremoveprograms.md - - name: ADMX_AdmPwd - href: policy-csp-admx-admpwd.md - - name: ADMX_AppCompat - href: policy-csp-admx-appcompat.md - - name: ADMX_AppxPackageManager - href: policy-csp-admx-appxpackagemanager.md - - name: ADMX_AppXRuntime - href: policy-csp-admx-appxruntime.md - - name: ADMX_AttachmentManager - href: policy-csp-admx-attachmentmanager.md - - name: ADMX_AuditSettings - href: policy-csp-admx-auditsettings.md - - name: ADMX_Bits - href: policy-csp-admx-bits.md - - name: ADMX_CipherSuiteOrder - href: policy-csp-admx-ciphersuiteorder.md - - name: ADMX_COM - href: policy-csp-admx-com.md - - name: ADMX_ControlPanel - href: policy-csp-admx-controlpanel.md - - name: ADMX_ControlPanelDisplay - href: policy-csp-admx-controlpaneldisplay.md - - name: ADMX_Cpls - href: policy-csp-admx-cpls.md - - name: ADMX_CredentialProviders - href: policy-csp-admx-credentialproviders.md - - name: ADMX_CredSsp - href: policy-csp-admx-credssp.md - - name: ADMX_CredUI - href: policy-csp-admx-credui.md - - name: ADMX_CtrlAltDel - href: policy-csp-admx-ctrlaltdel.md - - name: ADMX_DataCollection - href: policy-csp-admx-datacollection.md - - name: ADMX_DCOM - href: policy-csp-admx-dcom.md - - name: ADMX_Desktop - href: policy-csp-admx-desktop.md - - name: ADMX_DeviceCompat - href: policy-csp-admx-devicecompat.md - - name: ADMX_DeviceGuard - href: policy-csp-admx-deviceguard.md - - name: ADMX_DeviceInstallation - href: policy-csp-admx-deviceinstallation.md - - name: ADMX_DeviceSetup - href: policy-csp-admx-devicesetup.md - - name: ADMX_DFS - href: policy-csp-admx-dfs.md - - name: ADMX_DigitalLocker - href: policy-csp-admx-digitallocker.md - - name: ADMX_DiskDiagnostic - href: policy-csp-admx-diskdiagnostic.md - - name: ADMX_DistributedLinkTracking - href: policy-csp-admx-distributedlinktracking.md - - name: ADMX_DnsClient - href: policy-csp-admx-dnsclient.md - - name: ADMX_DWM - href: policy-csp-admx-dwm.md - - name: ADMX_EAIME - href: policy-csp-admx-eaime.md - - name: ADMX_EncryptFilesonMove - href: policy-csp-admx-encryptfilesonmove.md - - name: ADMX_EventLogging - href: policy-csp-admx-eventlogging.md - - name: ADMX_EnhancedStorage - href: policy-csp-admx-enhancedstorage.md - - name: ADMX_ErrorReporting - href: policy-csp-admx-errorreporting.md - - name: ADMX_EventForwarding - href: policy-csp-admx-eventforwarding.md - - name: ADMX_EventLog - href: policy-csp-admx-eventlog.md - - name: ADMX_EventViewer - href: policy-csp-admx-eventviewer.md - - name: ADMX_Explorer - href: policy-csp-admx-explorer.md - - name: ADMX_ExternalBoot - href: policy-csp-admx-externalboot.md - - name: ADMX_FileRecovery - href: policy-csp-admx-filerecovery.md - - name: ADMX_FileRevocation - href: policy-csp-admx-filerevocation.md - - name: ADMX_FileServerVSSProvider - href: policy-csp-admx-fileservervssprovider.md - - name: ADMX_FileSys - href: policy-csp-admx-filesys.md - - name: ADMX_FolderRedirection - href: policy-csp-admx-folderredirection.md - - name: ADMX_FramePanes - href: policy-csp-admx-framepanes.md - - name: ADMX_FTHSVC - href: policy-csp-admx-fthsvc.md - - name: ADMX_Globalization - href: policy-csp-admx-globalization.md - - name: ADMX_GroupPolicy - href: policy-csp-admx-grouppolicy.md - - name: ADMX_Help - href: policy-csp-admx-help.md - - name: ADMX_HelpAndSupport - href: policy-csp-admx-helpandsupport.md - - name: ADMX_HotSpotAuth - href: policy-csp-admx-hotspotauth.md - - name: ADMX_ICM - href: policy-csp-admx-icm.md - - name: ADMX_IIS - href: policy-csp-admx-iis.md - - name: ADMX_iSCSI - href: policy-csp-admx-iscsi.md - - name: ADMX_kdc - href: policy-csp-admx-kdc.md - - name: ADMX_Kerberos - href: policy-csp-admx-kerberos.md - - name: ADMX_LanmanServer - href: policy-csp-admx-lanmanserver.md - - name: ADMX_LanmanWorkstation - href: policy-csp-admx-lanmanworkstation.md - - name: ADMX_LeakDiagnostic - href: policy-csp-admx-leakdiagnostic.md - - name: ADMX_LinkLayerTopologyDiscovery - href: policy-csp-admx-linklayertopologydiscovery.md - - name: ADMX_LocationProviderAdm - href: policy-csp-admx-locationprovideradm.md - - name: ADMX_Logon - href: policy-csp-admx-logon.md - - name: ADMX_MicrosoftDefenderAntivirus - href: policy-csp-admx-microsoftdefenderantivirus.md - - name: ADMX_MMC - href: policy-csp-admx-mmc.md - - name: ADMX_MMCSnapins - href: policy-csp-admx-mmcsnapins.md - - name: ADMX_MobilePCMobilityCenter - href: policy-csp-admx-mobilepcmobilitycenter.md - - name: ADMX_MobilePCPresentationSettings - href: policy-csp-admx-mobilepcpresentationsettings.md - - name: ADMX_MSAPolicy - href: policy-csp-admx-msapolicy.md - - name: ADMX_msched - href: policy-csp-admx-msched.md - - name: ADMX_MSDT - href: policy-csp-admx-msdt.md - - name: ADMX_MSI - href: policy-csp-admx-msi.md - - name: ADMX_MsiFileRecovery - href: policy-csp-admx-msifilerecovery.md - - name: ADMX_nca - href: policy-csp-admx-nca.md - - name: ADMX_NCSI - href: policy-csp-admx-ncsi.md - - name: ADMX_Netlogon - href: policy-csp-admx-netlogon.md - - name: ADMX_NetworkConnections - href: policy-csp-admx-networkconnections.md - - name: ADMX_OfflineFiles - href: policy-csp-admx-offlinefiles.md - - name: ADMX_pca - href: policy-csp-admx-pca.md - - name: ADMX_PeerToPeerCaching - href: policy-csp-admx-peertopeercaching.md - - name: ADMX_PenTraining - href: policy-csp-admx-pentraining.md - - name: ADMX_PerformanceDiagnostics - href: policy-csp-admx-performancediagnostics.md - - name: ADMX_Power - href: policy-csp-admx-power.md - - name: ADMX_PowerShellExecutionPolicy - href: policy-csp-admx-powershellexecutionpolicy.md - - name: ADMX_PreviousVersions - href: policy-csp-admx-previousversions.md - - name: ADMX_Printing - href: policy-csp-admx-printing.md - - name: ADMX_Printing2 - href: policy-csp-admx-printing2.md - - name: ADMX_Programs - href: policy-csp-admx-programs.md - - name: ADMX_Reliability - href: policy-csp-admx-reliability.md - - name: ADMX_RemoteAssistance - href: policy-csp-admx-remoteassistance.md - - name: ADMX_RemovableStorage - href: policy-csp-admx-removablestorage.md - - name: ADMX_RPC - href: policy-csp-admx-rpc.md - - name: ADMX_Scripts - href: policy-csp-admx-scripts.md - - name: ADMX_sdiageng - href: policy-csp-admx-sdiageng.md - - name: ADMX_sdiagschd - href: policy-csp-admx-sdiagschd.md - - name: ADMX_Securitycenter - href: policy-csp-admx-securitycenter.md - - name: ADMX_Sensors - href: policy-csp-admx-sensors.md - - name: ADMX_ServerManager - href: policy-csp-admx-servermanager.md - - name: ADMX_Servicing - href: policy-csp-admx-servicing.md - - name: ADMX_SettingSync - href: policy-csp-admx-settingsync.md - - name: ADMX_SharedFolders - href: policy-csp-admx-sharedfolders.md - - name: ADMX_Sharing - href: policy-csp-admx-sharing.md - - name: ADMX_ShellCommandPromptRegEditTools - href: policy-csp-admx-shellcommandpromptregedittools.md - - name: ADMX_Smartcard - href: policy-csp-admx-smartcard.md - - name: ADMX_Snmp - href: policy-csp-admx-snmp.md - - name: ADMX_StartMenu - href: policy-csp-admx-startmenu.md - - name: ADMX_SystemRestore - href: policy-csp-admx-systemrestore.md - - name: ADMX_TabletShell - href: policy-csp-admx-tabletshell.md - - name: ADMX_Taskbar - href: policy-csp-admx-taskbar.md - - name: ADMX_tcpip - href: policy-csp-admx-tcpip.md - - name: ADMX_TerminalServer - href: policy-csp-admx-terminalserver.md - - name: ADMX_Thumbnails - href: policy-csp-admx-thumbnails.md - - name: ADMX_TouchInput - href: policy-csp-admx-touchinput.md - - name: ADMX_TPM - href: policy-csp-admx-tpm.md - - name: ADMX_UserExperienceVirtualization - href: policy-csp-admx-userexperiencevirtualization.md - - name: ADMX_UserProfiles - href: policy-csp-admx-userprofiles.md - - name: ADMX_W32Time - href: policy-csp-admx-w32time.md - - name: ADMX_WCM - href: policy-csp-admx-wcm.md - - name: ADMX_WDI - href: policy-csp-admx-wdi.md - - name: ADMX_WinCal - href: policy-csp-admx-wincal.md - - name: ADMX_WindowsConnectNow - href: policy-csp-admx-windowsconnectnow.md - - name: ADMX_WindowsExplorer - href: policy-csp-admx-windowsexplorer.md - - name: ADMX_WindowsMediaDRM - href: policy-csp-admx-windowsmediadrm.md - - name: ADMX_WindowsMediaPlayer - href: policy-csp-admx-windowsmediaplayer.md - - name: ADMX_WindowsRemoteManagement - href: policy-csp-admx-windowsremotemanagement.md - - name: ADMX_WindowsStore - href: policy-csp-admx-windowsstore.md - - name: ADMX_WinInit - href: policy-csp-admx-wininit.md - - name: ADMX_WinLogon - href: policy-csp-admx-winlogon.md - - name: ADMX-Winsrv - href: policy-csp-admx-winsrv.md - - name: ADMX_wlansvc - href: policy-csp-admx-wlansvc.md - - name: ADMX_WordWheel - href: policy-csp-admx-wordwheel.md - - name: ADMX_WorkFoldersClient - href: policy-csp-admx-workfoldersclient.md - - name: ADMX_WPN - href: policy-csp-admx-wpn.md - - name: ApplicationDefaults - href: policy-csp-applicationdefaults.md - - name: ApplicationManagement - href: policy-csp-applicationmanagement.md - - name: AppRuntime - href: policy-csp-appruntime.md - - name: AppVirtualization - href: policy-csp-appvirtualization.md - - name: AttachmentManager - href: policy-csp-attachmentmanager.md - - name: Audit - href: policy-csp-audit.md - - name: Authentication - href: policy-csp-authentication.md - - name: Autoplay - href: policy-csp-autoplay.md - - name: BitLocker - href: policy-csp-bitlocker.md - - name: BITS - href: policy-csp-bits.md - - name: Bluetooth - href: policy-csp-bluetooth.md - - name: Browser - href: policy-csp-browser.md - - name: Camera - href: policy-csp-camera.md - - name: Cellular - href: policy-csp-cellular.md - - name: Connectivity - href: policy-csp-connectivity.md - - name: ControlPolicyConflict - href: policy-csp-controlpolicyconflict.md - - name: CredentialsDelegation - href: policy-csp-credentialsdelegation.md - - name: CredentialProviders - href: policy-csp-credentialproviders.md - - name: CredentialsUI - href: policy-csp-credentialsui.md - - name: Cryptography - href: policy-csp-cryptography.md - - name: DataProtection - href: policy-csp-dataprotection.md - - name: DataUsage - href: policy-csp-datausage.md - - name: Defender - href: policy-csp-defender.md - - name: DeliveryOptimization - href: policy-csp-deliveryoptimization.md - - name: Desktop - href: policy-csp-desktop.md - - name: DesktopAppInstaller - href: policy-csp-desktopappinstaller.md - - name: DeviceGuard - href: policy-csp-deviceguard.md - - name: DeviceHealthMonitoring - href: policy-csp-devicehealthmonitoring.md - - name: DeviceInstallation - href: policy-csp-deviceinstallation.md - - name: DeviceLock - href: policy-csp-devicelock.md - - name: Display - href: policy-csp-display.md - - name: DmaGuard - href: policy-csp-dmaguard.md - - name: EAP - href: policy-csp-eap.md - - name: Education - href: policy-csp-education.md - - name: EnterpriseCloudPrint - href: policy-csp-enterprisecloudprint.md - - name: ErrorReporting - href: policy-csp-errorreporting.md - - name: EventLogService - href: policy-csp-eventlogservice.md - - name: Experience - href: policy-csp-experience.md - - name: ExploitGuard - href: policy-csp-exploitguard.md - - name: Federated Authentication - href: policy-csp-federatedauthentication.md - - name: Feeds - href: policy-csp-feeds.md - - name: FileExplorer - href: policy-csp-fileexplorer.md - - name: Games - href: policy-csp-games.md - - name: Handwriting - href: policy-csp-handwriting.md - - name: HumanPresence - href: policy-csp-humanpresence.md - - name: InternetExplorer - href: policy-csp-internetexplorer.md - - name: Kerberos - href: policy-csp-kerberos.md - - name: KioskBrowser - href: policy-csp-kioskbrowser.md - - name: LanmanWorkstation - href: policy-csp-lanmanworkstation.md - - name: Licensing - href: policy-csp-licensing.md - - name: LocalPoliciesSecurityOptions - href: policy-csp-localpoliciessecurityoptions.md - - name: LocalSecurityAuthority - href: policy-csp-lsa.md - - name: LocalUsersAndGroups - href: policy-csp-localusersandgroups.md - - name: LockDown - href: policy-csp-lockdown.md - - name: Maps - href: policy-csp-maps.md - - name: MemoryDump - href: policy-csp-memorydump.md - - name: Messaging - href: policy-csp-messaging.md - - name: MixedReality - href: policy-csp-mixedreality.md - - name: MSSecurityGuide - href: policy-csp-mssecurityguide.md - - name: MSSLegacy - href: policy-csp-msslegacy.md - - name: Multitasking - href: policy-csp-multitasking.md - - name: NetworkIsolation - href: policy-csp-networkisolation.md - - name: NetworkListManager - href: policy-csp-networklistmanager.md - - name: NewsAndInterests - href: policy-csp-newsandinterests.md - - name: Notifications - href: policy-csp-notifications.md - - name: Power - href: policy-csp-power.md - - name: Printers - href: policy-csp-printers.md - - name: Privacy - href: policy-csp-privacy.md - - name: RemoteAssistance - href: policy-csp-remoteassistance.md - - name: RemoteDesktop - href: policy-csp-remotedesktop.md - - name: RemoteDesktopServices - href: policy-csp-remotedesktopservices.md - - name: RemoteManagement - href: policy-csp-remotemanagement.md - - name: RemoteProcedureCall - href: policy-csp-remoteprocedurecall.md - - name: RemoteShell - href: policy-csp-remoteshell.md - - name: RestrictedGroups - href: policy-csp-restrictedgroups.md - - name: Search - href: policy-csp-search.md - - name: Security - href: policy-csp-security.md - - name: ServiceControlManager - href: policy-csp-servicecontrolmanager.md - - name: Settings - href: policy-csp-settings.md - - name: Speech - href: policy-csp-speech.md - - name: Start - href: policy-csp-start.md - - name: Storage - href: policy-csp-storage.md - - name: System - href: policy-csp-system.md - - name: SystemServices - href: policy-csp-systemservices.md - - name: TaskManager - href: policy-csp-taskmanager.md - - name: TaskScheduler - href: policy-csp-taskscheduler.md - - name: TextInput - href: policy-csp-textinput.md - - name: TimeLanguageSettings - href: policy-csp-timelanguagesettings.md - - name: Troubleshooting - href: policy-csp-troubleshooting.md - - name: Update - href: policy-csp-update.md - - name: UserRights - href: policy-csp-userrights.md - - name: VirtualizationBasedTechnology - href: policy-csp-virtualizationbasedtechnology.md - - name: WebThreatDefense - href: policy-csp-webthreatdefense.md - - name: Wifi - href: policy-csp-wifi.md - - name: WindowsAutoPilot - href: policy-csp-windowsautopilot.md - - name: WindowsConnectionManager - href: policy-csp-windowsconnectionmanager.md - - name: WindowsDefenderSecurityCenter - href: policy-csp-windowsdefendersecuritycenter.md - - name: WindowsDefenderSmartScreen - href: policy-csp-smartscreen.md - - name: WindowsInkWorkspace - href: policy-csp-windowsinkworkspace.md - - name: WindowsLogon - href: policy-csp-windowslogon.md - - name: WindowsPowerShell - href: policy-csp-windowspowershell.md - - name: WindowsSandbox - href: policy-csp-windowssandbox.md - - name: WirelessDisplay - href: policy-csp-wirelessdisplay.md - - name: AccountManagement - href: accountmanagement-csp.md - items: - - name: AccountManagement DDF file - href: accountmanagement-ddf.md - - name: Accounts - href: accounts-csp.md - items: - - name: Accounts DDF file - href: accounts-ddf-file.md - - name: ActiveSync - href: activesync-csp.md - items: - - name: ActiveSync DDF file - href: activesync-ddf-file.md - - name: AllJoynManagement - href: alljoynmanagement-csp.md - items: - - name: AllJoynManagement DDF - href: alljoynmanagement-ddf.md - - name: APPLICATION - href: application-csp.md - - name: ApplicationControl - href: applicationcontrol-csp.md - items: - - name: ApplicationControl DDF file - href: applicationcontrol-csp-ddf.md - - name: AppLocker - href: applocker-csp.md - items: - - name: AppLocker DDF file - href: applocker-ddf-file.md - - name: AppLocker XSD - href: applocker-xsd.md - - name: AssignedAccess - href: assignedaccess-csp.md - items: - - name: AssignedAccess DDF file - href: assignedaccess-ddf.md - - name: BitLocker - href: bitlocker-csp.md - items: - - name: BitLocker DDF file - href: bitlocker-ddf-file.md - - name: CellularSettings - href: cellularsettings-csp.md - - name: CertificateStore - href: certificatestore-csp.md - items: - - name: CertificateStore DDF file - href: certificatestore-ddf-file.md - - name: CleanPC - href: cleanpc-csp.md - items: - - name: CleanPC DDF - href: cleanpc-ddf.md - - name: ClientCertificateInstall - href: clientcertificateinstall-csp.md - items: - - name: ClientCertificateInstall DDF file - href: clientcertificateinstall-ddf-file.md - - name: CM_CellularEntries - href: cm-cellularentries-csp.md - - name: CMPolicy - href: cmpolicy-csp.md - - name: CMPolicyEnterprise - href: cmpolicyenterprise-csp.md - items: - - name: CMPolicyEnterprise DDF file - href: cmpolicyenterprise-ddf-file.md - - name: CustomDeviceUI - href: customdeviceui-csp.md - items: - - name: CustomDeviceUI DDF file - href: customdeviceui-ddf.md - - name: Defender - href: defender-csp.md - items: - - name: Defender DDF file - href: defender-ddf.md - - name: DevDetail - href: devdetail-csp.md - items: - - name: DevDetail DDF file - href: devdetail-ddf-file.md - - name: DeveloperSetup - href: developersetup-csp.md - items: - - name: DeveloperSetup DDF - href: developersetup-ddf.md - - name: DeviceLock - href: devicelock-csp.md - items: - - name: DeviceLock DDF file - href: devicelock-ddf-file.md - - name: DeviceManageability - href: devicemanageability-csp.md - items: - - name: DeviceManageability DDF - href: devicemanageability-ddf.md - - name: DeviceStatus - href: devicestatus-csp.md - items: - - name: DeviceStatus DDF - href: devicestatus-ddf.md - - name: DevInfo - href: devinfo-csp.md - items: - - name: DevInfo DDF file - href: devinfo-ddf-file.md - - name: DiagnosticLog - href: diagnosticlog-csp.md - items: - - name: DiagnosticLog DDF file - href: diagnosticlog-ddf.md - - name: DMAcc - href: dmacc-csp.md - items: - - name: DMAcc DDF file - href: dmacc-ddf-file.md - - name: DMClient - href: dmclient-csp.md - items: - - name: DMClient DDF file - href: dmclient-ddf-file.md - - name: DMSessionActions - href: dmsessionactions-csp.md - items: - - name: DMSessionActions DDF file - href: dmsessionactions-ddf.md - - name: DynamicManagement - href: dynamicmanagement-csp.md - items: - - name: DynamicManagement DDF file - href: dynamicmanagement-ddf.md - - name: EMAIL2 - href: email2-csp.md - items: - - name: EMAIL2 DDF file - href: email2-ddf-file.md - - name: EnrollmentStatusTracking - href: enrollmentstatustracking-csp.md - items: - - name: EnrollmentStatusTracking DDF file - href: enrollmentstatustracking-csp-ddf.md - - name: EnterpriseAPN - href: enterpriseapn-csp.md - items: - - name: EnterpriseAPN DDF - href: enterpriseapn-ddf.md - - name: EnterpriseAppVManagement - href: enterpriseappvmanagement-csp.md - items: - - name: EnterpriseAppVManagement DDF file - href: enterpriseappvmanagement-ddf.md - - name: EnterpriseDataProtection - href: enterprisedataprotection-csp.md - items: - - name: EnterpriseDataProtection DDF file - href: enterprisedataprotection-ddf-file.md - - name: EnterpriseDesktopAppManagement - href: enterprisedesktopappmanagement-csp.md - items: - - name: EnterpriseDesktopAppManagement DDF - href: enterprisedesktopappmanagement-ddf-file.md - - name: EnterpriseDesktopAppManagement XSD - href: enterprisedesktopappmanagement2-xsd.md - - name: EnterpriseModernAppManagement - href: enterprisemodernappmanagement-csp.md - items: - - name: EnterpriseModernAppManagement DDF - href: enterprisemodernappmanagement-ddf.md - - name: EnterpriseModernAppManagement XSD - href: enterprisemodernappmanagement-xsd.md - - name: eUICCs - href: euiccs-csp.md - items: - - name: eUICCs DDF file - href: euiccs-ddf-file.md - - name: Firewall - href: firewall-csp.md - items: - - name: Firewall DDF file - href: firewall-ddf-file.md - - name: HealthAttestation - href: healthattestation-csp.md - items: - - name: HealthAttestation DDF - href: healthattestation-ddf.md - - name: Local Administrator Password Solution - href: laps-csp.md - items: - - name: Local Administrator Password Solution DDF - href: laps-ddf-file.md - - name: MultiSIM - href: multisim-csp.md - items: - - name: MultiSIM DDF file - href: multisim-ddf.md - - name: NAP - href: nap-csp.md - - name: NAPDEF - href: napdef-csp.md - - name: NetworkProxy - href: networkproxy-csp.md - items: - - name: NetworkProxy DDF file - href: networkproxy-ddf.md - - name: NetworkQoSPolicy - href: networkqospolicy-csp.md - items: - - name: NetworkQoSPolicy DDF file - href: networkqospolicy-ddf.md - - name: NodeCache - href: nodecache-csp.md - items: - - name: NodeCache DDF file - href: nodecache-ddf-file.md - - name: Office - href: office-csp.md - items: - - name: Office DDF - href: office-ddf.md - - name: PassportForWork - href: passportforwork-csp.md - items: - - name: PassportForWork DDF file - href: passportforwork-ddf.md - - name: PersonalDataEncryption - href: personaldataencryption-csp.md - items: - - name: PersonalDataEncryption DDF file - href: personaldataencryption-ddf-file.md - - name: Personalization - href: personalization-csp.md - items: - - name: Personalization DDF file - href: personalization-ddf.md - - name: Provisioning - href: provisioning-csp.md - - name: PXLOGICAL - href: pxlogical-csp.md - - name: Reboot - href: reboot-csp.md - items: - - name: Reboot DDF file - href: reboot-ddf-file.md - - name: RemoteFind - href: remotefind-csp.md - items: - - name: RemoteFind DDF file - href: remotefind-ddf-file.md - - name: RemoteWipe - href: remotewipe-csp.md - items: - - name: RemoteWipe DDF file - href: remotewipe-ddf-file.md - - name: Reporting - href: reporting-csp.md - items: - - name: Reporting DDF file - href: reporting-ddf-file.md - - name: RootCATrustedCertificates - href: rootcacertificates-csp.md - items: - - name: RootCATrustedCertificates DDF file - href: rootcacertificates-ddf-file.md - - name: SecureAssessment - href: secureassessment-csp.md - items: - - name: SecureAssessment DDF file - href: secureassessment-ddf-file.md - - name: SecurityPolicy - href: securitypolicy-csp.md - - name: SharedPC - href: sharedpc-csp.md - items: - - name: SharedPC DDF file - href: sharedpc-ddf-file.md - - name: Storage - href: storage-csp.md - items: - - name: Storage DDF file - href: storage-ddf-file.md - - name: SUPL - href: supl-csp.md - items: - - name: SUPL DDF file - href: supl-ddf-file.md - - name: SurfaceHub - href: surfacehub-csp.md - items: - - name: SurfaceHub DDF file - href: surfacehub-ddf-file.md - - name: TenantLockdown - href: tenantlockdown-csp.md - items: - - name: TenantLockdown DDF file - href: tenantlockdown-ddf.md - - name: TPMPolicy - href: tpmpolicy-csp.md - items: - - name: TPMPolicy DDF file - href: tpmpolicy-ddf-file.md - - name: UEFI - href: uefi-csp.md - items: - - name: UEFI DDF file - href: uefi-ddf.md - - name: UnifiedWriteFilter - href: unifiedwritefilter-csp.md - items: - - name: UnifiedWriteFilter DDF file - href: unifiedwritefilter-ddf.md - - name: UniversalPrint - href: universalprint-csp.md - items: - - name: UniversalPrint DDF file - href: universalprint-ddf-file.md - - name: Update - href: update-csp.md - items: - - name: Update DDF file - href: update-ddf-file.md - - name: VPN - href: vpn-csp.md - items: - - name: VPN DDF file - href: vpn-ddf-file.md - - name: VPNv2 - href: vpnv2-csp.md - items: - - name: VPNv2 DDF file - href: vpnv2-ddf-file.md - - name: ProfileXML XSD - href: vpnv2-profile-xsd.md - - name: EAP configuration - href: eap-configuration.md - - name: w4 APPLICATION - href: w4-application-csp.md - - name: w7 APPLICATION - href: w7-application-csp.md - - name: WiFi - href: wifi-csp.md - items: - - name: WiFi DDF file - href: wifi-ddf-file.md - - name: Win32AppInventory - href: win32appinventory-csp.md - items: - - name: Win32AppInventory DDF file - href: win32appinventory-ddf-file.md - - name: Win32CompatibilityAppraiser - href: win32compatibilityappraiser-csp.md - items: - - name: Win32CompatibilityAppraiser DDF file - href: win32compatibilityappraiser-ddf.md - - name: WindowsAdvancedThreatProtection - href: windowsadvancedthreatprotection-csp.md - items: - - name: WindowsAdvancedThreatProtection DDF file - href: windowsadvancedthreatprotection-ddf.md - - name: WindowsAutopilot - href: windowsautopilot-csp.md - items: - - name: WindowsAutopilot DDF file - href: windowsautopilot-ddf-file.md - - name: WindowsDefenderApplicationGuard - href: windowsdefenderapplicationguard-csp.md - items: - - name: WindowsDefenderApplicationGuard DDF file - href: windowsdefenderapplicationguard-ddf-file.md - - name: WindowsLicensing - href: windowslicensing-csp.md - items: - - name: WindowsLicensing DDF file - href: windowslicensing-ddf-file.md - - name: WiredNetwork - href: wirednetwork-csp.md - items: - - name: WiredNetwork DDF file - href: wirednetwork-ddf-file.md + - name: ActiveSync DDF file + href: activesync-ddf-file.md + - name: AllJoynManagement + href: alljoynmanagement-csp.md + items: + - name: AllJoynManagement DDF + href: alljoynmanagement-ddf.md + - name: APPLICATION + href: application-csp.md + - name: ApplicationControl + href: applicationcontrol-csp.md + items: + - name: ApplicationControl DDF file + href: applicationcontrol-csp-ddf.md + - name: AppLocker + href: applocker-csp.md + items: + - name: AppLocker DDF file + href: applocker-ddf-file.md + - name: AppLocker XSD + href: applocker-xsd.md + - name: AssignedAccess + href: assignedaccess-csp.md + items: + - name: AssignedAccess DDF file + href: assignedaccess-ddf.md + - name: BitLocker + href: bitlocker-csp.md + items: + - name: BitLocker DDF file + href: bitlocker-ddf-file.md + - name: CellularSettings + href: cellularsettings-csp.md + - name: CertificateStore + href: certificatestore-csp.md + items: + - name: CertificateStore DDF file + href: certificatestore-ddf-file.md + - name: CleanPC + href: cleanpc-csp.md + items: + - name: CleanPC DDF + href: cleanpc-ddf.md + - name: ClientCertificateInstall + href: clientcertificateinstall-csp.md + items: + - name: ClientCertificateInstall DDF file + href: clientcertificateinstall-ddf-file.md + - name: CM_CellularEntries + href: cm-cellularentries-csp.md + - name: CMPolicy + href: cmpolicy-csp.md + - name: CMPolicyEnterprise + href: cmpolicyenterprise-csp.md + items: + - name: CMPolicyEnterprise DDF file + href: cmpolicyenterprise-ddf-file.md + - name: CustomDeviceUI + href: customdeviceui-csp.md + items: + - name: CustomDeviceUI DDF file + href: customdeviceui-ddf.md + - name: Defender + href: defender-csp.md + items: + - name: Defender DDF file + href: defender-ddf.md + - name: DevDetail + href: devdetail-csp.md + items: + - name: DevDetail DDF file + href: devdetail-ddf-file.md + - name: DeveloperSetup + href: developersetup-csp.md + items: + - name: DeveloperSetup DDF + href: developersetup-ddf.md + - name: DeviceLock + href: devicelock-csp.md + items: + - name: DeviceLock DDF file + href: devicelock-ddf-file.md + - name: DeviceManageability + href: devicemanageability-csp.md + items: + - name: DeviceManageability DDF + href: devicemanageability-ddf.md + - name: DeviceStatus + href: devicestatus-csp.md + items: + - name: DeviceStatus DDF + href: devicestatus-ddf.md + - name: DevInfo + href: devinfo-csp.md + items: + - name: DevInfo DDF file + href: devinfo-ddf-file.md + - name: DiagnosticLog + href: diagnosticlog-csp.md + items: + - name: DiagnosticLog DDF file + href: diagnosticlog-ddf.md + - name: DMAcc + href: dmacc-csp.md + items: + - name: DMAcc DDF file + href: dmacc-ddf-file.md + - name: DMClient + href: dmclient-csp.md + items: + - name: DMClient DDF file + href: dmclient-ddf-file.md + - name: DMSessionActions + href: dmsessionactions-csp.md + items: + - name: DMSessionActions DDF file + href: dmsessionactions-ddf.md + - name: DynamicManagement + href: dynamicmanagement-csp.md + items: + - name: DynamicManagement DDF file + href: dynamicmanagement-ddf.md + - name: EMAIL2 + href: email2-csp.md + items: + - name: EMAIL2 DDF file + href: email2-ddf-file.md + - name: EnrollmentStatusTracking + href: enrollmentstatustracking-csp.md + items: + - name: EnrollmentStatusTracking DDF file + href: enrollmentstatustracking-csp-ddf.md + - name: EnterpriseAPN + href: enterpriseapn-csp.md + items: + - name: EnterpriseAPN DDF + href: enterpriseapn-ddf.md + - name: EnterpriseAppVManagement + href: enterpriseappvmanagement-csp.md + items: + - name: EnterpriseAppVManagement DDF file + href: enterpriseappvmanagement-ddf.md + - name: EnterpriseDataProtection + href: enterprisedataprotection-csp.md + items: + - name: EnterpriseDataProtection DDF file + href: enterprisedataprotection-ddf-file.md + - name: EnterpriseDesktopAppManagement + href: enterprisedesktopappmanagement-csp.md + items: + - name: EnterpriseDesktopAppManagement DDF + href: enterprisedesktopappmanagement-ddf-file.md + - name: EnterpriseDesktopAppManagement XSD + href: enterprisedesktopappmanagement2-xsd.md + - name: EnterpriseModernAppManagement + href: enterprisemodernappmanagement-csp.md + items: + - name: EnterpriseModernAppManagement DDF + href: enterprisemodernappmanagement-ddf.md + - name: EnterpriseModernAppManagement XSD + href: enterprisemodernappmanagement-xsd.md + - name: eUICCs + href: euiccs-csp.md + items: + - name: eUICCs DDF file + href: euiccs-ddf-file.md + - name: Firewall + href: firewall-csp.md + items: + - name: Firewall DDF file + href: firewall-ddf-file.md + - name: HealthAttestation + href: healthattestation-csp.md + items: + - name: HealthAttestation DDF + href: healthattestation-ddf.md + - name: Local Administrator Password Solution + href: laps-csp.md + items: + - name: Local Administrator Password Solution DDF + href: laps-ddf-file.md + - name: MultiSIM + href: multisim-csp.md + items: + - name: MultiSIM DDF file + href: multisim-ddf.md + - name: NAP + href: nap-csp.md + - name: NAPDEF + href: napdef-csp.md + - name: NetworkProxy + href: networkproxy-csp.md + items: + - name: NetworkProxy DDF file + href: networkproxy-ddf.md + - name: NetworkQoSPolicy + href: networkqospolicy-csp.md + items: + - name: NetworkQoSPolicy DDF file + href: networkqospolicy-ddf.md + - name: NodeCache + href: nodecache-csp.md + items: + - name: NodeCache DDF file + href: nodecache-ddf-file.md + - name: Office + href: office-csp.md + items: + - name: Office DDF + href: office-ddf.md + - name: PassportForWork + href: passportforwork-csp.md + items: + - name: PassportForWork DDF file + href: passportforwork-ddf.md + - name: PersonalDataEncryption + href: personaldataencryption-csp.md + items: + - name: PersonalDataEncryption DDF file + href: personaldataencryption-ddf-file.md + - name: Personalization + href: personalization-csp.md + items: + - name: Personalization DDF file + href: personalization-ddf.md + - name: Provisioning + href: provisioning-csp.md + - name: PXLOGICAL + href: pxlogical-csp.md + - name: Reboot + href: reboot-csp.md + items: + - name: Reboot DDF file + href: reboot-ddf-file.md + - name: RemoteFind + href: remotefind-csp.md + items: + - name: RemoteFind DDF file + href: remotefind-ddf-file.md + - name: RemoteWipe + href: remotewipe-csp.md + items: + - name: RemoteWipe DDF file + href: remotewipe-ddf-file.md + - name: Reporting + href: reporting-csp.md + items: + - name: Reporting DDF file + href: reporting-ddf-file.md + - name: RootCATrustedCertificates + href: rootcacertificates-csp.md + items: + - name: RootCATrustedCertificates DDF file + href: rootcacertificates-ddf-file.md + - name: SecureAssessment + href: secureassessment-csp.md + items: + - name: SecureAssessment DDF file + href: secureassessment-ddf-file.md + - name: SecurityPolicy + href: securitypolicy-csp.md + - name: SharedPC + href: sharedpc-csp.md + items: + - name: SharedPC DDF file + href: sharedpc-ddf-file.md + - name: Storage + href: storage-csp.md + items: + - name: Storage DDF file + href: storage-ddf-file.md + - name: SUPL + href: supl-csp.md + items: + - name: SUPL DDF file + href: supl-ddf-file.md + - name: SurfaceHub + href: surfacehub-csp.md + items: + - name: SurfaceHub DDF file + href: surfacehub-ddf-file.md + - name: TenantLockdown + href: tenantlockdown-csp.md + items: + - name: TenantLockdown DDF file + href: tenantlockdown-ddf.md + - name: TPMPolicy + href: tpmpolicy-csp.md + items: + - name: TPMPolicy DDF file + href: tpmpolicy-ddf-file.md + - name: UEFI + href: uefi-csp.md + items: + - name: UEFI DDF file + href: uefi-ddf.md + - name: UnifiedWriteFilter + href: unifiedwritefilter-csp.md + items: + - name: UnifiedWriteFilter DDF file + href: unifiedwritefilter-ddf.md + - name: UniversalPrint + href: universalprint-csp.md + items: + - name: UniversalPrint DDF file + href: universalprint-ddf-file.md + - name: Update + href: update-csp.md + items: + - name: Update DDF file + href: update-ddf-file.md + - name: VPN + href: vpn-csp.md + items: + - name: VPN DDF file + href: vpn-ddf-file.md + - name: VPNv2 + href: vpnv2-csp.md + items: + - name: VPNv2 DDF file + href: vpnv2-ddf-file.md + - name: ProfileXML XSD + href: vpnv2-profile-xsd.md + - name: EAP configuration + href: eap-configuration.md + - name: w4 APPLICATION + href: w4-application-csp.md + - name: w7 APPLICATION + href: w7-application-csp.md + - name: WiFi + href: wifi-csp.md + items: + - name: WiFi DDF file + href: wifi-ddf-file.md + - name: Win32AppInventory + href: win32appinventory-csp.md + items: + - name: Win32AppInventory DDF file + href: win32appinventory-ddf-file.md + - name: Win32CompatibilityAppraiser + href: win32compatibilityappraiser-csp.md + items: + - name: Win32CompatibilityAppraiser DDF file + href: win32compatibilityappraiser-ddf.md + - name: WindowsAdvancedThreatProtection + href: windowsadvancedthreatprotection-csp.md + items: + - name: WindowsAdvancedThreatProtection DDF file + href: windowsadvancedthreatprotection-ddf.md + - name: WindowsAutopilot + href: windowsautopilot-csp.md + items: + - name: WindowsAutopilot DDF file + href: windowsautopilot-ddf-file.md + - name: WindowsDefenderApplicationGuard + href: windowsdefenderapplicationguard-csp.md + items: + - name: WindowsDefenderApplicationGuard DDF file + href: windowsdefenderapplicationguard-ddf-file.md + - name: WindowsLicensing + href: windowslicensing-csp.md + items: + - name: WindowsLicensing DDF file + href: windowslicensing-ddf-file.md + - name: WiredNetwork + href: wirednetwork-csp.md + items: + - name: WiredNetwork DDF file + href: wirednetwork-ddf-file.md From ed08353578acae54897571923a0a2f7bf0b256d5 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 1 Nov 2022 16:02:54 -0400 Subject: [PATCH 003/324] Add some other missing policy CSPs --- windows/client-management/mdm/defender-csp.md | 4 +- .../mdm/policies-in-policy-csp-admx-backed.md | 4902 +++---- ...-in-policy-csp-supported-by-surface-hub.md | 54 +- .../policy-configuration-service-provider.md | 10608 ++-------------- .../mdm/policy-csp-admx-mss-legacy.md | 806 ++ .../mdm/policy-csp-admx-qos.md | 1139 ++ .../mdm/policy-csp-admx-tabletpcinputpanel.md | 1032 ++ .../mdm/policy-csp-defender.md | 22 +- .../mdm/policy-csp-msslegacy.md | 313 +- .../mdm/policy-csp-settingssync.md | 90 + .../mdm/policy-csp-tenantrestrictions.md | 92 + windows/client-management/mdm/toc.yml | 10 + 12 files changed, 6916 insertions(+), 12156 deletions(-) create mode 100644 windows/client-management/mdm/policy-csp-admx-mss-legacy.md create mode 100644 windows/client-management/mdm/policy-csp-admx-qos.md create mode 100644 windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md create mode 100644 windows/client-management/mdm/policy-csp-settingssync.md create mode 100644 windows/client-management/mdm/policy-csp-tenantrestrictions.md diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index c95bb5bc44..53f26f9b51 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -497,7 +497,7 @@ Supported operation is Get. **Health/QuickScanOverdue** Indicates whether a Windows Defender quick scan is overdue for the device. -A Quick scan is overdue when a scheduled Quick scan didn't complete successfully for 2 weeks and [catchup Quick scans](./policy-csp-defender.md#defender-disablecatchupquickscan) are disabled (default). +A Quick scan is overdue when a scheduled Quick scan didn't complete successfully for 2 weeks and [catchup Quick scans](./policy-csp-defender.md#disablecatchupquickscan) are disabled (default). The data type is a Boolean. @@ -506,7 +506,7 @@ Supported operation is Get. **Health/FullScanOverdue** Indicates whether a Windows Defender full scan is overdue for the device. -A Full scan is overdue when a scheduled Full scan didn't complete successfully for 2 weeks and [catchup Full scans](./policy-csp-defender.md#defender-disablecatchupfullscan) are disabled (default). +A Full scan is overdue when a scheduled Full scan didn't complete successfully for 2 weeks and [catchup Full scans](./policy-csp-defender.md#disablecatchupfullscan) are disabled (default). The data type is a Boolean. diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 6a4bbc1496..c9f905bcab 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -20,3009 +20,3009 @@ This article lists the ADMX-backed policies in Policy CSP. ## ActiveXControls -- [ApprovedInstallationSites](policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [ApprovedInstallationSites](policy-csp-activexcontrols.md) ## ADMX_ActiveXInstallService -- [AxISURLZonePolicies](policy-csp-admx-activexinstallservice.md#admx-activexinstallservice-axisurlzonepolicies) +- [AxISURLZonePolicies](policy-csp-admx-activexinstallservice.md) ## ADMX_AddRemovePrograms -- [NoServices](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noservices) -- [NoAddPage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddpage) -- [NoWindowsSetupPage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nowindowssetuppage) -- [NoRemovePage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noremovepage) -- [NoAddFromCDorFloppy](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromcdorfloppy) -- [NoAddFromInternet](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfrominternet) -- [NoAddFromNetwork](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddfromnetwork) -- [NoChooseProgramsPage](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nochooseprogramspage) -- [NoAddRemovePrograms](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-noaddremoveprograms) -- [NoSupportInfo](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-nosupportinfo) -- [DefaultCategory](policy-csp-admx-addremoveprograms.md#admx-addremoveprograms-defaultcategory) +- [NoServices](policy-csp-admx-addremoveprograms.md) +- [NoAddPage](policy-csp-admx-addremoveprograms.md) +- [NoWindowsSetupPage](policy-csp-admx-addremoveprograms.md) +- [NoRemovePage](policy-csp-admx-addremoveprograms.md) +- [NoAddFromCDorFloppy](policy-csp-admx-addremoveprograms.md) +- [NoAddFromInternet](policy-csp-admx-addremoveprograms.md) +- [NoAddFromNetwork](policy-csp-admx-addremoveprograms.md) +- [NoChooseProgramsPage](policy-csp-admx-addremoveprograms.md) +- [NoAddRemovePrograms](policy-csp-admx-addremoveprograms.md) +- [NoSupportInfo](policy-csp-admx-addremoveprograms.md) +- [DefaultCategory](policy-csp-admx-addremoveprograms.md) ## ADMX_AdmPwd -- [POL_AdmPwd_DontAllowPwdExpirationBehindPolicy](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd-dontallowpwdexpirationbehindpolicy) -- [POL_AdmPwd_Enabled](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd-enabled) -- [POL_AdmPwd_AdminName](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd-adminname) -- [POL_AdmPwd](policy-csp-admx-admpwd.md#admx-admpwd-pol-admpwd) +- [POL_AdmPwd_DontAllowPwdExpirationBehindPolicy](policy-csp-admx-admpwd.md) +- [POL_AdmPwd_Enabled](policy-csp-admx-admpwd.md) +- [POL_AdmPwd_AdminName](policy-csp-admx-admpwd.md) +- [POL_AdmPwd](policy-csp-admx-admpwd.md) ## ADMX_AppCompat -- [AppCompatTurnOffProgramCompatibilityAssistant_1](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant-1) -- [AppCompatPrevent16BitMach](policy-csp-admx-appcompat.md#admx-appcompat-appcompatprevent16bitmach) -- [AppCompatRemoveProgramCompatPropPage](policy-csp-admx-appcompat.md#admx-appcompat-appcompatremoveprogramcompatproppage) -- [AppCompatTurnOffEngine](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffengine) -- [AppCompatTurnOffApplicationImpactTelemetry](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffapplicationimpacttelemetry) -- [AppCompatTurnOffProgramInventory](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprograminventory) -- [AppCompatTurnOffProgramCompatibilityAssistant_2](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffprogramcompatibilityassistant-2) -- [AppCompatTurnOffUserActionRecord](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffuseractionrecord) -- [AppCompatTurnOffSwitchBack](policy-csp-admx-appcompat.md#admx-appcompat-appcompatturnoffswitchback) +- [AppCompatTurnOffProgramCompatibilityAssistant_1](policy-csp-admx-appcompat.md) +- [AppCompatPrevent16BitMach](policy-csp-admx-appcompat.md) +- [AppCompatRemoveProgramCompatPropPage](policy-csp-admx-appcompat.md) +- [AppCompatTurnOffEngine](policy-csp-admx-appcompat.md) +- [AppCompatTurnOffApplicationImpactTelemetry](policy-csp-admx-appcompat.md) +- [AppCompatTurnOffProgramInventory](policy-csp-admx-appcompat.md) +- [AppCompatTurnOffProgramCompatibilityAssistant_2](policy-csp-admx-appcompat.md) +- [AppCompatTurnOffUserActionRecord](policy-csp-admx-appcompat.md) +- [AppCompatTurnOffSwitchBack](policy-csp-admx-appcompat.md) ## ADMX_AppxPackageManager -- [AllowDeploymentInSpecialProfiles](policy-csp-admx-appxpackagemanager.md#admx-appxpackagemanager-allowdeploymentinspecialprofiles) +- [AllowDeploymentInSpecialProfiles](policy-csp-admx-appxpackagemanager.md) ## ADMX_AppXRuntime -- [AppxRuntimeBlockFileElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) -- [AppxRuntimeBlockProtocolElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) -- [AppxRuntimeBlockFileElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockfileelevation) -- [AppxRuntimeBlockProtocolElevation](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockprotocolelevation) -- [AppxRuntimeBlockHostedAppAccessWinRT](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeblockhostedappaccesswinrt) -- [AppxRuntimeApplicationContentUriRules](policy-csp-admx-appxruntime.md#admx-appxruntime-appxruntimeapplicationcontenturirules) +- [AppxRuntimeBlockFileElevation](policy-csp-admx-appxruntime.md) +- [AppxRuntimeBlockProtocolElevation](policy-csp-admx-appxruntime.md) +- [AppxRuntimeBlockFileElevation](policy-csp-admx-appxruntime.md) +- [AppxRuntimeBlockProtocolElevation](policy-csp-admx-appxruntime.md) +- [AppxRuntimeBlockHostedAppAccessWinRT](policy-csp-admx-appxruntime.md) +- [AppxRuntimeApplicationContentUriRules](policy-csp-admx-appxruntime.md) ## ADMX_AttachmentManager -- [AM_SetFileRiskLevel](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setfilerisklevel) -- [AM_SetHighRiskInclusion](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-sethighriskinclusion) -- [AM_SetLowRiskInclusion](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setlowriskinclusion) -- [AM_SetModRiskInclusion](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-setmodriskinclusion) -- [AM_EstimateFileHandlerRisk](policy-csp-admx-attachmentmanager.md#admx-attachmentmanager-am-estimatefilehandlerrisk) +- [AM_SetFileRiskLevel](policy-csp-admx-attachmentmanager.md) +- [AM_SetHighRiskInclusion](policy-csp-admx-attachmentmanager.md) +- [AM_SetLowRiskInclusion](policy-csp-admx-attachmentmanager.md) +- [AM_SetModRiskInclusion](policy-csp-admx-attachmentmanager.md) +- [AM_EstimateFileHandlerRisk](policy-csp-admx-attachmentmanager.md) ## ADMX_AuditSettings -- [IncludeCmdLine](policy-csp-admx-auditsettings.md#admx-auditsettings-includecmdline) +- [IncludeCmdLine](policy-csp-admx-auditsettings.md) ## ADMX_Bits -- [BITS_EnablePeercaching](policy-csp-admx-bits.md#admx-bits-bits-enablepeercaching) -- [BITS_DisableBranchCache](policy-csp-admx-bits.md#admx-bits-bits-disablebranchcache) -- [BITS_DisablePeercachingClient](policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingclient) -- [BITS_DisablePeercachingServer](policy-csp-admx-bits.md#admx-bits-bits-disablepeercachingserver) -- [BITS_MaxContentAge](policy-csp-admx-bits.md#admx-bits-bits-maxcontentage) -- [BITS_MaxCacheSize](policy-csp-admx-bits.md#admx-bits-bits-maxcachesize) -- [BITS_MaxDownloadTime](policy-csp-admx-bits.md#admx-bits-bits-maxdownloadtime) -- [BITS_MaxBandwidthServedForPeers](policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthservedforpeers) -- [BITS_MaxJobsPerUser](policy-csp-admx-bits.md#admx-bits-bits-maxjobsperuser) -- [BITS_MaxJobsPerMachine](policy-csp-admx-bits.md#admx-bits-bits-maxjobspermachine) -- [BITS_MaxFilesPerJob](policy-csp-admx-bits.md#admx-bits-bits-maxfilesperjob) -- [BITS_MaxRangesPerFile](policy-csp-admx-bits.md#admx-bits-bits-maxrangesperfile) -- [BITS_MaxBandwidthV2_Maintenance](policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-maintenance) -- [BITS_MaxBandwidthV2_Work](policy-csp-admx-bits.md#admx-bits-bits-maxbandwidthv2-work) +- [BITS_EnablePeercaching](policy-csp-admx-bits.md) +- [BITS_DisableBranchCache](policy-csp-admx-bits.md) +- [BITS_DisablePeercachingClient](policy-csp-admx-bits.md) +- [BITS_DisablePeercachingServer](policy-csp-admx-bits.md) +- [BITS_MaxContentAge](policy-csp-admx-bits.md) +- [BITS_MaxCacheSize](policy-csp-admx-bits.md) +- [BITS_MaxDownloadTime](policy-csp-admx-bits.md) +- [BITS_MaxBandwidthServedForPeers](policy-csp-admx-bits.md) +- [BITS_MaxJobsPerUser](policy-csp-admx-bits.md) +- [BITS_MaxJobsPerMachine](policy-csp-admx-bits.md) +- [BITS_MaxFilesPerJob](policy-csp-admx-bits.md) +- [BITS_MaxRangesPerFile](policy-csp-admx-bits.md) +- [BITS_MaxBandwidthV2_Maintenance](policy-csp-admx-bits.md) +- [BITS_MaxBandwidthV2_Work](policy-csp-admx-bits.md) ## ADMX_CipherSuiteOrder -- [SSLCurveOrder](policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslcurveorder) -- [SSLCipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md#admx-ciphersuiteorder-sslciphersuiteorder) +- [SSLCurveOrder](policy-csp-admx-ciphersuiteorder.md) +- [SSLCipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md) ## ADMX_COM -- [AppMgmt_COM_SearchForCLSID_1](policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1) -- [AppMgmt_COM_SearchForCLSID_2](policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2) +- [AppMgmt_COM_SearchForCLSID_1](policy-csp-admx-com.md) +- [AppMgmt_COM_SearchForCLSID_2](policy-csp-admx-com.md) ## ADMX_ControlPanel -- [ForceClassicControlPanel](policy-csp-admx-controlpanel.md#admx-controlpanel-forceclassiccontrolpanel) -- [DisallowCpls](policy-csp-admx-controlpanel.md#admx-controlpanel-disallowcpls) -- [NoControlPanel](policy-csp-admx-controlpanel.md#admx-controlpanel-nocontrolpanel) -- [RestrictCpls](policy-csp-admx-controlpanel.md#admx-controlpanel-restrictcpls) +- [ForceClassicControlPanel](policy-csp-admx-controlpanel.md) +- [DisallowCpls](policy-csp-admx-controlpanel.md) +- [NoControlPanel](policy-csp-admx-controlpanel.md) +- [RestrictCpls](policy-csp-admx-controlpanel.md) ## ADMX_ControlPanelDisplay -- [CPL_Display_Disable](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-disable) -- [CPL_Display_HideSettings](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-display-hidesettings) -- [CPL_Personalization_EnableScreenSaver](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-enablescreensaver) -- [CPL_Personalization_SetVisualStyle](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setvisualstyle) -- [CPL_Personalization_SetScreenSaver](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-setscreensaver) -- [CPL_Personalization_SetTheme](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) -- [CPL_Personalization_ScreenSaverIsSecure](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensaverissecure) -- [CPL_Personalization_NoColorAppearanceUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nocolorappearanceui) -- [CPL_Personalization_DisableColorSchemeChoice](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablecolorschemechoice) -- [CPL_Personalization_NoDesktopBackgroundUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopbackgroundui) -- [CPL_Personalization_NoDesktopIconsUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nodesktopiconsui) -- [CPL_Personalization_NoMousePointersUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nomousepointersui) -- [CPL_Personalization_NoScreenSaverUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-noscreensaverui) -- [CPL_Personalization_NoSoundSchemeUI](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nosoundschemeui) -- [CPL_Personalization_DisableThemeChange](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablethemechange) -- [CPL_Personalization_DisableVisualStyle](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-disablevisualstyle) -- [CPL_Personalization_LockFontSize](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-lockfontsize) -- [CPL_Personalization_ScreenSaverTimeOut](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-screensavertimeout) -- [CPL_Personalization_NoLockScreen](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nolockscreen) -- [CPL_Personalization_PersonalColors](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-personalcolors) -- [CPL_Personalization_ForceDefaultLockScreen](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-forcedefaultlockscreen) -- [CPL_Personalization_StartBackground](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-startbackground) -- [CPL_Personalization_SetTheme](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-settheme) -- [CPL_Personalization_NoChangingLockScreen](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochanginglockscreen) -- [CPL_Personalization_NoChangingStartMenuBackground](policy-csp-admx-controlpaneldisplay.md#admx-controlpaneldisplay-cpl-personalization-nochangingstartmenubackground) +- [CPL_Display_Disable](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Display_HideSettings](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_EnableScreenSaver](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_SetVisualStyle](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_SetScreenSaver](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_SetTheme](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_ScreenSaverIsSecure](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoColorAppearanceUI](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_DisableColorSchemeChoice](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoDesktopBackgroundUI](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoDesktopIconsUI](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoMousePointersUI](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoScreenSaverUI](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoSoundSchemeUI](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_DisableThemeChange](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_DisableVisualStyle](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_LockFontSize](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_ScreenSaverTimeOut](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoLockScreen](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_PersonalColors](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_ForceDefaultLockScreen](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_StartBackground](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_SetTheme](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoChangingLockScreen](policy-csp-admx-controlpaneldisplay.md) +- [CPL_Personalization_NoChangingStartMenuBackground](policy-csp-admx-controlpaneldisplay.md) ## ADMX_Cpls -- [UseDefaultTile](policy-csp-admx-cpls.md#admx-cpls-usedefaulttile) +- [UseDefaultTile](policy-csp-admx-cpls.md) ## ADMX_CredentialProviders -- [AllowDomainDelayLock](policy-csp-admx-credentialproviders.md#admx-credentialproviders-allowdomaindelaylock) -- [DefaultCredentialProvider](policy-csp-admx-credentialproviders.md#admx-credentialproviders-defaultcredentialprovider) -- [ExcludedCredentialProviders](policy-csp-admx-credentialproviders.md#admx-credentialproviders-excludedcredentialproviders) +- [AllowDomainDelayLock](policy-csp-admx-credentialproviders.md) +- [DefaultCredentialProvider](policy-csp-admx-credentialproviders.md) +- [ExcludedCredentialProviders](policy-csp-admx-credentialproviders.md) ## ADMX_CredSsp -- [AllowDefaultCredentials](policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials) -- [AllowDefCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly) -- [AllowFreshCredentials](policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentials) -- [AllowFreshCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentialswhenntlmonly) -- [AllowSavedCredentials](policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentials) -- [AllowSavedCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentialswhenntlmonly) -- [DenyDefaultCredentials](policy-csp-admx-credssp.md#admx-credssp-denydefaultcredentials) -- [DenyFreshCredentials](policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials) -- [DenySavedCredentials](policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials) -- [AllowEncryptionOracle](policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle) -- [RestrictedRemoteAdministration](policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration) +- [AllowDefaultCredentials](policy-csp-admx-credssp.md) +- [AllowDefCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md) +- [AllowFreshCredentials](policy-csp-admx-credssp.md) +- [AllowFreshCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md) +- [AllowSavedCredentials](policy-csp-admx-credssp.md) +- [AllowSavedCredentialsWhenNTLMOnly](policy-csp-admx-credssp.md) +- [DenyDefaultCredentials](policy-csp-admx-credssp.md) +- [DenyFreshCredentials](policy-csp-admx-credssp.md) +- [DenySavedCredentials](policy-csp-admx-credssp.md) +- [AllowEncryptionOracle](policy-csp-admx-credssp.md) +- [RestrictedRemoteAdministration](policy-csp-admx-credssp.md) ## ADMX_CredUI -- [NoLocalPasswordResetQuestions](policy-csp-admx-credui.md#admx-credui-nolocalpasswordresetquestions) -- [EnableSecureCredentialPrompting](policy-csp-admx-credui.md#admx-credui-enablesecurecredentialprompting) +- [NoLocalPasswordResetQuestions](policy-csp-admx-credui.md) +- [EnableSecureCredentialPrompting](policy-csp-admx-credui.md) ## ADMX_CtrlAltDel -- [DisableChangePassword](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword) -- [DisableLockComputer](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) -- [NoLogoff](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) -- [DisableTaskMgr](policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) +- [DisableChangePassword](policy-csp-admx-ctrlaltdel.md) +- [DisableLockComputer](policy-csp-admx-ctrlaltdel.md) +- [NoLogoff](policy-csp-admx-ctrlaltdel.md) +- [DisableTaskMgr](policy-csp-admx-ctrlaltdel.md) ## ADMX_DataCollection -- [CommercialIdPolicy](policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) +- [CommercialIdPolicy](policy-csp-admx-datacollection.md) ## ADMX_DCOM -- [DCOMActivationSecurityCheckAllowLocalList](policy-csp-admx-dcom.md#admx-dcom-dcomactivationsecuritycheckallowlocallist) -- [DCOMActivationSecurityCheckExemptionList](policy-csp-admx-dcom.md#admx-dcom-dcomactivationsecuritycheckexemptionlist) +- [DCOMActivationSecurityCheckAllowLocalList](policy-csp-admx-dcom.md) +- [DCOMActivationSecurityCheckExemptionList](policy-csp-admx-dcom.md) ## ADMX_Desktop -- [AD_EnableFilter](policy-csp-admx-desktop.md#admx-desktop-ad-enablefilter) -- [AD_HideDirectoryFolder](policy-csp-admx-desktop.md#admx-desktop-ad-hidedirectoryfolder) -- [AD_QueryLimit](policy-csp-admx-desktop.md#admx-desktop-ad-querylimit) -- [sz_AdminComponents_Title](policy-csp-admx-desktop.md#admx-desktop-sz-admincomponents-title) -- [sz_DWP_NoHTMLPaper](policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) -- [Wallpaper](policy-csp-admx-desktop.md#admx-desktop-wallpaper) -- [NoActiveDesktop](policy-csp-admx-desktop.md#admx-desktop-noactivedesktop) -- [sz_ATC_NoComponents](policy-csp-admx-desktop.md#admx-desktop-sz-atc-nocomponents) -- [ForceActiveDesktopOn](policy-csp-admx-desktop.md#admx-desktop-forceactivedesktopon) -- [sz_ATC_DisableAdd](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableadd) -- [NoActiveDesktopChanges](policy-csp-admx-desktop.md#admx-desktop-noactivedesktopchanges) -- [sz_ATC_DisableClose](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableclose) -- [sz_ATC_DisableDel](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disabledel) -- [sz_ATC_DisableEdit](policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableedit) -- [NoRecentDocsNetHood](policy-csp-admx-desktop.md#admx-desktop-norecentdocsnethood) -- [NoSaveSettings](policy-csp-admx-desktop.md#admx-desktop-nosavesettings) -- [NoDesktop](policy-csp-admx-desktop.md#admx-desktop-nodesktop) -- [NoInternetIcon](policy-csp-admx-desktop.md#admx-desktop-nointerneticon) -- [NoNetHood](policy-csp-admx-desktop.md#admx-desktop-nonethood) -- [sz_DB_DragDropClose](policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) -- [sz_DB_Moving](policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) -- [NoMyComputerIcon](policy-csp-admx-desktop.md#admx-desktop-nomycomputericon) -- [NoMyDocumentsIcon](policy-csp-admx-desktop.md#admx-desktop-nomydocumentsicon) -- [NoPropertiesMyComputer](policy-csp-admx-desktop.md#admx-desktop-nopropertiesmycomputer) -- [NoPropertiesMyDocuments](policy-csp-admx-desktop.md#admx-desktop-nopropertiesmydocuments) -- [NoRecycleBinProperties](policy-csp-admx-desktop.md#admx-desktop-norecyclebinproperties) -- [NoRecycleBinIcon](policy-csp-admx-desktop.md#admx-desktop-norecyclebinicon) -- [NoDesktopCleanupWizard](policy-csp-admx-desktop.md#admx-desktop-nodesktopcleanupwizard) -- [NoWindowMinimizingShortcuts](policy-csp-admx-desktop.md#admx-desktop-nowindowminimizingshortcuts) -- [NoDesktop](policy-csp-admx-desktop.md#admx-desktop-nodesktop) +- [AD_EnableFilter](policy-csp-admx-desktop.md) +- [AD_HideDirectoryFolder](policy-csp-admx-desktop.md) +- [AD_QueryLimit](policy-csp-admx-desktop.md) +- [sz_AdminComponents_Title](policy-csp-admx-desktop.md) +- [sz_DWP_NoHTMLPaper](policy-csp-admx-desktop.md) +- [Wallpaper](policy-csp-admx-desktop.md) +- [NoActiveDesktop](policy-csp-admx-desktop.md) +- [sz_ATC_NoComponents](policy-csp-admx-desktop.md) +- [ForceActiveDesktopOn](policy-csp-admx-desktop.md) +- [sz_ATC_DisableAdd](policy-csp-admx-desktop.md) +- [NoActiveDesktopChanges](policy-csp-admx-desktop.md) +- [sz_ATC_DisableClose](policy-csp-admx-desktop.md) +- [sz_ATC_DisableDel](policy-csp-admx-desktop.md) +- [sz_ATC_DisableEdit](policy-csp-admx-desktop.md) +- [NoRecentDocsNetHood](policy-csp-admx-desktop.md) +- [NoSaveSettings](policy-csp-admx-desktop.md) +- [NoDesktop](policy-csp-admx-desktop.md) +- [NoInternetIcon](policy-csp-admx-desktop.md) +- [NoNetHood](policy-csp-admx-desktop.md) +- [sz_DB_DragDropClose](policy-csp-admx-desktop.md) +- [sz_DB_Moving](policy-csp-admx-desktop.md) +- [NoMyComputerIcon](policy-csp-admx-desktop.md) +- [NoMyDocumentsIcon](policy-csp-admx-desktop.md) +- [NoPropertiesMyComputer](policy-csp-admx-desktop.md) +- [NoPropertiesMyDocuments](policy-csp-admx-desktop.md) +- [NoRecycleBinProperties](policy-csp-admx-desktop.md) +- [NoRecycleBinIcon](policy-csp-admx-desktop.md) +- [NoDesktopCleanupWizard](policy-csp-admx-desktop.md) +- [NoWindowMinimizingShortcuts](policy-csp-admx-desktop.md) +- [NoDesktop](policy-csp-admx-desktop.md) ## ADMX_DeviceCompat -- [DeviceFlags](policy-csp-admx-devicecompat.md#admx-devicecompat-deviceflags) -- [DriverShims](policy-csp-admx-devicecompat.md#admx-devicecompat-drivershims) +- [DeviceFlags](policy-csp-admx-devicecompat.md) +- [DriverShims](policy-csp-admx-devicecompat.md) ## ADMX_DeviceGuard -- [ConfigCIPolicy](policy-csp-admx-deviceguard.md#admx-deviceguard-configcipolicy) +- [ConfigCIPolicy](policy-csp-admx-deviceguard.md) ## ADMX_DeviceInstallation -- [DeviceInstall_InstallTimeout](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) -- [DeviceInstall_AllowAdminInstall](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) -- [DeviceInstall_DeniedPolicy_SimpleText](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) -- [DeviceInstall_DeniedPolicy_DetailText](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) -- [DeviceInstall_Removable_Deny](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) -- [DeviceInstall_Policy_RebootTime](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) -- [DeviceInstall_SystemRestore](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) -- [DriverInstall_Classes_AllowUser](policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-driverinstall-classes-allowuser) +- [DeviceInstall_InstallTimeout](policy-csp-admx-deviceinstallation.md) +- [DeviceInstall_AllowAdminInstall](policy-csp-admx-deviceinstallation.md) +- [DeviceInstall_DeniedPolicy_SimpleText](policy-csp-admx-deviceinstallation.md) +- [DeviceInstall_DeniedPolicy_DetailText](policy-csp-admx-deviceinstallation.md) +- [DeviceInstall_Removable_Deny](policy-csp-admx-deviceinstallation.md) +- [DeviceInstall_Policy_RebootTime](policy-csp-admx-deviceinstallation.md) +- [DeviceInstall_SystemRestore](policy-csp-admx-deviceinstallation.md) +- [DriverInstall_Classes_AllowUser](policy-csp-admx-deviceinstallation.md) ## ADMX_DeviceSetup -- [DriverSearchPlaces_SearchOrderConfiguration](policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) -- [DeviceInstall_BalloonTips](policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) +- [DriverSearchPlaces_SearchOrderConfiguration](policy-csp-admx-devicesetup.md) +- [DeviceInstall_BalloonTips](policy-csp-admx-devicesetup.md) ## ADMX_DFS -- [DFSDiscoverDC](policy-csp-admx-dfs.md#admx-dfs-dfsdiscoverdc) +- [DFSDiscoverDC](policy-csp-admx-dfs.md) ## ADMX_DigitalLocker -- [Digitalx_DiableApplication_TitleText_1](policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) -- [Digitalx_DiableApplication_TitleText_2](policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) +- [Digitalx_DiableApplication_TitleText_1](policy-csp-admx-digitallocker.md) +- [Digitalx_DiableApplication_TitleText_2](policy-csp-admx-digitallocker.md) ## ADMX_DiskDiagnostic -- [DfdAlertPolicy](policy-csp-admx-diskdiagnostic.md#admx-diskdiagnostic-dfdalertpolicy) -- [WdiScenarioExecutionPolicy](policy-csp-admx-diskdiagnostic.md#admx-diskdiagnostic-wdiscenarioexecutionpolicy) +- [DfdAlertPolicy](policy-csp-admx-diskdiagnostic.md) +- [WdiScenarioExecutionPolicy](policy-csp-admx-diskdiagnostic.md) ## ADMX_DiskNVCache -- [BootResumePolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-bootresumepolicy) -- [CachePowerModePolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-cachepowermodepolicy) -- [FeatureOffPolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-featureoffpolicy) -- [SolidStatePolicy](policy-csp-admx-disknvcache.md#admx-disknvcache-solidstatepolicy) +- [BootResumePolicy](policy-csp-admx-disknvcache.md) +- [CachePowerModePolicy](policy-csp-admx-disknvcache.md) +- [FeatureOffPolicy](policy-csp-admx-disknvcache.md) +- [SolidStatePolicy](policy-csp-admx-disknvcache.md) ## ADMX_DiskQuota -- [DQ_RemovableMedia](policy-csp-admx-diskquota.md#admx-diskquota-dq-removablemedia) -- [DQ_Enable](policy-csp-admx-diskquota.md#admx-diskquota-dq-enable) -- [DQ_Enforce](policy-csp-admx-diskquota.md#admx-diskquota-dq-enforce) -- [DQ_LogEventOverLimit](policy-csp-admx-diskquota.md#admx-diskquota-dq-logeventoverlimit) -- [DQ_LogEventOverThreshold](policy-csp-admx-diskquota.md#admx-diskquota-dq-logeventoverthreshold) -- [DQ_Limit](policy-csp-admx-diskquota.md#admx-diskquota-dq-limit) +- [DQ_RemovableMedia](policy-csp-admx-diskquota.md) +- [DQ_Enable](policy-csp-admx-diskquota.md) +- [DQ_Enforce](policy-csp-admx-diskquota.md) +- [DQ_LogEventOverLimit](policy-csp-admx-diskquota.md) +- [DQ_LogEventOverThreshold](policy-csp-admx-diskquota.md) +- [DQ_Limit](policy-csp-admx-diskquota.md) ## ADMX_DistributedLinkTracking -- [DLT_AllowDomainMode](policy-csp-admx-distributedlinktracking.md#admx-distributedlinktracking-dlt-allowdomainmode) +- [DLT_AllowDomainMode](policy-csp-admx-distributedlinktracking.md) ## ADMX_DnsClient -- [DNS_AppendToMultiLabelName](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-appendtomultilabelname) -- [DNS_AllowFQDNNetBiosQueries](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) -- [DNS_Domain](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domain) -- [DNS_NameServer](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-nameserver) -- [DNS_SearchList](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-searchlist) -- [DNS_RegistrationEnabled](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationenabled) -- [DNS_IdnMapping](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnmapping) -- [DNS_PreferLocalResponsesOverLowerOrderDns](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-preferlocalresponsesoverlowerorderdns) -- [DNS_PrimaryDnsSuffix](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-primarydnssuffix) -- [DNS_UseDomainNameDevolution](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-usedomainnamedevolution) -- [DNS_DomainNameDevolutionLevel](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-domainnamedevolutionlevel) -- [DNS_RegisterAdapterName](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registeradaptername) -- [DNS_RegisterReverseLookup](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registerreverselookup) -- [DNS_RegistrationRefreshInterval](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationrefreshinterval) -- [DNS_RegistrationOverwritesInConflict](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationoverwritesinconflict) -- [DNS_RegistrationTtl](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-registrationttl) -- [DNS_IdnEncoding](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-idnencoding) -- [Turn_Off_Multicast](policy-csp-admx-dnsclient.md#admx-dnsclient-turn-off-multicast) -- [DNS_SmartMultiHomedNameResolution](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartmultihomednameresolution) -- [DNS_SmartProtocolReorder](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-smartprotocolreorder) -- [DNS_UpdateSecurityLevel](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatesecuritylevel) -- [DNS_UpdateTopLevelDomainZones](policy-csp-admx-dnsclient.md#admx-dnsclient-dns-updatetopleveldomainzones) +- [DNS_AppendToMultiLabelName](policy-csp-admx-dnsclient.md) +- [DNS_AllowFQDNNetBiosQueries](policy-csp-admx-dnsclient.md) +- [DNS_Domain](policy-csp-admx-dnsclient.md) +- [DNS_NameServer](policy-csp-admx-dnsclient.md) +- [DNS_SearchList](policy-csp-admx-dnsclient.md) +- [DNS_RegistrationEnabled](policy-csp-admx-dnsclient.md) +- [DNS_IdnMapping](policy-csp-admx-dnsclient.md) +- [DNS_PreferLocalResponsesOverLowerOrderDns](policy-csp-admx-dnsclient.md) +- [DNS_PrimaryDnsSuffix](policy-csp-admx-dnsclient.md) +- [DNS_UseDomainNameDevolution](policy-csp-admx-dnsclient.md) +- [DNS_DomainNameDevolutionLevel](policy-csp-admx-dnsclient.md) +- [DNS_RegisterAdapterName](policy-csp-admx-dnsclient.md) +- [DNS_RegisterReverseLookup](policy-csp-admx-dnsclient.md) +- [DNS_RegistrationRefreshInterval](policy-csp-admx-dnsclient.md) +- [DNS_RegistrationOverwritesInConflict](policy-csp-admx-dnsclient.md) +- [DNS_RegistrationTtl](policy-csp-admx-dnsclient.md) +- [DNS_IdnEncoding](policy-csp-admx-dnsclient.md) +- [Turn_Off_Multicast](policy-csp-admx-dnsclient.md) +- [DNS_SmartMultiHomedNameResolution](policy-csp-admx-dnsclient.md) +- [DNS_SmartProtocolReorder](policy-csp-admx-dnsclient.md) +- [DNS_UpdateSecurityLevel](policy-csp-admx-dnsclient.md) +- [DNS_UpdateTopLevelDomainZones](policy-csp-admx-dnsclient.md) ## ADMX_DWM -- [DwmDisallowAnimations_1](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-1) -- [DwmDisallowColorizationColorChanges_1](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-1) -- [DwmDefaultColorizationColor_1](policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-1) -- [DwmDisallowAnimations_2](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-2) -- [DwmDisallowColorizationColorChanges_2](policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-2) -- [DwmDefaultColorizationColor_2](policy-csp-admx-dwm.md#admx-dwm-dwmdefaultcolorizationcolor-2) +- [DwmDisallowAnimations_1](policy-csp-admx-dwm.md) +- [DwmDisallowColorizationColorChanges_1](policy-csp-admx-dwm.md) +- [DwmDefaultColorizationColor_1](policy-csp-admx-dwm.md) +- [DwmDisallowAnimations_2](policy-csp-admx-dwm.md) +- [DwmDisallowColorizationColorChanges_2](policy-csp-admx-dwm.md) +- [DwmDefaultColorizationColor_2](policy-csp-admx-dwm.md) ## ADMX_EAIME -- [L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](policy-csp-admx-eaime.md#admx-eaime-l-donotincludenonpublishingstandardglyphinthecandidatelist) -- [L_RestrictCharacterCodeRangeOfConversion](policy-csp-admx-eaime.md#admx-eaime-l-restrictcharactercoderangeofconversion) -- [L_TurnOffCustomDictionary](policy-csp-admx-eaime.md#admx-eaime-l-turnoffcustomdictionary) -- [L_TurnOffHistorybasedPredictiveInput](policy-csp-admx-eaime.md#admx-eaime-l-turnoffhistorybasedpredictiveinput) -- [L_TurnOffInternetSearchIntegration](policy-csp-admx-eaime.md#admx-eaime-l-turnoffinternetsearchintegration) -- [L_TurnOffOpenExtendedDictionary](policy-csp-admx-eaime.md#admx-eaime-l-turnoffopenextendeddictionary) -- [L_TurnOffSavingAutoTuningDataToFile](policy-csp-admx-eaime.md#admx-eaime-l-turnoffsavingautotuningdatatofile) -- [L_TurnOnCloudCandidate](policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidate) -- [L_TurnOnCloudCandidateCHS](policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidatechs) -- [L_TurnOnLexiconUpdate](policy-csp-admx-eaime.md#admx-eaime-l-turnonlexiconupdate) -- [L_TurnOnLiveStickers](policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) -- [L_TurnOnMisconversionLoggingForMisconversionReport](policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) +- [L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](policy-csp-admx-eaime.md) +- [L_RestrictCharacterCodeRangeOfConversion](policy-csp-admx-eaime.md) +- [L_TurnOffCustomDictionary](policy-csp-admx-eaime.md) +- [L_TurnOffHistorybasedPredictiveInput](policy-csp-admx-eaime.md) +- [L_TurnOffInternetSearchIntegration](policy-csp-admx-eaime.md) +- [L_TurnOffOpenExtendedDictionary](policy-csp-admx-eaime.md) +- [L_TurnOffSavingAutoTuningDataToFile](policy-csp-admx-eaime.md) +- [L_TurnOnCloudCandidate](policy-csp-admx-eaime.md) +- [L_TurnOnCloudCandidateCHS](policy-csp-admx-eaime.md) +- [L_TurnOnLexiconUpdate](policy-csp-admx-eaime.md) +- [L_TurnOnLiveStickers](policy-csp-admx-eaime.md) +- [L_TurnOnMisconversionLoggingForMisconversionReport](policy-csp-admx-eaime.md) ## ADMX_EncryptFilesonMove -- [NoEncryptOnMove](policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) +- [NoEncryptOnMove](policy-csp-admx-encryptfilesonmove.md) ## ADMX_EnhancedStorage -- [RootHubConnectedEnStorDevices](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) -- [ApprovedEnStorDevices](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedenstordevices) -- [ApprovedSilos](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedsilos) -- [DisallowLegacyDiskDevices](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) -- [DisablePasswordAuthentication](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disablepasswordauthentication) -- [LockDeviceOnMachineLock](policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) +- [RootHubConnectedEnStorDevices](policy-csp-admx-enhancedstorage.md) +- [ApprovedEnStorDevices](policy-csp-admx-enhancedstorage.md) +- [ApprovedSilos](policy-csp-admx-enhancedstorage.md) +- [DisallowLegacyDiskDevices](policy-csp-admx-enhancedstorage.md) +- [DisablePasswordAuthentication](policy-csp-admx-enhancedstorage.md) +- [LockDeviceOnMachineLock](policy-csp-admx-enhancedstorage.md) ## ADMX_ErrorReporting -- [WerArchive_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-1) -- [WerQueue_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-1) -- [WerExlusion_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-1) -- [WerAutoApproveOSDumps_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-1) -- [WerDefaultConsent_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-1) -- [WerConsentCustomize_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentcustomize-1) -- [WerConsentOverride_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-1) -- [WerNoLogging_1](policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-1) -- [WerDisable_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werdisable-1) -- [WerNoSecondLevelData_1](policy-csp-admx-errorreporting.md#admx-errorreporting-wernosecondleveldata-1) -- [WerBypassDataThrottling_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-1) -- [WerBypassPowerThrottling_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-1) -- [WerBypassNetworkCostThrottling_1](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-1) -- [WerCER](policy-csp-admx-errorreporting.md#admx-errorreporting-wercer) -- [WerArchive_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-2) -- [WerQueue_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) -- [PCH_AllOrNoneDef](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornonedef) -- [PCH_AllOrNoneInc](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneinc) -- [WerExlusion_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-2) -- [PCH_AllOrNoneEx](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneex) -- [PCH_ReportOperatingSystemFaults](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-reportoperatingsystemfaults) -- [WerAutoApproveOSDumps_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-2) -- [PCH_ConfigureReport](policy-csp-admx-errorreporting.md#admx-errorreporting-pch-configurereport) -- [WerDefaultConsent_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-2) -- [WerConsentOverride_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-2) -- [WerNoLogging_2](policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-2) -- [WerBypassDataThrottling_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-2) -- [WerBypassPowerThrottling_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-2) -- [WerBypassNetworkCostThrottling_2](policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-2) +- [WerArchive_1](policy-csp-admx-errorreporting.md) +- [WerQueue_1](policy-csp-admx-errorreporting.md) +- [WerExlusion_1](policy-csp-admx-errorreporting.md) +- [WerAutoApproveOSDumps_1](policy-csp-admx-errorreporting.md) +- [WerDefaultConsent_1](policy-csp-admx-errorreporting.md) +- [WerConsentCustomize_1](policy-csp-admx-errorreporting.md) +- [WerConsentOverride_1](policy-csp-admx-errorreporting.md) +- [WerNoLogging_1](policy-csp-admx-errorreporting.md) +- [WerDisable_1](policy-csp-admx-errorreporting.md) +- [WerNoSecondLevelData_1](policy-csp-admx-errorreporting.md) +- [WerBypassDataThrottling_1](policy-csp-admx-errorreporting.md) +- [WerBypassPowerThrottling_1](policy-csp-admx-errorreporting.md) +- [WerBypassNetworkCostThrottling_1](policy-csp-admx-errorreporting.md) +- [WerCER](policy-csp-admx-errorreporting.md) +- [WerArchive_2](policy-csp-admx-errorreporting.md) +- [WerQueue_2](policy-csp-admx-errorreporting.md) +- [PCH_AllOrNoneDef](policy-csp-admx-errorreporting.md) +- [PCH_AllOrNoneInc](policy-csp-admx-errorreporting.md) +- [WerExlusion_2](policy-csp-admx-errorreporting.md) +- [PCH_AllOrNoneEx](policy-csp-admx-errorreporting.md) +- [PCH_ReportOperatingSystemFaults](policy-csp-admx-errorreporting.md) +- [WerAutoApproveOSDumps_2](policy-csp-admx-errorreporting.md) +- [PCH_ConfigureReport](policy-csp-admx-errorreporting.md) +- [WerDefaultConsent_2](policy-csp-admx-errorreporting.md) +- [WerConsentOverride_2](policy-csp-admx-errorreporting.md) +- [WerNoLogging_2](policy-csp-admx-errorreporting.md) +- [WerBypassDataThrottling_2](policy-csp-admx-errorreporting.md) +- [WerBypassPowerThrottling_2](policy-csp-admx-errorreporting.md) +- [WerBypassNetworkCostThrottling_2](policy-csp-admx-errorreporting.md) ## ADMX_EventForwarding -- [ForwarderResourceUsage](policy-csp-admx-eventforwarding.md#admx-eventforwarding-forwarderresourceusage) -- [SubscriptionManager](policy-csp-admx-eventforwarding.md#admx-eventforwarding-subscriptionmanager) +- [ForwarderResourceUsage](policy-csp-admx-eventforwarding.md) +- [SubscriptionManager](policy-csp-admx-eventforwarding.md) ## ADMX_EventLog -- [Channel_Log_AutoBackup_1](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-1) -- [Channel_Log_FileLogAccess_1](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-1) -- [Channel_Log_FileLogAccess_5](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-5) -- [Channel_LogFilePath_1](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-1) -- [Channel_Log_AutoBackup_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-2) -- [Channel_Log_FileLogAccess_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-2) -- [Channel_Log_FileLogAccess_6](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-6) -- [Channel_Log_Retention_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-2) -- [Channel_LogFilePath_2](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-2) -- [Channel_Log_AutoBackup_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-3) -- [Channel_Log_FileLogAccess_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-3) -- [Channel_Log_FileLogAccess_7](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-7) -- [Channel_Log_Retention_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-3) -- [Channel_LogFilePath_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-3) -- [Channel_LogMaxSize_3](policy-csp-admx-eventlog.md#admx-eventlog-channel-logmaxsize-3) -- [Channel_LogEnabled](policy-csp-admx-eventlog.md#admx-eventlog-channel-logenabled) -- [Channel_Log_AutoBackup_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-4) -- [Channel_Log_FileLogAccess_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-4) -- [Channel_Log_FileLogAccess_8](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-8) -- [Channel_Log_Retention_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-4) -- [Channel_LogFilePath_4](policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-4) +- [Channel_Log_AutoBackup_1](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_1](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_5](policy-csp-admx-eventlog.md) +- [Channel_LogFilePath_1](policy-csp-admx-eventlog.md) +- [Channel_Log_AutoBackup_2](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_2](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_6](policy-csp-admx-eventlog.md) +- [Channel_Log_Retention_2](policy-csp-admx-eventlog.md) +- [Channel_LogFilePath_2](policy-csp-admx-eventlog.md) +- [Channel_Log_AutoBackup_3](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_3](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_7](policy-csp-admx-eventlog.md) +- [Channel_Log_Retention_3](policy-csp-admx-eventlog.md) +- [Channel_LogFilePath_3](policy-csp-admx-eventlog.md) +- [Channel_LogMaxSize_3](policy-csp-admx-eventlog.md) +- [Channel_LogEnabled](policy-csp-admx-eventlog.md) +- [Channel_Log_AutoBackup_4](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_4](policy-csp-admx-eventlog.md) +- [Channel_Log_FileLogAccess_8](policy-csp-admx-eventlog.md) +- [Channel_Log_Retention_4](policy-csp-admx-eventlog.md) +- [Channel_LogFilePath_4](policy-csp-admx-eventlog.md) ## ADMX_EventLogging -- [EnableProtectedEventLogging](policy-csp-admx-eventlogging.md#admx-eventlogging-enableprotectedeventlogging) +- [EnableProtectedEventLogging](policy-csp-admx-eventlogging.md) ## ADMX_EventViewer -- [EventViewer_RedirectionProgram](policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer-redirectionprogram) -- [EventViewer_RedirectionProgramCommandLineParameters](policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer-redirectionprogramcommandlineparameters) -- [EventViewer_RedirectionURL](policy-csp-admx-eventviewer.md#admx-eventviewer-eventviewer-redirectionurl) +- [EventViewer_RedirectionProgram](policy-csp-admx-eventviewer.md) +- [EventViewer_RedirectionProgramCommandLineParameters](policy-csp-admx-eventviewer.md) +- [EventViewer_RedirectionURL](policy-csp-admx-eventviewer.md) ## ADMX_Explorer -- [AlwaysShowClassicMenu](policy-csp-admx-explorer.md#admx-explorer-alwaysshowclassicmenu) -- [PreventItemCreationInUsersFilesFolder](policy-csp-admx-explorer.md#admx-explorer-preventitemcreationinusersfilesfolder) -- [TurnOffSPIAnimations](policy-csp-admx-explorer.md#admx-explorer-turnoffspianimations) -- [DisableRoamedProfileInit](policy-csp-admx-explorer.md#admx-explorer-disableroamedprofileinit) -- [AdminInfoUrl](policy-csp-admx-explorer.md#admx-explorer-admininfourl) +- [AlwaysShowClassicMenu](policy-csp-admx-explorer.md) +- [PreventItemCreationInUsersFilesFolder](policy-csp-admx-explorer.md) +- [TurnOffSPIAnimations](policy-csp-admx-explorer.md) +- [DisableRoamedProfileInit](policy-csp-admx-explorer.md) +- [AdminInfoUrl](policy-csp-admx-explorer.md) ## ADMX_ExternalBoot -- [PortableOperatingSystem_Hibernate](policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem-hibernate) -- [PortableOperatingSystem_Sleep](policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem-sleep) -- [PortableOperatingSystem_Launcher](policy-csp-admx-externalboot.md#admx-externalboot-portableoperatingsystem-launcher) +- [PortableOperatingSystem_Hibernate](policy-csp-admx-externalboot.md) +- [PortableOperatingSystem_Sleep](policy-csp-admx-externalboot.md) +- [PortableOperatingSystem_Launcher](policy-csp-admx-externalboot.md) ## ADMX_FileRecovery -- [WdiScenarioExecutionPolicy](policy-csp-admx-filerecovery.md#admx-filerecovery-wdiscenarioexecutionpolicy) +- [WdiScenarioExecutionPolicy](policy-csp-admx-filerecovery.md) ## ADMX_FileRevocation -- [DelegatedPackageFamilyNames](policy-csp-admx-filerevocation.md#admx-filerevocation-delegatedpackagefamilynames) +- [DelegatedPackageFamilyNames](policy-csp-admx-filerevocation.md) ## ADMX_FileServerVSSProvider -- [Pol_EncryptProtocol](policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) +- [Pol_EncryptProtocol](policy-csp-admx-fileservervssprovider.md) ## ADMX_FileSys -- [DisableDeleteNotification](policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) -- [LongPathsEnabled](policy-csp-admx-filesys.md#admx-filesys-longpathsenabled) -- [DisableCompression](policy-csp-admx-filesys.md#admx-filesys-disablecompression) -- [DisableEncryption](policy-csp-admx-filesys.md#admx-filesys-disableencryption) -- [TxfDeprecatedFunctionality](policy-csp-admx-filesys.md#admx-filesys-txfdeprecatedfunctionality) -- [EnablePagefileEncryption](policy-csp-admx-filesys.md#admx-filesys-enablepagefileencryption) -- [ShortNameCreationSettings](policy-csp-admx-filesys.md#admx-filesys-shortnamecreationsettings) -- [SymlinkEvaluation](policy-csp-admx-filesys.md#admx-filesys-symlinkevaluation) +- [DisableDeleteNotification](policy-csp-admx-filesys.md) +- [LongPathsEnabled](policy-csp-admx-filesys.md) +- [DisableCompression](policy-csp-admx-filesys.md) +- [DisableEncryption](policy-csp-admx-filesys.md) +- [TxfDeprecatedFunctionality](policy-csp-admx-filesys.md) +- [EnablePagefileEncryption](policy-csp-admx-filesys.md) +- [ShortNameCreationSettings](policy-csp-admx-filesys.md) +- [SymlinkEvaluation](policy-csp-admx-filesys.md) ## ADMX_FolderRedirection -- [DisableFRAdminPin](policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpin) -- [DisableFRAdminPinByFolder](policy-csp-admx-folderredirection.md#admx-folderredirection-disablefradminpinbyfolder) -- [FolderRedirectionEnableCacheRename](policy-csp-admx-folderredirection.md#admx-folderredirection-folderredirectionenablecacherename) -- [PrimaryComputer_FR_1](policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) -- [LocalizeXPRelativePaths_1](policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-1) -- [PrimaryComputer_FR_2](policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) -- [LocalizeXPRelativePaths_2](policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) +- [DisableFRAdminPin](policy-csp-admx-folderredirection.md) +- [DisableFRAdminPinByFolder](policy-csp-admx-folderredirection.md) +- [FolderRedirectionEnableCacheRename](policy-csp-admx-folderredirection.md) +- [PrimaryComputer_FR_1](policy-csp-admx-folderredirection.md) +- [LocalizeXPRelativePaths_1](policy-csp-admx-folderredirection.md) +- [PrimaryComputer_FR_2](policy-csp-admx-folderredirection.md) +- [LocalizeXPRelativePaths_2](policy-csp-admx-folderredirection.md) ## ADMX_FramePanes -- [NoReadingPane](policy-csp-admx-framepanes.md#admx-framepanes-noreadingpane) -- [NoPreviewPane](policy-csp-admx-framepanes.md#admx-framepanes-nopreviewpane) +- [NoReadingPane](policy-csp-admx-framepanes.md) +- [NoPreviewPane](policy-csp-admx-framepanes.md) ## ADMX_fthsvc -- [WdiScenarioExecutionPolicy](policy-csp-admx-fthsvc.md#admx-fthsvc-wdiscenarioexecutionpolicy) +- [WdiScenarioExecutionPolicy](policy-csp-admx-fthsvc.md) ## ADMX_Globalization -- [ImplicitDataCollectionOff_1](policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-1) -- [HideAdminOptions](policy-csp-admx-globalization.md#admx-globalization-hideadminoptions) -- [HideCurrentLocation](policy-csp-admx-globalization.md#admx-globalization-hidecurrentlocation) -- [HideLanguageSelection](policy-csp-admx-globalization.md#admx-globalization-hidelanguageselection) -- [HideLocaleSelectAndCustomize](policy-csp-admx-globalization.md#admx-globalization-hidelocaleselectandcustomize) -- [RestrictUILangSelect](policy-csp-admx-globalization.md#admx-globalization-restrictuilangselect) -- [LockUserUILanguage](policy-csp-admx-globalization.md#admx-globalization-lockuseruilanguage) -- [TurnOffAutocorrectMisspelledWords](policy-csp-admx-globalization.md#admx-globalization-turnoffautocorrectmisspelledwords) -- [TurnOffHighlightMisspelledWords](policy-csp-admx-globalization.md#admx-globalization-turnoffhighlightmisspelledwords) -- [TurnOffInsertSpace](policy-csp-admx-globalization.md#admx-globalization-turnoffinsertspace) -- [TurnOffOfferTextPredictions](policy-csp-admx-globalization.md#admx-globalization-turnoffoffertextpredictions) -- [Y2K](policy-csp-admx-globalization.md#admx-globalization-y2k) -- [PreventGeoIdChange_1](policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-1) -- [CustomLocalesNoSelect_1](policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1) -- [PreventUserOverrides_1](policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-1) -- [LocaleUserRestrict_1](policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-1) -- [ImplicitDataCollectionOff_2](policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-2) -- [LockMachineUILanguage](policy-csp-admx-globalization.md#admx-globalization-lockmachineuilanguage) -- [PreventGeoIdChange_2](policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-2) -- [BlockUserInputMethodsForSignIn](policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin) -- [CustomLocalesNoSelect_2](policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2) -- [PreventUserOverrides_2](policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-2) -- [LocaleSystemRestrict](policy-csp-admx-globalization.md#admx-globalization-localesystemrestrict) -- [LocaleUserRestrict_2](policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-2) +- [ImplicitDataCollectionOff_1](policy-csp-admx-globalization.md) +- [HideAdminOptions](policy-csp-admx-globalization.md) +- [HideCurrentLocation](policy-csp-admx-globalization.md) +- [HideLanguageSelection](policy-csp-admx-globalization.md) +- [HideLocaleSelectAndCustomize](policy-csp-admx-globalization.md) +- [RestrictUILangSelect](policy-csp-admx-globalization.md) +- [LockUserUILanguage](policy-csp-admx-globalization.md) +- [TurnOffAutocorrectMisspelledWords](policy-csp-admx-globalization.md) +- [TurnOffHighlightMisspelledWords](policy-csp-admx-globalization.md) +- [TurnOffInsertSpace](policy-csp-admx-globalization.md) +- [TurnOffOfferTextPredictions](policy-csp-admx-globalization.md) +- [Y2K](policy-csp-admx-globalization.md) +- [PreventGeoIdChange_1](policy-csp-admx-globalization.md) +- [CustomLocalesNoSelect_1](policy-csp-admx-globalization.md) +- [PreventUserOverrides_1](policy-csp-admx-globalization.md) +- [LocaleUserRestrict_1](policy-csp-admx-globalization.md) +- [ImplicitDataCollectionOff_2](policy-csp-admx-globalization.md) +- [LockMachineUILanguage](policy-csp-admx-globalization.md) +- [PreventGeoIdChange_2](policy-csp-admx-globalization.md) +- [BlockUserInputMethodsForSignIn](policy-csp-admx-globalization.md) +- [CustomLocalesNoSelect_2](policy-csp-admx-globalization.md) +- [PreventUserOverrides_2](policy-csp-admx-globalization.md) +- [LocaleSystemRestrict](policy-csp-admx-globalization.md) +- [LocaleUserRestrict_2](policy-csp-admx-globalization.md) ## ADMX_GroupPolicy -- [GPDCOptions](policy-csp-admx-grouppolicy.md#admx-grouppolicy-gpdcoptions) -- [GPTransferRate_1](policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-1) -- [NewGPOLinksDisabled](policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpolinksdisabled) -- [DenyRsopToInteractiveUser_1](policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-1) -- [EnforcePoliciesOnly](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enforcepoliciesonly) -- [NewGPODisplayName](policy-csp-admx-grouppolicy.md#admx-grouppolicy-newgpodisplayname) -- [GroupPolicyRefreshRateUser](policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrateuser) -- [DisableAutoADMUpdate](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableautoadmupdate) -- [ProcessMitigationOptions](policy-csp-admx-grouppolicy.md#admx-grouppolicy-processmitigationoptions) -- [AllowX-ForestPolicy-and-RUP](policy-csp-admx-grouppolicy.md#admx-grouppolicy-allowx-forestpolicy-and-rup) -- [OnlyUseLocalAdminFiles](policy-csp-admx-grouppolicy.md#admx-grouppolicy-onlyuselocaladminfiles) -- [SlowlinkDefaultToAsync](policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaulttoasync) -- [SlowLinkDefaultForDirectAccess](policy-csp-admx-grouppolicy.md#admx-grouppolicy-slowlinkdefaultfordirectaccess) -- [CSE_DiskQuota](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-diskquota) -- [CSE_EFSRecovery](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-efsrecovery) -- [CSE_FolderRedirection](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-folderredirection) -- [EnableLogonOptimization](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimization) -- [GPTransferRate_2](policy-csp-admx-grouppolicy.md#admx-grouppolicy-gptransferrate-2) -- [CSE_IEM](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-iem) -- [CSE_IPSecurity](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-ipsecurity) -- [LogonScriptDelay](policy-csp-admx-grouppolicy.md#admx-grouppolicy-logonscriptdelay) -- [CSE_Registry](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-registry) -- [CSE_Scripts](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-scripts) -- [CSE_Security](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-security) -- [CSE_AppMgmt](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-appmgmt) -- [UserPolicyMode](policy-csp-admx-grouppolicy.md#admx-grouppolicy-userpolicymode) -- [CSE_Wired](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wired) -- [CSE_Wireless](policy-csp-admx-grouppolicy.md#admx-grouppolicy-cse-wireless) -- [EnableCDP](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablecdp) -- [DenyRsopToInteractiveUser_2](policy-csp-admx-grouppolicy.md#admx-grouppolicy-denyrsoptointeractiveuser-2) -- [ResetDfsClientInfoDuringRefreshPolicy](policy-csp-admx-grouppolicy.md#admx-grouppolicy-resetdfsclientinfoduringrefreshpolicy) -- [EnableLogonOptimizationOnServerSKU](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablelogonoptimizationonserversku) -- [EnableMMX](policy-csp-admx-grouppolicy.md#admx-grouppolicy-enablemmx) -- [DisableUsersFromMachGP](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableusersfrommachgp) -- [GroupPolicyRefreshRate](policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshrate) -- [GroupPolicyRefreshRateDC](policy-csp-admx-grouppolicy.md#admx-grouppolicy-grouppolicyrefreshratedc) -- [SyncWaitTime](policy-csp-admx-grouppolicy.md#admx-grouppolicy-syncwaittime) -- [CorpConnSyncWaitTime](policy-csp-admx-grouppolicy.md#admx-grouppolicy-corpconnsyncwaittime) -- [DisableBackgroundPolicy](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablebackgroundpolicy) -- [DisableAOACProcessing](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disableaoacprocessing) -- [DisableLGPOProcessing](policy-csp-admx-grouppolicy.md#admx-grouppolicy-disablelgpoprocessing) -- [RSoPLogging](policy-csp-admx-grouppolicy.md#admx-grouppolicy-rsoplogging) -- [ProcessMitigationOptions](policy-csp-admx-grouppolicy.md#admx-grouppolicy-processmitigationoptions) -- [FontMitigation](policy-csp-admx-grouppolicy.md#admx-grouppolicy-fontmitigation) +- [GPDCOptions](policy-csp-admx-grouppolicy.md) +- [GPTransferRate_1](policy-csp-admx-grouppolicy.md) +- [NewGPOLinksDisabled](policy-csp-admx-grouppolicy.md) +- [DenyRsopToInteractiveUser_1](policy-csp-admx-grouppolicy.md) +- [EnforcePoliciesOnly](policy-csp-admx-grouppolicy.md) +- [NewGPODisplayName](policy-csp-admx-grouppolicy.md) +- [GroupPolicyRefreshRateUser](policy-csp-admx-grouppolicy.md) +- [DisableAutoADMUpdate](policy-csp-admx-grouppolicy.md) +- [ProcessMitigationOptions](policy-csp-admx-grouppolicy.md) +- [AllowX-ForestPolicy-and-RUP](policy-csp-admx-grouppolicy.md) +- [OnlyUseLocalAdminFiles](policy-csp-admx-grouppolicy.md) +- [SlowlinkDefaultToAsync](policy-csp-admx-grouppolicy.md) +- [SlowLinkDefaultForDirectAccess](policy-csp-admx-grouppolicy.md) +- [CSE_DiskQuota](policy-csp-admx-grouppolicy.md) +- [CSE_EFSRecovery](policy-csp-admx-grouppolicy.md) +- [CSE_FolderRedirection](policy-csp-admx-grouppolicy.md) +- [EnableLogonOptimization](policy-csp-admx-grouppolicy.md) +- [GPTransferRate_2](policy-csp-admx-grouppolicy.md) +- [CSE_IEM](policy-csp-admx-grouppolicy.md) +- [CSE_IPSecurity](policy-csp-admx-grouppolicy.md) +- [LogonScriptDelay](policy-csp-admx-grouppolicy.md) +- [CSE_Registry](policy-csp-admx-grouppolicy.md) +- [CSE_Scripts](policy-csp-admx-grouppolicy.md) +- [CSE_Security](policy-csp-admx-grouppolicy.md) +- [CSE_AppMgmt](policy-csp-admx-grouppolicy.md) +- [UserPolicyMode](policy-csp-admx-grouppolicy.md) +- [CSE_Wired](policy-csp-admx-grouppolicy.md) +- [CSE_Wireless](policy-csp-admx-grouppolicy.md) +- [EnableCDP](policy-csp-admx-grouppolicy.md) +- [DenyRsopToInteractiveUser_2](policy-csp-admx-grouppolicy.md) +- [ResetDfsClientInfoDuringRefreshPolicy](policy-csp-admx-grouppolicy.md) +- [EnableLogonOptimizationOnServerSKU](policy-csp-admx-grouppolicy.md) +- [EnableMMX](policy-csp-admx-grouppolicy.md) +- [DisableUsersFromMachGP](policy-csp-admx-grouppolicy.md) +- [GroupPolicyRefreshRate](policy-csp-admx-grouppolicy.md) +- [GroupPolicyRefreshRateDC](policy-csp-admx-grouppolicy.md) +- [SyncWaitTime](policy-csp-admx-grouppolicy.md) +- [CorpConnSyncWaitTime](policy-csp-admx-grouppolicy.md) +- [DisableBackgroundPolicy](policy-csp-admx-grouppolicy.md) +- [DisableAOACProcessing](policy-csp-admx-grouppolicy.md) +- [DisableLGPOProcessing](policy-csp-admx-grouppolicy.md) +- [RSoPLogging](policy-csp-admx-grouppolicy.md) +- [ProcessMitigationOptions](policy-csp-admx-grouppolicy.md) +- [FontMitigation](policy-csp-admx-grouppolicy.md) ## ADMX_Help -- [RestrictRunFromHelp](policy-csp-admx-help.md#admx-help-restrictrunfromhelp) -- [HelpQualifiedRootDir_Comp](policy-csp-admx-help.md#admx-help-helpqualifiedrootdir-comp) -- [RestrictRunFromHelp_Comp](policy-csp-admx-help.md#admx-help-restrictrunfromhelp-comp) -- [DisableHHDEP](policy-csp-admx-help.md#admx-help-disablehhdep) +- [RestrictRunFromHelp](policy-csp-admx-help.md) +- [HelpQualifiedRootDir_Comp](policy-csp-admx-help.md) +- [RestrictRunFromHelp_Comp](policy-csp-admx-help.md) +- [DisableHHDEP](policy-csp-admx-help.md) ## ADMX_HelpAndSupport -- [HPImplicitFeedback](policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpimplicitfeedback) -- [HPExplicitFeedback](policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpexplicitfeedback) -- [HPOnlineAssistance](policy-csp-admx-helpandsupport.md#admx-helpandsupport-hponlineassistance) -- [ActiveHelp](policy-csp-admx-helpandsupport.md#admx-helpandsupport-activehelp) +- [HPImplicitFeedback](policy-csp-admx-helpandsupport.md) +- [HPExplicitFeedback](policy-csp-admx-helpandsupport.md) +- [HPOnlineAssistance](policy-csp-admx-helpandsupport.md) +- [ActiveHelp](policy-csp-admx-helpandsupport.md) ## ADMX_hotspotauth -- [HotspotAuth_Enable](policy-csp-admx-hotspotauth.md#admx-hotspotauth-hotspotauth-enable) +- [HotspotAuth_Enable](policy-csp-admx-hotspotauth.md) ## ADMX_ICM -- [ShellNoUseStoreOpenWith_1](policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-1) -- [DisableWebPnPDownload_1](policy-csp-admx-icm.md#admx-icm-disablewebpnpdownload-1) -- [ShellPreventWPWDownload_1](policy-csp-admx-icm.md#admx-icm-shellpreventwpwdownload-1) -- [ShellNoUseInternetOpenWith_1](policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-1) -- [DisableHTTPPrinting_1](policy-csp-admx-icm.md#admx-icm-disablehttpprinting-1) -- [ShellRemoveOrderPrints_1](policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-1) -- [ShellRemovePublishToWeb_1](policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-1) -- [WinMSG_NoInstrumentation_1](policy-csp-admx-icm.md#admx-icm-winmsg-noinstrumentation-1) -- [InternetManagement_RestrictCommunication_1](policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-1) -- [RemoveWindowsUpdate_ICM](policy-csp-admx-icm.md#admx-icm-removewindowsupdate-icm) -- [ShellNoUseStoreOpenWith_2](policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-2) -- [CertMgr_DisableAutoRootUpdates](policy-csp-admx-icm.md#admx-icm-certmgr-disableautorootupdates) -- [EventViewer_DisableLinks](policy-csp-admx-icm.md#admx-icm-eventviewer-disablelinks) -- [HSS_HeadlinesPolicy](policy-csp-admx-icm.md#admx-icm-hss-headlinespolicy) -- [HSS_KBSearchPolicy](policy-csp-admx-icm.md#admx-icm-hss-kbsearchpolicy) -- [NC_ExitOnISP](policy-csp-admx-icm.md#admx-icm-nc-exitonisp) -- [ShellNoUseInternetOpenWith_2](policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-2) -- [NC_NoRegistration](policy-csp-admx-icm.md#admx-icm-nc-noregistration) -- [SearchCompanion_DisableFileUpdates](policy-csp-admx-icm.md#admx-icm-searchcompanion-disablefileupdates) -- [ShellRemoveOrderPrints_2](policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-2) -- [ShellRemovePublishToWeb_2](policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-2) -- [WinMSG_NoInstrumentation_2](policy-csp-admx-icm.md#admx-icm-winmsg-noinstrumentation-2) -- [CEIPEnable](policy-csp-admx-icm.md#admx-icm-ceipenable) -- [PCH_DoNotReport](policy-csp-admx-icm.md#admx-icm-pch-donotreport) -- [DriverSearchPlaces_DontSearchWindowsUpdate](policy-csp-admx-icm.md#admx-icm-driversearchplaces-dontsearchwindowsupdate) -- [InternetManagement_RestrictCommunication_2](policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-2) +- [ShellNoUseStoreOpenWith_1](policy-csp-admx-icm.md) +- [DisableWebPnPDownload_1](policy-csp-admx-icm.md) +- [ShellPreventWPWDownload_1](policy-csp-admx-icm.md) +- [ShellNoUseInternetOpenWith_1](policy-csp-admx-icm.md) +- [DisableHTTPPrinting_1](policy-csp-admx-icm.md) +- [ShellRemoveOrderPrints_1](policy-csp-admx-icm.md) +- [ShellRemovePublishToWeb_1](policy-csp-admx-icm.md) +- [WinMSG_NoInstrumentation_1](policy-csp-admx-icm.md) +- [InternetManagement_RestrictCommunication_1](policy-csp-admx-icm.md) +- [RemoveWindowsUpdate_ICM](policy-csp-admx-icm.md) +- [ShellNoUseStoreOpenWith_2](policy-csp-admx-icm.md) +- [CertMgr_DisableAutoRootUpdates](policy-csp-admx-icm.md) +- [EventViewer_DisableLinks](policy-csp-admx-icm.md) +- [HSS_HeadlinesPolicy](policy-csp-admx-icm.md) +- [HSS_KBSearchPolicy](policy-csp-admx-icm.md) +- [NC_ExitOnISP](policy-csp-admx-icm.md) +- [ShellNoUseInternetOpenWith_2](policy-csp-admx-icm.md) +- [NC_NoRegistration](policy-csp-admx-icm.md) +- [SearchCompanion_DisableFileUpdates](policy-csp-admx-icm.md) +- [ShellRemoveOrderPrints_2](policy-csp-admx-icm.md) +- [ShellRemovePublishToWeb_2](policy-csp-admx-icm.md) +- [WinMSG_NoInstrumentation_2](policy-csp-admx-icm.md) +- [CEIPEnable](policy-csp-admx-icm.md) +- [PCH_DoNotReport](policy-csp-admx-icm.md) +- [DriverSearchPlaces_DontSearchWindowsUpdate](policy-csp-admx-icm.md) +- [InternetManagement_RestrictCommunication_2](policy-csp-admx-icm.md) ## ADMX_IIS -- [PreventIISInstall](policy-csp-admx-iis.md#admx-iis-preventiisinstall) +- [PreventIISInstall](policy-csp-admx-iis.md) ## ADMX_iSCSI -- [iSCSIGeneral_RestrictAdditionalLogins](policy-csp-admx-iscsi.md#admx-iscsi-iscsigeneral-restrictadditionallogins) -- [iSCSIGeneral_ChangeIQNName](policy-csp-admx-iscsi.md#admx-iscsi-iscsigeneral-changeiqnname) -- [iSCSISecurity_ChangeCHAPSecret](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-changechapsecret) -- [iSCSISecurity_RequireIPSec](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-requireipsec) -- [iSCSISecurity_RequireMutualCHAP](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-requiremutualchap) -- [iSCSISecurity_RequireOneWayCHAP](policy-csp-admx-iscsi.md#admx-iscsi-iscsisecurity-requireonewaychap) -- [iSCSIDiscovery_NewStaticTargets](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-newstatictargets) -- [iSCSIDiscovery_ConfigureTargets](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-configuretargets) -- [iSCSIDiscovery_ConfigureiSNSServers](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-configureisnsservers) -- [iSCSIDiscovery_ConfigureTargetPortals](policy-csp-admx-iscsi.md#admx-iscsi-iscsidiscovery-configuretargetportals) +- [iSCSIGeneral_RestrictAdditionalLogins](policy-csp-admx-iscsi.md) +- [iSCSIGeneral_ChangeIQNName](policy-csp-admx-iscsi.md) +- [iSCSISecurity_ChangeCHAPSecret](policy-csp-admx-iscsi.md) +- [iSCSISecurity_RequireIPSec](policy-csp-admx-iscsi.md) +- [iSCSISecurity_RequireMutualCHAP](policy-csp-admx-iscsi.md) +- [iSCSISecurity_RequireOneWayCHAP](policy-csp-admx-iscsi.md) +- [iSCSIDiscovery_NewStaticTargets](policy-csp-admx-iscsi.md) +- [iSCSIDiscovery_ConfigureTargets](policy-csp-admx-iscsi.md) +- [iSCSIDiscovery_ConfigureiSNSServers](policy-csp-admx-iscsi.md) +- [iSCSIDiscovery_ConfigureTargetPortals](policy-csp-admx-iscsi.md) ## ADMX_kdc -- [CbacAndArmor](policy-csp-admx-kdc.md#admx-kdc-cbacandarmor) -- [PKINITFreshness](policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness) -- [emitlili](policy-csp-admx-kdc.md#admx-kdc-emitlili) -- [RequestCompoundId](policy-csp-admx-kdc.md#admx-kdc-requestcompoundid) -- [ForestSearch](policy-csp-admx-kdc.md#admx-kdc-forestsearch) -- [TicketSizeThreshold](policy-csp-admx-kdc.md#admx-kdc-ticketsizethreshold) +- [CbacAndArmor](policy-csp-admx-kdc.md) +- [PKINITFreshness](policy-csp-admx-kdc.md) +- [emitlili](policy-csp-admx-kdc.md) +- [RequestCompoundId](policy-csp-admx-kdc.md) +- [ForestSearch](policy-csp-admx-kdc.md) +- [TicketSizeThreshold](policy-csp-admx-kdc.md) ## ADMX_Kerberos -- [AlwaysSendCompoundId](policy-csp-admx-kerberos.md#admx-kerberos-alwayssendcompoundid) -- [HostToRealm](policy-csp-admx-kerberos.md#admx-kerberos-hosttorealm) -- [MitRealms](policy-csp-admx-kerberos.md#admx-kerberos-mitrealms) -- [KdcProxyDisableServerRevocationCheck](policy-csp-admx-kerberos.md#admx-kerberos-kdcproxydisableserverrevocationcheck) -- [StrictTarget](policy-csp-admx-kerberos.md#admx-kerberos-stricttarget) -- [KdcProxyServer](policy-csp-admx-kerberos.md#admx-kerberos-kdcproxyserver) -- [ServerAcceptsCompound](policy-csp-admx-kerberos.md#admx-kerberos-serveracceptscompound) -- [DevicePKInitEnabled](policy-csp-admx-kerberos.md#admx-kerberos-devicepkinitenabled) +- [AlwaysSendCompoundId](policy-csp-admx-kerberos.md) +- [HostToRealm](policy-csp-admx-kerberos.md) +- [MitRealms](policy-csp-admx-kerberos.md) +- [KdcProxyDisableServerRevocationCheck](policy-csp-admx-kerberos.md) +- [StrictTarget](policy-csp-admx-kerberos.md) +- [KdcProxyServer](policy-csp-admx-kerberos.md) +- [ServerAcceptsCompound](policy-csp-admx-kerberos.md) +- [DevicePKInitEnabled](policy-csp-admx-kerberos.md) ## ADMX_LanmanServer -- [Pol_CipherSuiteOrder](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-ciphersuiteorder) -- [Pol_HashPublication](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) -- [Pol_HashSupportVersion](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) -- [Pol_HonorCipherSuiteOrder](policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) +- [Pol_CipherSuiteOrder](policy-csp-admx-lanmanserver.md) +- [Pol_HashPublication](policy-csp-admx-lanmanserver.md) +- [Pol_HashSupportVersion](policy-csp-admx-lanmanserver.md) +- [Pol_HonorCipherSuiteOrder](policy-csp-admx-lanmanserver.md) ## ADMX_LanmanWorkstation -- [Pol_CipherSuiteOrder](policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-ciphersuiteorder) -- [Pol_EnableHandleCachingForCAFiles](policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enablehandlecachingforcafiles) -- [Pol_EnableOfflineFilesforCAShares](policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enableofflinefilesforcashares) +- [Pol_CipherSuiteOrder](policy-csp-admx-lanmanworkstation.md) +- [Pol_EnableHandleCachingForCAFiles](policy-csp-admx-lanmanworkstation.md) +- [Pol_EnableOfflineFilesforCAShares](policy-csp-admx-lanmanworkstation.md) ## ADMX_LeakDiagnostic -- [WdiScenarioExecutionPolicy](policy-csp-admx-leakdiagnostic.md#admx-leakdiagnostic-wdiscenarioexecutionpolicy) +- [WdiScenarioExecutionPolicy](policy-csp-admx-leakdiagnostic.md) ## ADMX_LinkLayerTopologyDiscovery -- [LLTD_EnableLLTDIO](policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) -- [LLTD_EnableRspndr](policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) +- [LLTD_EnableLLTDIO](policy-csp-admx-linklayertopologydiscovery.md) +- [LLTD_EnableRspndr](policy-csp-admx-linklayertopologydiscovery.md) ## ADMX_LocationProviderAdm -- [DisableWindowsLocationProvider_1](policy-csp-admx-locationprovideradm.md#admx-locationprovideradm-disablewindowslocationprovider-1) +- [DisableWindowsLocationProvider_1](policy-csp-admx-locationprovideradm.md) ## ADMX_Logon -- [NoWelcomeTips_1](policy-csp-admx-logon.md#admx-logon-nowelcometips-1) -- [DisableExplorerRunLegacy_1](policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-1) -- [DisableExplorerRunOnceLegacy_1](policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-1) -- [Run_1](policy-csp-admx-logon.md#admx-logon-run-1) -- [VerboseStatus](policy-csp-admx-logon.md#admx-logon-verbosestatus) -- [UseOEMBackground](policy-csp-admx-logon.md#admx-logon-useoembackground) -- [SyncForegroundPolicy](policy-csp-admx-logon.md#admx-logon-syncforegroundpolicy) -- [BlockUserFromShowingAccountDetailsOnSignin](policy-csp-admx-logon.md#admx-logon-blockuserfromshowingaccountdetailsonsignin) -- [NoWelcomeTips_2](policy-csp-admx-logon.md#admx-logon-nowelcometips-2) -- [DontEnumerateConnectedUsers](policy-csp-admx-logon.md#admx-logon-dontenumerateconnectedusers) -- [DisableExplorerRunLegacy_2](policy-csp-admx-logon.md#admx-logon-disableexplorerrunlegacy-2) -- [DisableExplorerRunOnceLegacy_2](policy-csp-admx-logon.md#admx-logon-disableexplorerrunoncelegacy-2) -- [Run_2](policy-csp-admx-logon.md#admx-logon-run-2) -- [DisableAcrylicBackgroundOnLogon](policy-csp-admx-logon.md#admx-logon-disableacrylicbackgroundonlogon) -- [DisableStatusMessages](policy-csp-admx-logon.md#admx-logon-disablestatusmessages) +- [NoWelcomeTips_1](policy-csp-admx-logon.md) +- [DisableExplorerRunLegacy_1](policy-csp-admx-logon.md) +- [DisableExplorerRunOnceLegacy_1](policy-csp-admx-logon.md) +- [Run_1](policy-csp-admx-logon.md) +- [VerboseStatus](policy-csp-admx-logon.md) +- [UseOEMBackground](policy-csp-admx-logon.md) +- [SyncForegroundPolicy](policy-csp-admx-logon.md) +- [BlockUserFromShowingAccountDetailsOnSignin](policy-csp-admx-logon.md) +- [NoWelcomeTips_2](policy-csp-admx-logon.md) +- [DontEnumerateConnectedUsers](policy-csp-admx-logon.md) +- [DisableExplorerRunLegacy_2](policy-csp-admx-logon.md) +- [DisableExplorerRunOnceLegacy_2](policy-csp-admx-logon.md) +- [Run_2](policy-csp-admx-logon.md) +- [DisableAcrylicBackgroundOnLogon](policy-csp-admx-logon.md) +- [DisableStatusMessages](policy-csp-admx-logon.md) ## ADMX_MicrosoftDefenderAntivirus -- [ServiceKeepAlive](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-servicekeepalive) -- [AllowFastServiceStartup](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-allowfastservicestartup) -- [UX_Configuration_CustomDefaultActionToastString](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring) -- [UX_Configuration_UILockdown](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-uilockdown) -- [UX_Configuration_Notification_Suppress](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress) -- [UX_Configuration_SuppressRebootNotification](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification) -- [DisableLocalAdminMerge](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablelocaladminmerge) -- [ProxyBypass](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxybypass) -- [ProxyPacUrl](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxypacurl) -- [ProxyServer](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxyserver) -- [Exclusions_Extensions](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-extensions) -- [Exclusions_Paths](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-paths) -- [Exclusions_Processes](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-processes) -- [DisableAutoExclusions](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableautoexclusions) -- [Spynet_LocalSettingOverrideSpynetReporting](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting) -- [DisableBlockAtFirstSeen](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableblockatfirstseen) -- [SpynetReporting](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynetreporting) -- [ExploitGuard_ASR_Rules](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-rules) -- [ExploitGuard_ASR_ASROnlyExclusions](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions) -- [ExploitGuard_ControlledFolderAccess_AllowedApplications](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications) -- [ExploitGuard_ControlledFolderAccess_ProtectedFolders](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders) -- [MpEngine_EnableFileHashComputation](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation) -- [Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid) -- [Nis_Consumers_IPS_DisableSignatureRetirement](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement) -- [Nis_DisableProtocolRecognition](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition) -- [Quarantine_LocalSettingOverridePurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay) -- [Quarantine_PurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay) -- [RandomizeScheduleTaskTimes](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-randomizescheduletasktimes) -- [RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection) -- [RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection) -- [RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection) -- [RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring) -- [RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring) -- [RealtimeProtection_IOAVMaxSize](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize) -- [RealtimeProtection_DisableOnAccessProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection) -- [RealtimeProtection_DisableIOAVProtection](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection) -- [DisableRealtimeMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablerealtimemonitoring) -- [RealtimeProtection_DisableBehaviorMonitoring](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring) -- [RealtimeProtection_DisableScanOnRealtimeEnable](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable) -- [RealtimeProtection_DisableRawWriteNotification](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification) -- [Remediation_LocalSettingOverrideScan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime) -- [Remediation_Scan_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduleday) -- [Remediation_Scan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduletime) -- [Reporting_CriticalFailureTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout) -- [Reporting_NonCriticalTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout) -- [Reporting_RecentlyCleanedTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout) -- [Reporting_AdditionalActionTimeout](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout) -- [Reporting_DisablegenericrePorts](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disablegenericreports) -- [Reporting_WppTracingComponents](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents) -- [Reporting_WppTracingLevel](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracinglevel) -- [Reporting_DisableEnhancedNotifications](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications) -- [Scan_AllowPause](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-allowpause) -- [Scan_LocalSettingOverrideAvgCPULoadFactor](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor) -- [Scan_LocalSettingOverrideScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday) -- [Scan_LocalSettingOverrideScheduleQuickScantime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime) -- [Scan_LocalSettingOverrideScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime) -- [Scan_LocalSettingOverrideScanParameters](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters) -- [Scan_LowCpuPriority](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-lowcpupriority) -- [Scan_DisableRestorePoint](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablerestorepoint) -- [Scan_MissedScheduledScanCountBeforeCatchup](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup) -- [Scan_DisableScanningMappedNetworkDrivesForFullScan](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan) -- [Scan_DisableArchiveScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablearchivescanning) -- [Scan_DisableScanningNetworkFiles](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles) -- [Scan_DisablePackedExeScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablepackedexescanning) -- [Scan_DisableRemovableDriveScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning) -- [Scan_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduleday) -- [Scan_QuickScanInterval](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-quickscaninterval) -- [Scan_ArchiveMaxDepth](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxdepth) -- [Scan_ArchiveMaxSize](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxsize) -- [Scan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduletime) -- [Scan_ScanOnlyIfIdle](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scanonlyifidle) -- [Scan_DisableEmailScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableemailscanning) -- [Scan_DisableHeuristics](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableheuristics) -- [Scan_PurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay) -- [Scan_DisableReparsePointScanning](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning) -- [SignatureUpdate_SignatureDisableNotification](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification) -- [SignatureUpdate_RealtimeSignatureDelivery](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery) -- [SignatureUpdate_ForceUpdateFromMU](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu) -- [SignatureUpdate_DisableScheduledSignatureUpdateonBattery](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery) -- [SignatureUpdate_UpdateOnStartup](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup) -- [SignatureUpdate_DefinitionUpdateFileSharesSources](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources) -- [SignatureUpdate_SharedSignaturesLocation](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation) -- [SignatureUpdate_SignatureUpdateCatchupInterval](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval) -- [SignatureUpdate_ASSignatureDue](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue) -- [SignatureUpdate_AVSignatureDue](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue) -- [SignatureUpdate_FallbackOrder](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder) -- [SignatureUpdate_DisableUpdateOnStartupWithoutEngine](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine) -- [SignatureUpdate_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduleday) -- [SignatureUpdate_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduletime) -- [SignatureUpdate_DisableScanOnUpdate](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate) -- [Threats_ThreatIdDefaultAction](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-threats-threatiddefaultaction) -- [DisableAntiSpywareDefender](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableantispywaredefender) -- [DisableRoutinelyTakingAction](policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableroutinelytakingaction) +- [ServiceKeepAlive](policy-csp-admx-microsoftdefenderantivirus.md) +- [AllowFastServiceStartup](policy-csp-admx-microsoftdefenderantivirus.md) +- [UX_Configuration_CustomDefaultActionToastString](policy-csp-admx-microsoftdefenderantivirus.md) +- [UX_Configuration_UILockdown](policy-csp-admx-microsoftdefenderantivirus.md) +- [UX_Configuration_Notification_Suppress](policy-csp-admx-microsoftdefenderantivirus.md) +- [UX_Configuration_SuppressRebootNotification](policy-csp-admx-microsoftdefenderantivirus.md) +- [DisableLocalAdminMerge](policy-csp-admx-microsoftdefenderantivirus.md) +- [ProxyBypass](policy-csp-admx-microsoftdefenderantivirus.md) +- [ProxyPacUrl](policy-csp-admx-microsoftdefenderantivirus.md) +- [ProxyServer](policy-csp-admx-microsoftdefenderantivirus.md) +- [Exclusions_Extensions](policy-csp-admx-microsoftdefenderantivirus.md) +- [Exclusions_Paths](policy-csp-admx-microsoftdefenderantivirus.md) +- [Exclusions_Processes](policy-csp-admx-microsoftdefenderantivirus.md) +- [DisableAutoExclusions](policy-csp-admx-microsoftdefenderantivirus.md) +- [Spynet_LocalSettingOverrideSpynetReporting](policy-csp-admx-microsoftdefenderantivirus.md) +- [DisableBlockAtFirstSeen](policy-csp-admx-microsoftdefenderantivirus.md) +- [SpynetReporting](policy-csp-admx-microsoftdefenderantivirus.md) +- [ExploitGuard_ASR_Rules](policy-csp-admx-microsoftdefenderantivirus.md) +- [ExploitGuard_ASR_ASROnlyExclusions](policy-csp-admx-microsoftdefenderantivirus.md) +- [ExploitGuard_ControlledFolderAccess_AllowedApplications](policy-csp-admx-microsoftdefenderantivirus.md) +- [ExploitGuard_ControlledFolderAccess_ProtectedFolders](policy-csp-admx-microsoftdefenderantivirus.md) +- [MpEngine_EnableFileHashComputation](policy-csp-admx-microsoftdefenderantivirus.md) +- [Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](policy-csp-admx-microsoftdefenderantivirus.md) +- [Nis_Consumers_IPS_DisableSignatureRetirement](policy-csp-admx-microsoftdefenderantivirus.md) +- [Nis_DisableProtocolRecognition](policy-csp-admx-microsoftdefenderantivirus.md) +- [Quarantine_LocalSettingOverridePurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md) +- [Quarantine_PurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md) +- [RandomizeScheduleTaskTimes](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_IOAVMaxSize](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_DisableOnAccessProtection](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_DisableIOAVProtection](policy-csp-admx-microsoftdefenderantivirus.md) +- [DisableRealtimeMonitoring](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_DisableBehaviorMonitoring](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_DisableScanOnRealtimeEnable](policy-csp-admx-microsoftdefenderantivirus.md) +- [RealtimeProtection_DisableRawWriteNotification](policy-csp-admx-microsoftdefenderantivirus.md) +- [Remediation_LocalSettingOverrideScan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md) +- [Remediation_Scan_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md) +- [Remediation_Scan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_CriticalFailureTimeout](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_NonCriticalTimeout](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_RecentlyCleanedTimeout](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_AdditionalActionTimeout](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_DisablegenericrePorts](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_WppTracingComponents](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_WppTracingLevel](policy-csp-admx-microsoftdefenderantivirus.md) +- [Reporting_DisableEnhancedNotifications](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_AllowPause](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_LocalSettingOverrideAvgCPULoadFactor](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_LocalSettingOverrideScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_LocalSettingOverrideScheduleQuickScantime](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_LocalSettingOverrideScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_LocalSettingOverrideScanParameters](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_LowCpuPriority](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableRestorePoint](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_MissedScheduledScanCountBeforeCatchup](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableScanningMappedNetworkDrivesForFullScan](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableArchiveScanning](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableScanningNetworkFiles](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisablePackedExeScanning](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableRemovableDriveScanning](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_QuickScanInterval](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_ArchiveMaxDepth](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_ArchiveMaxSize](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_ScanOnlyIfIdle](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableEmailScanning](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableHeuristics](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_PurgeItemsAfterDelay](policy-csp-admx-microsoftdefenderantivirus.md) +- [Scan_DisableReparsePointScanning](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_SignatureDisableNotification](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_RealtimeSignatureDelivery](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_ForceUpdateFromMU](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_DisableScheduledSignatureUpdateonBattery](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_UpdateOnStartup](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_DefinitionUpdateFileSharesSources](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_SharedSignaturesLocation](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_SignatureUpdateCatchupInterval](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_ASSignatureDue](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_AVSignatureDue](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_FallbackOrder](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_DisableUpdateOnStartupWithoutEngine](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_ScheduleDay](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_ScheduleTime](policy-csp-admx-microsoftdefenderantivirus.md) +- [SignatureUpdate_DisableScanOnUpdate](policy-csp-admx-microsoftdefenderantivirus.md) +- [Threats_ThreatIdDefaultAction](policy-csp-admx-microsoftdefenderantivirus.md) +- [DisableAntiSpywareDefender](policy-csp-admx-microsoftdefenderantivirus.md) +- [DisableRoutinelyTakingAction](policy-csp-admx-microsoftdefenderantivirus.md) ## ADMX_MMC -- [MMC_Restrict_Author](policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-author) -- [MMC_Restrict_To_Permitted_Snapins](policy-csp-admx-mmc.md#admx-mmc-mmc-restrict-to-permitted-snapins) -- [MMC_ActiveXControl](policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) -- [MMC_ExtendView](policy-csp-admx-mmc.md#admx-mmc-mmc-extendview) -- [MMC_LinkToWeb](policy-csp-admx-mmc.md#admx-mmc-mmc-linktoweb) +- [MMC_Restrict_Author](policy-csp-admx-mmc.md) +- [MMC_Restrict_To_Permitted_Snapins](policy-csp-admx-mmc.md) +- [MMC_ActiveXControl](policy-csp-admx-mmc.md) +- [MMC_ExtendView](policy-csp-admx-mmc.md) +- [MMC_LinkToWeb](policy-csp-admx-mmc.md) ## ADMX_MMCSnapins -- [MMC_Net_Framework](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-net-framework) -- [MMC_ActiveDirDomTrusts](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirdomtrusts) -- [MMC_ActiveDirSitesServices](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activedirsitesservices) -- [MMC_ActiveDirUsersComp](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-activediruserscomp) -- [MMC_ADSI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-adsi) -- [MMC_CertsTemplate](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certstemplate) -- [MMC_Certs](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certs) -- [MMC_CertAuth](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauth) -- [MMC_ComponentServices](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-componentservices) -- [MMC_ComputerManagement](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-computermanagement) -- [MMC_DeviceManager_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-2) -- [MMC_DiskDefrag](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskdefrag) -- [MMC_DiskMgmt](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-diskmgmt) -- [MMC_DFS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dfs) -- [MMC_EnterprisePKI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-enterprisepki) -- [MMC_EventViewer_3](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-3) -- [MMC_EventViewer_4](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-4) -- [MMC_AppleTalkRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-appletalkrouting) -- [MMC_AuthMan](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-authman) -- [MMC_CertAuthPolSet](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-certauthpolset) -- [MMC_ConnectionSharingNAT](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-connectionsharingnat) -- [MMC_DCOMCFG](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dcomcfg) -- [MMC_DeviceManager_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-devicemanager-1) -- [MMC_DHCPRelayMgmt](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-dhcprelaymgmt) -- [MMC_EventViewer_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-1) -- [MMC_EventViewer_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-eventviewer-2) -- [MMC_IASLogging](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iaslogging) -- [MMC_IGMPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-igmprouting) -- [MMC_IPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iprouting) -- [MMC_IPXRIPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxriprouting) -- [MMC_IPXRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxrouting) -- [MMC_IPXSAPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipxsaprouting) -- [MMC_LogicalMappedDrives](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-logicalmappeddrives) -- [MMC_OSPFRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ospfrouting) -- [MMC_PublicKey](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-publickey) -- [MMC_RAS_DialinUser](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ras-dialinuser) -- [MMC_RemoteAccess](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remoteaccess) -- [MMC_RemStore](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remstore) -- [MMC_RIPRouting](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-riprouting) -- [MMC_Routing](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-routing) -- [MMC_SendConsoleMessage](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sendconsolemessage) -- [MMC_ServiceDependencies](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servicedependencies) -- [MMC_SharedFolders_Ext](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders-ext) -- [MMC_SMTPProtocol](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-smtpprotocol) -- [MMC_SNMP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-snmp) -- [MMC_SysProp](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysprop) -- [MMC_FailoverClusters](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-failoverclusters) -- [MMC_FAXService](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-faxservice) -- [MMC_FrontPageExt](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-frontpageext) -- [MMC_GroupPolicyManagementSnapIn](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicymanagementsnapin) -- [MMC_GroupPolicySnapIn](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicysnapin) -- [MMC_ADMComputers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-1) -- [MMC_ADMUsers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-1) -- [MMC_FolderRedirection_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-1) -- [MMC_IEMaintenance_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-1) -- [MMC_IPSecManage_GP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage-gp) -- [MMC_NapSnap_GP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap-gp) -- [MMC_RIS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ris) -- [MMC_ScriptsUser_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-1) -- [MMC_ScriptsMachine_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-1) -- [MMC_SecuritySettings_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-1) -- [MMC_SoftwareInstalationComputers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-1) -- [MMC_SoftwareInstallationUsers_1](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-1) -- [MMC_WindowsFirewall_GP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall-gp) -- [MMC_WiredNetworkPolicy](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirednetworkpolicy) -- [MMC_WirelessNetworkPolicy](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessnetworkpolicy) -- [MMC_GroupPolicyTab](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-grouppolicytab) -- [MMC_ResultantSetOfPolicySnapIn](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-resultantsetofpolicysnapin) -- [MMC_ADMComputers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admcomputers-2) -- [MMC_ADMUsers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-admusers-2) -- [MMC_FolderRedirection_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-folderredirection-2) -- [MMC_IEMaintenance_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iemaintenance-2) -- [MMC_ScriptsUser_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsuser-2) -- [MMC_ScriptsMachine_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-scriptsmachine-2) -- [MMC_SecuritySettings_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitysettings-2) -- [MMC_SoftwareInstalationComputers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstalationcomputers-2) -- [MMC_SoftwareInstallationUsers_2](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-softwareinstallationusers-2) -- [MMC_HRA](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-hra) -- [MMC_IndexingService](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-indexingservice) -- [MMC_IAS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ias) -- [MMC_IIS](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-iis) -- [MMC_IpSecMonitor](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmonitor) -- [MMC_IpSecManage](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ipsecmanage) -- [MMC_LocalUsersGroups](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-localusersgroups) -- [MMC_NapSnap](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-napsnap) -- [MMC_NPSUI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-npsui) -- [MMC_OCSP](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-ocsp) -- [MMC_PerfLogsAlerts](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-perflogsalerts) -- [MMC_QoSAdmission](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-qosadmission) -- [MMC_TerminalServices](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-terminalservices) -- [MMC_RemoteDesktop](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-remotedesktop) -- [MMC_RSM](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rsm) -- [MMC_RRA](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-rra) -- [MMC_SCA](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sca) -- [MMC_SecurityTemplates](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-securitytemplates) -- [MMC_ServerManager](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-servermanager) -- [MMC_Services](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-services) -- [MMC_SharedFolders](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sharedfolders) -- [MMC_SysInfo](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-sysinfo) -- [MMC_Telephony](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-telephony) -- [MMC_TPMManagement](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-tpmmanagement) -- [MMC_WindowsFirewall](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-windowsfirewall) -- [MMC_WirelessMon](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessmon) -- [MMC_WMI](policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wmi) +- [MMC_Net_Framework](policy-csp-admx-mmcsnapins.md) +- [MMC_ActiveDirDomTrusts](policy-csp-admx-mmcsnapins.md) +- [MMC_ActiveDirSitesServices](policy-csp-admx-mmcsnapins.md) +- [MMC_ActiveDirUsersComp](policy-csp-admx-mmcsnapins.md) +- [MMC_ADSI](policy-csp-admx-mmcsnapins.md) +- [MMC_CertsTemplate](policy-csp-admx-mmcsnapins.md) +- [MMC_Certs](policy-csp-admx-mmcsnapins.md) +- [MMC_CertAuth](policy-csp-admx-mmcsnapins.md) +- [MMC_ComponentServices](policy-csp-admx-mmcsnapins.md) +- [MMC_ComputerManagement](policy-csp-admx-mmcsnapins.md) +- [MMC_DeviceManager_2](policy-csp-admx-mmcsnapins.md) +- [MMC_DiskDefrag](policy-csp-admx-mmcsnapins.md) +- [MMC_DiskMgmt](policy-csp-admx-mmcsnapins.md) +- [MMC_DFS](policy-csp-admx-mmcsnapins.md) +- [MMC_EnterprisePKI](policy-csp-admx-mmcsnapins.md) +- [MMC_EventViewer_3](policy-csp-admx-mmcsnapins.md) +- [MMC_EventViewer_4](policy-csp-admx-mmcsnapins.md) +- [MMC_AppleTalkRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_AuthMan](policy-csp-admx-mmcsnapins.md) +- [MMC_CertAuthPolSet](policy-csp-admx-mmcsnapins.md) +- [MMC_ConnectionSharingNAT](policy-csp-admx-mmcsnapins.md) +- [MMC_DCOMCFG](policy-csp-admx-mmcsnapins.md) +- [MMC_DeviceManager_1](policy-csp-admx-mmcsnapins.md) +- [MMC_DHCPRelayMgmt](policy-csp-admx-mmcsnapins.md) +- [MMC_EventViewer_1](policy-csp-admx-mmcsnapins.md) +- [MMC_EventViewer_2](policy-csp-admx-mmcsnapins.md) +- [MMC_IASLogging](policy-csp-admx-mmcsnapins.md) +- [MMC_IGMPRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_IPRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_IPXRIPRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_IPXRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_IPXSAPRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_LogicalMappedDrives](policy-csp-admx-mmcsnapins.md) +- [MMC_OSPFRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_PublicKey](policy-csp-admx-mmcsnapins.md) +- [MMC_RAS_DialinUser](policy-csp-admx-mmcsnapins.md) +- [MMC_RemoteAccess](policy-csp-admx-mmcsnapins.md) +- [MMC_RemStore](policy-csp-admx-mmcsnapins.md) +- [MMC_RIPRouting](policy-csp-admx-mmcsnapins.md) +- [MMC_Routing](policy-csp-admx-mmcsnapins.md) +- [MMC_SendConsoleMessage](policy-csp-admx-mmcsnapins.md) +- [MMC_ServiceDependencies](policy-csp-admx-mmcsnapins.md) +- [MMC_SharedFolders_Ext](policy-csp-admx-mmcsnapins.md) +- [MMC_SMTPProtocol](policy-csp-admx-mmcsnapins.md) +- [MMC_SNMP](policy-csp-admx-mmcsnapins.md) +- [MMC_SysProp](policy-csp-admx-mmcsnapins.md) +- [MMC_FailoverClusters](policy-csp-admx-mmcsnapins.md) +- [MMC_FAXService](policy-csp-admx-mmcsnapins.md) +- [MMC_FrontPageExt](policy-csp-admx-mmcsnapins.md) +- [MMC_GroupPolicyManagementSnapIn](policy-csp-admx-mmcsnapins.md) +- [MMC_GroupPolicySnapIn](policy-csp-admx-mmcsnapins.md) +- [MMC_ADMComputers_1](policy-csp-admx-mmcsnapins.md) +- [MMC_ADMUsers_1](policy-csp-admx-mmcsnapins.md) +- [MMC_FolderRedirection_1](policy-csp-admx-mmcsnapins.md) +- [MMC_IEMaintenance_1](policy-csp-admx-mmcsnapins.md) +- [MMC_IPSecManage_GP](policy-csp-admx-mmcsnapins.md) +- [MMC_NapSnap_GP](policy-csp-admx-mmcsnapins.md) +- [MMC_RIS](policy-csp-admx-mmcsnapins.md) +- [MMC_ScriptsUser_1](policy-csp-admx-mmcsnapins.md) +- [MMC_ScriptsMachine_1](policy-csp-admx-mmcsnapins.md) +- [MMC_SecuritySettings_1](policy-csp-admx-mmcsnapins.md) +- [MMC_SoftwareInstalationComputers_1](policy-csp-admx-mmcsnapins.md) +- [MMC_SoftwareInstallationUsers_1](policy-csp-admx-mmcsnapins.md) +- [MMC_WindowsFirewall_GP](policy-csp-admx-mmcsnapins.md) +- [MMC_WiredNetworkPolicy](policy-csp-admx-mmcsnapins.md) +- [MMC_WirelessNetworkPolicy](policy-csp-admx-mmcsnapins.md) +- [MMC_GroupPolicyTab](policy-csp-admx-mmcsnapins.md) +- [MMC_ResultantSetOfPolicySnapIn](policy-csp-admx-mmcsnapins.md) +- [MMC_ADMComputers_2](policy-csp-admx-mmcsnapins.md) +- [MMC_ADMUsers_2](policy-csp-admx-mmcsnapins.md) +- [MMC_FolderRedirection_2](policy-csp-admx-mmcsnapins.md) +- [MMC_IEMaintenance_2](policy-csp-admx-mmcsnapins.md) +- [MMC_ScriptsUser_2](policy-csp-admx-mmcsnapins.md) +- [MMC_ScriptsMachine_2](policy-csp-admx-mmcsnapins.md) +- [MMC_SecuritySettings_2](policy-csp-admx-mmcsnapins.md) +- [MMC_SoftwareInstalationComputers_2](policy-csp-admx-mmcsnapins.md) +- [MMC_SoftwareInstallationUsers_2](policy-csp-admx-mmcsnapins.md) +- [MMC_HRA](policy-csp-admx-mmcsnapins.md) +- [MMC_IndexingService](policy-csp-admx-mmcsnapins.md) +- [MMC_IAS](policy-csp-admx-mmcsnapins.md) +- [MMC_IIS](policy-csp-admx-mmcsnapins.md) +- [MMC_IpSecMonitor](policy-csp-admx-mmcsnapins.md) +- [MMC_IpSecManage](policy-csp-admx-mmcsnapins.md) +- [MMC_LocalUsersGroups](policy-csp-admx-mmcsnapins.md) +- [MMC_NapSnap](policy-csp-admx-mmcsnapins.md) +- [MMC_NPSUI](policy-csp-admx-mmcsnapins.md) +- [MMC_OCSP](policy-csp-admx-mmcsnapins.md) +- [MMC_PerfLogsAlerts](policy-csp-admx-mmcsnapins.md) +- [MMC_QoSAdmission](policy-csp-admx-mmcsnapins.md) +- [MMC_TerminalServices](policy-csp-admx-mmcsnapins.md) +- [MMC_RemoteDesktop](policy-csp-admx-mmcsnapins.md) +- [MMC_RSM](policy-csp-admx-mmcsnapins.md) +- [MMC_RRA](policy-csp-admx-mmcsnapins.md) +- [MMC_SCA](policy-csp-admx-mmcsnapins.md) +- [MMC_SecurityTemplates](policy-csp-admx-mmcsnapins.md) +- [MMC_ServerManager](policy-csp-admx-mmcsnapins.md) +- [MMC_Services](policy-csp-admx-mmcsnapins.md) +- [MMC_SharedFolders](policy-csp-admx-mmcsnapins.md) +- [MMC_SysInfo](policy-csp-admx-mmcsnapins.md) +- [MMC_Telephony](policy-csp-admx-mmcsnapins.md) +- [MMC_TPMManagement](policy-csp-admx-mmcsnapins.md) +- [MMC_WindowsFirewall](policy-csp-admx-mmcsnapins.md) +- [MMC_WirelessMon](policy-csp-admx-mmcsnapins.md) +- [MMC_WMI](policy-csp-admx-mmcsnapins.md) ## ADMX_MobilePCMobilityCenter -- [MobilityCenterEnable_1](policy-csp-admx-mobilepcmobilitycenter.md#admx-mobilepcmobilitycenter-mobilitycenterenable-1) -- [MobilityCenterEnable_2](policy-csp-admx-mobilepcmobilitycenter.md#admx-mobilepcmobilitycenter-mobilitycenterenable-2) +- [MobilityCenterEnable_1](policy-csp-admx-mobilepcmobilitycenter.md) +- [MobilityCenterEnable_2](policy-csp-admx-mobilepcmobilitycenter.md) ## ADMX_MobilePCPresentationSettings -- [PresentationSettingsEnable_1](policy-csp-admx-mobilepcpresentationsettings.md#admx-mobilepcpresentationsettings-presentationsettingsenable-1) -- [PresentationSettingsEnable_2](policy-csp-admx-mobilepcpresentationsettings.md#admx-mobilepcpresentationsettings-presentationsettingsenable-2) +- [PresentationSettingsEnable_1](policy-csp-admx-mobilepcpresentationsettings.md) +- [PresentationSettingsEnable_2](policy-csp-admx-mobilepcpresentationsettings.md) ## ADMX_MSAPolicy -- [MicrosoftAccount_DisableUserAuth](policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) +- [MicrosoftAccount_DisableUserAuth](policy-csp-admx-msapolicy.md) ## ADMX_msched -- [ActivationBoundaryPolicy](policy-csp-admx-msched.md#admx-msched-activationboundarypolicy) -- [RandomDelayPolicy](policy-csp-admx-msched.md#admx-msched-randomdelaypolicy) +- [ActivationBoundaryPolicy](policy-csp-admx-msched.md) +- [RandomDelayPolicy](policy-csp-admx-msched.md) ## ADMX_MSDT -- [WdiScenarioExecutionPolicy](policy-csp-admx-msdt.md#admx-msdt-wdiscenarioexecutionpolicy) -- [MsdtToolDownloadPolicy](policy-csp-admx-msdt.md#admx-msdt-msdttooldownloadpolicy) -- [MsdtSupportProvider](policy-csp-admx-msdt.md#admx-msdt-msdtsupportprovider) +- [WdiScenarioExecutionPolicy](policy-csp-admx-msdt.md) +- [MsdtToolDownloadPolicy](policy-csp-admx-msdt.md) +- [MsdtSupportProvider](policy-csp-admx-msdt.md) ## ADMX_MSI -- [DisableMedia](policy-csp-admx-msi.md#admx-msi-disablemedia) -- [DisableRollback_1](policy-csp-admx-msi.md#admx-msi-disablerollback-1) -- [SearchOrder](policy-csp-admx-msi.md#admx-msi-searchorder) -- [AllowLockdownBrowse](policy-csp-admx-msi.md#admx-msi-allowlockdownbrowse) -- [AllowLockdownPatch](policy-csp-admx-msi.md#admx-msi-allowlockdownpatch) -- [AllowLockdownMedia](policy-csp-admx-msi.md#admx-msi-allowlockdownmedia) -- [MSI_MaxPatchCacheSize](policy-csp-admx-msi.md#admx-msi-msi-maxpatchcachesize) -- [MSI_EnforceUpgradeComponentRules](policy-csp-admx-msi.md#admx-msi-msi-enforceupgradecomponentrules) -- [MsiDisableEmbeddedUI](policy-csp-admx-msi.md#admx-msi-msidisableembeddedui) -- [SafeForScripting](policy-csp-admx-msi.md#admx-msi-safeforscripting) -- [DisablePatch](policy-csp-admx-msi.md#admx-msi-disablepatch) -- [DisableFlyweightPatching](policy-csp-admx-msi.md#admx-msi-disableflyweightpatching) -- [MSI_DisableLUAPatching](policy-csp-admx-msi.md#admx-msi-msi-disableluapatching) -- [MSI_DisablePatchUninstall](policy-csp-admx-msi.md#admx-msi-msi-disablepatchuninstall) -- [DisableRollback_2](policy-csp-admx-msi.md#admx-msi-disablerollback-2) -- [DisableAutomaticApplicationShutdown](policy-csp-admx-msi.md#admx-msi-disableautomaticapplicationshutdown) -- [MSI_DisableUserInstalls](policy-csp-admx-msi.md#admx-msi-msi-disableuserinstalls) -- [DisableBrowse](policy-csp-admx-msi.md#admx-msi-disablebrowse) -- [TransformsSecure](policy-csp-admx-msi.md#admx-msi-transformssecure) -- [MSILogging](policy-csp-admx-msi.md#admx-msi-msilogging) -- [MSI_DisableSRCheckPoints](policy-csp-admx-msi.md#admx-msi-msi-disablesrcheckpoints) -- [DisableLoggingFromPackage](policy-csp-admx-msi.md#admx-msi-disableloggingfrompackage) -- [DisableSharedComponent](policy-csp-admx-msi.md#admx-msi-disablesharedcomponent) -- [DisableMSI](policy-csp-admx-msi.md#admx-msi-disablemsi) +- [DisableMedia](policy-csp-admx-msi.md) +- [DisableRollback_1](policy-csp-admx-msi.md) +- [SearchOrder](policy-csp-admx-msi.md) +- [AllowLockdownBrowse](policy-csp-admx-msi.md) +- [AllowLockdownPatch](policy-csp-admx-msi.md) +- [AllowLockdownMedia](policy-csp-admx-msi.md) +- [MSI_MaxPatchCacheSize](policy-csp-admx-msi.md) +- [MSI_EnforceUpgradeComponentRules](policy-csp-admx-msi.md) +- [MsiDisableEmbeddedUI](policy-csp-admx-msi.md) +- [SafeForScripting](policy-csp-admx-msi.md) +- [DisablePatch](policy-csp-admx-msi.md) +- [DisableFlyweightPatching](policy-csp-admx-msi.md) +- [MSI_DisableLUAPatching](policy-csp-admx-msi.md) +- [MSI_DisablePatchUninstall](policy-csp-admx-msi.md) +- [DisableRollback_2](policy-csp-admx-msi.md) +- [DisableAutomaticApplicationShutdown](policy-csp-admx-msi.md) +- [MSI_DisableUserInstalls](policy-csp-admx-msi.md) +- [DisableBrowse](policy-csp-admx-msi.md) +- [TransformsSecure](policy-csp-admx-msi.md) +- [MSILogging](policy-csp-admx-msi.md) +- [MSI_DisableSRCheckPoints](policy-csp-admx-msi.md) +- [DisableLoggingFromPackage](policy-csp-admx-msi.md) +- [DisableSharedComponent](policy-csp-admx-msi.md) +- [DisableMSI](policy-csp-admx-msi.md) ## ADMX_MsiFileRecovery -- [WdiScenarioExecutionPolicy](policy-csp-admx-msifilerecovery.md#admx-msifilerecovery-wdiscenarioexecutionpolicy) +- [WdiScenarioExecutionPolicy](policy-csp-admx-msifilerecovery.md) ## ADMX_MSS-legacy -- [Pol_MSS_AutoAdminLogon](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autoadminlogon) -- [Pol_MSS_AutoReboot](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autoreboot) -- [Pol_MSS_AutoShareServer](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autoshareserver) -- [Pol_MSS_AutoShareWks](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-autosharewks) -- [Pol_MSS_DisableSavePassword](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-disablesavepassword) -- [Pol_MSS_EnableDeadGWDetect](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-enabledeadgwdetect) -- [Pol_MSS_HideFromBrowseList](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-hidefrombrowselist) -- [Pol_MSS_KeepAliveTime](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-keepalivetime) -- [Pol_MSS_NoDefaultExempt](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-nodefaultexempt) -- [Pol_MSS_NtfsDisable8dot3NameCreation](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-ntfsdisable8dot3namecreation) -- [Pol_MSS_PerformRouterDiscovery](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-performrouterdiscovery) -- [Pol_MSS_SafeDllSearchMode](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-safedllsearchmode) -- [Pol_MSS_ScreenSaverGracePeriod](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-screensavergraceperiod) -- [Pol_MSS_SynAttackProtect](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-synattackprotect) -- [Pol_MSS_TcpMaxConnectResponseRetransmissions](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-tcpmaxconnectresponseretransmissions) -- [Pol_MSS_TcpMaxDataRetransmissionsIPv6](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-tcpmaxdataretransmissionsipv6) -- [Pol_MSS_TcpMaxDataRetransmissions](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-tcpmaxdataretransmissions) -- [Pol_MSS_WarningLevel](policy-csp-admx-mss-legacy.md#admx-mss-legacy-pol-mss-warninglevel) +- [Pol_MSS_AutoAdminLogon](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_AutoReboot](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_AutoShareServer](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_AutoShareWks](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_DisableSavePassword](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_EnableDeadGWDetect](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_HideFromBrowseList](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_KeepAliveTime](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_NoDefaultExempt](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_NtfsDisable8dot3NameCreation](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_PerformRouterDiscovery](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_SafeDllSearchMode](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_ScreenSaverGracePeriod](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_SynAttackProtect](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_TcpMaxConnectResponseRetransmissions](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_TcpMaxDataRetransmissionsIPv6](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_TcpMaxDataRetransmissions](policy-csp-admx-mss-legacy.md) +- [Pol_MSS_WarningLevel](policy-csp-admx-mss-legacy.md) ## ADMX_nca -- [CorporateResources](policy-csp-admx-nca.md#admx-nca-corporateresources) -- [CustomCommands](policy-csp-admx-nca.md#admx-nca-customcommands) -- [PassiveMode](policy-csp-admx-nca.md#admx-nca-passivemode) -- [FriendlyName](policy-csp-admx-nca.md#admx-nca-friendlyname) -- [DTEs](policy-csp-admx-nca.md#admx-nca-dtes) -- [LocalNamesOn](policy-csp-admx-nca.md#admx-nca-localnameson) -- [SupportEmail](policy-csp-admx-nca.md#admx-nca-supportemail) -- [ShowUI](policy-csp-admx-nca.md#admx-nca-showui) +- [CorporateResources](policy-csp-admx-nca.md) +- [CustomCommands](policy-csp-admx-nca.md) +- [PassiveMode](policy-csp-admx-nca.md) +- [FriendlyName](policy-csp-admx-nca.md) +- [DTEs](policy-csp-admx-nca.md) +- [LocalNamesOn](policy-csp-admx-nca.md) +- [SupportEmail](policy-csp-admx-nca.md) +- [ShowUI](policy-csp-admx-nca.md) ## ADMX_NCSI -- [NCSI_CorpDnsProbeContent](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobecontent) -- [NCSI_CorpDnsProbeHost](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpdnsprobehost) -- [NCSI_CorpSitePrefixes](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpsiteprefixes) -- [NCSI_CorpWebProbeUrl](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-corpwebprobeurl) -- [NCSI_DomainLocationDeterminationUrl](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-domainlocationdeterminationurl) -- [NCSI_GlobalDns](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-globaldns) -- [NCSI_PassivePolling](policy-csp-admx-ncsi.md#admx-ncsi-ncsi-passivepolling) +- [NCSI_CorpDnsProbeContent](policy-csp-admx-ncsi.md) +- [NCSI_CorpDnsProbeHost](policy-csp-admx-ncsi.md) +- [NCSI_CorpSitePrefixes](policy-csp-admx-ncsi.md) +- [NCSI_CorpWebProbeUrl](policy-csp-admx-ncsi.md) +- [NCSI_DomainLocationDeterminationUrl](policy-csp-admx-ncsi.md) +- [NCSI_GlobalDns](policy-csp-admx-ncsi.md) +- [NCSI_PassivePolling](policy-csp-admx-ncsi.md) ## ADMX_Netlogon -- [Netlogon_AllowNT4Crypto](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allownt4crypto) -- [Netlogon_AvoidPdcOnWan](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidpdconwan) -- [Netlogon_IgnoreIncomingMailslotMessages](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ignoreincomingmailslotmessages) -- [Netlogon_AvoidFallbackNetbiosDiscovery](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-avoidfallbacknetbiosdiscovery) -- [Netlogon_ForceRediscoveryInterval](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-forcerediscoveryinterval) -- [Netlogon_AddressTypeReturned](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresstypereturned) -- [Netlogon_LdapSrvPriority](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvpriority) -- [Netlogon_DnsTtl](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsttl) -- [Netlogon_LdapSrvWeight](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ldapsrvweight) -- [Netlogon_AddressLookupOnPingBehavior](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-addresslookuponpingbehavior) -- [Netlogon_DnsAvoidRegisterRecords](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsavoidregisterrecords) -- [Netlogon_UseDynamicDns](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-usedynamicdns) -- [Netlogon_DnsRefreshInterval](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnsrefreshinterval) -- [Netlogon_NdncSiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-ndncsitecoverage) -- [Netlogon_SiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitecoverage) -- [Netlogon_GcSiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-gcsitecoverage) -- [Netlogon_TryNextClosestSite](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-trynextclosestsite) -- [Netlogon_AutoSiteCoverage](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-autositecoverage) -- [Netlogon_AllowDnsSuffixSearch](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowdnssuffixsearch) -- [Netlogon_AllowSingleLabelDnsDomain](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-allowsinglelabeldnsdomain) -- [Netlogon_DnsSrvRecordUseLowerCaseHostNames](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-dnssrvrecorduselowercasehostnames) -- [Netlogon_NetlogonShareCompatibilityMode](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-netlogonsharecompatibilitymode) -- [Netlogon_ScavengeInterval](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-scavengeinterval) -- [Netlogon_SysvolShareCompatibilityMode](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sysvolsharecompatibilitymode) -- [Netlogon_ExpectedDialupDelay](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-expecteddialupdelay) -- [Netlogon_DebugFlag](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-debugflag) -- [Netlogon_MaximumLogFileSize](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-maximumlogfilesize) -- [Netlogon_NegativeCachePeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-negativecacheperiod) -- [Netlogon_NonBackgroundSuccessfulRefreshPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-nonbackgroundsuccessfulrefreshperiod) -- [Netlogon_SiteName](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-sitename) -- [Netlogon_BackgroundRetryQuitTime](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryquittime) -- [Netlogon_BackgroundRetryInitialPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretryinitialperiod) -- [Netlogon_BackgroundRetryMaximumPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundretrymaximumperiod) -- [Netlogon_BackgroundSuccessfulRefreshPeriod](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-backgroundsuccessfulrefreshperiod) -- [Netlogon_PingUrgencyMode](policy-csp-admx-netlogon.md#admx-netlogon-netlogon-pingurgencymode) +- [Netlogon_AllowNT4Crypto](policy-csp-admx-netlogon.md) +- [Netlogon_AvoidPdcOnWan](policy-csp-admx-netlogon.md) +- [Netlogon_IgnoreIncomingMailslotMessages](policy-csp-admx-netlogon.md) +- [Netlogon_AvoidFallbackNetbiosDiscovery](policy-csp-admx-netlogon.md) +- [Netlogon_ForceRediscoveryInterval](policy-csp-admx-netlogon.md) +- [Netlogon_AddressTypeReturned](policy-csp-admx-netlogon.md) +- [Netlogon_LdapSrvPriority](policy-csp-admx-netlogon.md) +- [Netlogon_DnsTtl](policy-csp-admx-netlogon.md) +- [Netlogon_LdapSrvWeight](policy-csp-admx-netlogon.md) +- [Netlogon_AddressLookupOnPingBehavior](policy-csp-admx-netlogon.md) +- [Netlogon_DnsAvoidRegisterRecords](policy-csp-admx-netlogon.md) +- [Netlogon_UseDynamicDns](policy-csp-admx-netlogon.md) +- [Netlogon_DnsRefreshInterval](policy-csp-admx-netlogon.md) +- [Netlogon_NdncSiteCoverage](policy-csp-admx-netlogon.md) +- [Netlogon_SiteCoverage](policy-csp-admx-netlogon.md) +- [Netlogon_GcSiteCoverage](policy-csp-admx-netlogon.md) +- [Netlogon_TryNextClosestSite](policy-csp-admx-netlogon.md) +- [Netlogon_AutoSiteCoverage](policy-csp-admx-netlogon.md) +- [Netlogon_AllowDnsSuffixSearch](policy-csp-admx-netlogon.md) +- [Netlogon_AllowSingleLabelDnsDomain](policy-csp-admx-netlogon.md) +- [Netlogon_DnsSrvRecordUseLowerCaseHostNames](policy-csp-admx-netlogon.md) +- [Netlogon_NetlogonShareCompatibilityMode](policy-csp-admx-netlogon.md) +- [Netlogon_ScavengeInterval](policy-csp-admx-netlogon.md) +- [Netlogon_SysvolShareCompatibilityMode](policy-csp-admx-netlogon.md) +- [Netlogon_ExpectedDialupDelay](policy-csp-admx-netlogon.md) +- [Netlogon_DebugFlag](policy-csp-admx-netlogon.md) +- [Netlogon_MaximumLogFileSize](policy-csp-admx-netlogon.md) +- [Netlogon_NegativeCachePeriod](policy-csp-admx-netlogon.md) +- [Netlogon_NonBackgroundSuccessfulRefreshPeriod](policy-csp-admx-netlogon.md) +- [Netlogon_SiteName](policy-csp-admx-netlogon.md) +- [Netlogon_BackgroundRetryQuitTime](policy-csp-admx-netlogon.md) +- [Netlogon_BackgroundRetryInitialPeriod](policy-csp-admx-netlogon.md) +- [Netlogon_BackgroundRetryMaximumPeriod](policy-csp-admx-netlogon.md) +- [Netlogon_BackgroundSuccessfulRefreshPeriod](policy-csp-admx-netlogon.md) +- [Netlogon_PingUrgencyMode](policy-csp-admx-netlogon.md) ## ADMX_NetworkConnections -- [NC_RasAllUserProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasalluserproperties) -- [NC_DeleteAllUserConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deletealluserconnection) -- [NC_LanConnect](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanconnect) -- [NC_RenameAllUserRasConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamealluserrasconnection) -- [NC_RenameLanConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamelanconnection) -- [NC_RenameConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renameconnection) -- [NC_EnableAdminProhibits](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-enableadminprohibits) -- [NC_LanProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanproperties) -- [NC_LanChangeProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-lanchangeproperties) -- [NC_RasChangeProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-raschangeproperties) -- [NC_AdvancedSettings](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-advancedsettings) -- [NC_NewConnectionWizard](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-newconnectionwizard) -- [NC_DialupPrefs](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-dialupprefs) -- [NC_AddRemoveComponents](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-addremovecomponents) -- [NC_RasMyProperties](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasmyproperties) -- [NC_RasConnect](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-rasconnect) -- [NC_DeleteConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-deleteconnection) -- [NC_ChangeBindState](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-changebindstate) -- [NC_RenameMyRasConnection](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-renamemyrasconnection) -- [NC_AllowAdvancedTCPIPConfig](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-allowadvancedtcpipconfig) -- [NC_Statistics](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-statistics) -- [NC_IpStateChecking](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-ipstatechecking) -- [NC_DoNotShowLocalOnlyIcon](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-donotshowlocalonlyicon) -- [NC_PersonalFirewallConfig](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-personalfirewallconfig) -- [NC_ShowSharedAccessUI](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-showsharedaccessui) -- [NC_StdDomainUserSetLocation](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-stddomainusersetlocation) -- [NC_ForceTunneling](policy-csp-admx-networkconnections.md#admx-networkconnections-nc-forcetunneling) +- [NC_RasAllUserProperties](policy-csp-admx-networkconnections.md) +- [NC_DeleteAllUserConnection](policy-csp-admx-networkconnections.md) +- [NC_LanConnect](policy-csp-admx-networkconnections.md) +- [NC_RenameAllUserRasConnection](policy-csp-admx-networkconnections.md) +- [NC_RenameLanConnection](policy-csp-admx-networkconnections.md) +- [NC_RenameConnection](policy-csp-admx-networkconnections.md) +- [NC_EnableAdminProhibits](policy-csp-admx-networkconnections.md) +- [NC_LanProperties](policy-csp-admx-networkconnections.md) +- [NC_LanChangeProperties](policy-csp-admx-networkconnections.md) +- [NC_RasChangeProperties](policy-csp-admx-networkconnections.md) +- [NC_AdvancedSettings](policy-csp-admx-networkconnections.md) +- [NC_NewConnectionWizard](policy-csp-admx-networkconnections.md) +- [NC_DialupPrefs](policy-csp-admx-networkconnections.md) +- [NC_AddRemoveComponents](policy-csp-admx-networkconnections.md) +- [NC_RasMyProperties](policy-csp-admx-networkconnections.md) +- [NC_RasConnect](policy-csp-admx-networkconnections.md) +- [NC_DeleteConnection](policy-csp-admx-networkconnections.md) +- [NC_ChangeBindState](policy-csp-admx-networkconnections.md) +- [NC_RenameMyRasConnection](policy-csp-admx-networkconnections.md) +- [NC_AllowAdvancedTCPIPConfig](policy-csp-admx-networkconnections.md) +- [NC_Statistics](policy-csp-admx-networkconnections.md) +- [NC_IpStateChecking](policy-csp-admx-networkconnections.md) +- [NC_DoNotShowLocalOnlyIcon](policy-csp-admx-networkconnections.md) +- [NC_PersonalFirewallConfig](policy-csp-admx-networkconnections.md) +- [NC_ShowSharedAccessUI](policy-csp-admx-networkconnections.md) +- [NC_StdDomainUserSetLocation](policy-csp-admx-networkconnections.md) +- [NC_ForceTunneling](policy-csp-admx-networkconnections.md) ## ADMX_OfflineFiles -- [Pol_GoOfflineAction_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-1) -- [Pol_EventLoggingLevel_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-1) -- [Pol_ReminderInitTimeout_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-1) -- [Pol_CustomGoOfflineActions_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-1) -- [Pol_NoCacheViewer_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-1) -- [Pol_NoConfigCache_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-1) -- [Pol_ReminderFreq_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-1) -- [Pol_ReminderTimeout_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-1) -- [Pol_NoMakeAvailableOffline_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-1) -- [Pol_NoPinFiles_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-1) -- [Pol_WorkOfflineDisabled_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-1) -- [Pol_AssignedOfflineFiles_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-1) -- [Pol_SyncAtLogoff_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-1) -- [Pol_SyncAtLogon_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-1) -- [Pol_SyncAtSuspend_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-1) -- [Pol_NoReminders_1](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-1) -- [Pol_GoOfflineAction_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-goofflineaction-2) -- [Pol_Enabled](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-enabled) -- [Pol_PurgeAtLogoff](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-purgeatlogoff) -- [Pol_BackgroundSyncSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-backgroundsyncsettings) -- [Pol_SlowLinkSpeed](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinkspeed) -- [Pol_SlowLinkSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-slowlinksettings) -- [Pol_DefCacheSize](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-defcachesize) -- [Pol_ExclusionListSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-exclusionlistsettings) -- [Pol_SyncOnCostedNetwork](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-synconcostednetwork) -- [Pol_OnlineCachingSettings](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-onlinecachingsettings) -- [Pol_EncryptOfflineFiles](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-encryptofflinefiles) -- [Pol_EventLoggingLevel_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-eventlogginglevel-2) -- [Pol_ExtExclusionList](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-extexclusionlist) -- [Pol_ReminderInitTimeout_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderinittimeout-2) -- [Pol_CacheSize](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-cachesize) -- [Pol_CustomGoOfflineActions_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-customgoofflineactions-2) -- [Pol_NoCacheViewer_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nocacheviewer-2) -- [Pol_NoConfigCache_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noconfigcache-2) -- [Pol_ReminderFreq_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-reminderfreq-2) -- [Pol_ReminderTimeout_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-remindertimeout-2) -- [Pol_NoMakeAvailableOffline_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nomakeavailableoffline-2) -- [Pol_NoPinFiles_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-nopinfiles-2) -- [Pol_WorkOfflineDisabled_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-workofflinedisabled-2) -- [Pol_AssignedOfflineFiles_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-assignedofflinefiles-2) -- [Pol_AlwaysPinSubFolders](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-alwayspinsubfolders) -- [Pol_SyncAtLogoff_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogoff-2) -- [Pol_SyncAtLogon_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatlogon-2) -- [Pol_SyncAtSuspend_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-syncatsuspend-2) -- [Pol_NoReminders_2](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-noreminders-2) -- [Pol_QuickAdimPin](policy-csp-admx-offlinefiles.md#admx-offlinefiles-pol-quickadimpin) +- [Pol_GoOfflineAction_1](policy-csp-admx-offlinefiles.md) +- [Pol_EventLoggingLevel_1](policy-csp-admx-offlinefiles.md) +- [Pol_ReminderInitTimeout_1](policy-csp-admx-offlinefiles.md) +- [Pol_CustomGoOfflineActions_1](policy-csp-admx-offlinefiles.md) +- [Pol_NoCacheViewer_1](policy-csp-admx-offlinefiles.md) +- [Pol_NoConfigCache_1](policy-csp-admx-offlinefiles.md) +- [Pol_ReminderFreq_1](policy-csp-admx-offlinefiles.md) +- [Pol_ReminderTimeout_1](policy-csp-admx-offlinefiles.md) +- [Pol_NoMakeAvailableOffline_1](policy-csp-admx-offlinefiles.md) +- [Pol_NoPinFiles_1](policy-csp-admx-offlinefiles.md) +- [Pol_WorkOfflineDisabled_1](policy-csp-admx-offlinefiles.md) +- [Pol_AssignedOfflineFiles_1](policy-csp-admx-offlinefiles.md) +- [Pol_SyncAtLogoff_1](policy-csp-admx-offlinefiles.md) +- [Pol_SyncAtLogon_1](policy-csp-admx-offlinefiles.md) +- [Pol_SyncAtSuspend_1](policy-csp-admx-offlinefiles.md) +- [Pol_NoReminders_1](policy-csp-admx-offlinefiles.md) +- [Pol_GoOfflineAction_2](policy-csp-admx-offlinefiles.md) +- [Pol_Enabled](policy-csp-admx-offlinefiles.md) +- [Pol_PurgeAtLogoff](policy-csp-admx-offlinefiles.md) +- [Pol_BackgroundSyncSettings](policy-csp-admx-offlinefiles.md) +- [Pol_SlowLinkSpeed](policy-csp-admx-offlinefiles.md) +- [Pol_SlowLinkSettings](policy-csp-admx-offlinefiles.md) +- [Pol_DefCacheSize](policy-csp-admx-offlinefiles.md) +- [Pol_ExclusionListSettings](policy-csp-admx-offlinefiles.md) +- [Pol_SyncOnCostedNetwork](policy-csp-admx-offlinefiles.md) +- [Pol_OnlineCachingSettings](policy-csp-admx-offlinefiles.md) +- [Pol_EncryptOfflineFiles](policy-csp-admx-offlinefiles.md) +- [Pol_EventLoggingLevel_2](policy-csp-admx-offlinefiles.md) +- [Pol_ExtExclusionList](policy-csp-admx-offlinefiles.md) +- [Pol_ReminderInitTimeout_2](policy-csp-admx-offlinefiles.md) +- [Pol_CacheSize](policy-csp-admx-offlinefiles.md) +- [Pol_CustomGoOfflineActions_2](policy-csp-admx-offlinefiles.md) +- [Pol_NoCacheViewer_2](policy-csp-admx-offlinefiles.md) +- [Pol_NoConfigCache_2](policy-csp-admx-offlinefiles.md) +- [Pol_ReminderFreq_2](policy-csp-admx-offlinefiles.md) +- [Pol_ReminderTimeout_2](policy-csp-admx-offlinefiles.md) +- [Pol_NoMakeAvailableOffline_2](policy-csp-admx-offlinefiles.md) +- [Pol_NoPinFiles_2](policy-csp-admx-offlinefiles.md) +- [Pol_WorkOfflineDisabled_2](policy-csp-admx-offlinefiles.md) +- [Pol_AssignedOfflineFiles_2](policy-csp-admx-offlinefiles.md) +- [Pol_AlwaysPinSubFolders](policy-csp-admx-offlinefiles.md) +- [Pol_SyncAtLogoff_2](policy-csp-admx-offlinefiles.md) +- [Pol_SyncAtLogon_2](policy-csp-admx-offlinefiles.md) +- [Pol_SyncAtSuspend_2](policy-csp-admx-offlinefiles.md) +- [Pol_NoReminders_2](policy-csp-admx-offlinefiles.md) +- [Pol_QuickAdimPin](policy-csp-admx-offlinefiles.md) ## ADMX_pca -- [DetectDeprecatedCOMComponentFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectdeprecatedcomcomponentfailurespolicy) -- [DetectDeprecatedComponentFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectdeprecatedcomponentfailurespolicy) -- [DetectInstallFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectinstallfailurespolicy) -- [DetectUndetectedInstallersPolicy](policy-csp-admx-pca.md#admx-pca-detectundetectedinstallerspolicy) -- [DetectUpdateFailuresPolicy](policy-csp-admx-pca.md#admx-pca-detectupdatefailurespolicy) -- [DisablePcaUIPolicy](policy-csp-admx-pca.md#admx-pca-disablepcauipolicy) -- [DetectBlockedDriversPolicy](policy-csp-admx-pca.md#admx-pca-detectblockeddriverspolicy) +- [DetectDeprecatedCOMComponentFailuresPolicy](policy-csp-admx-pca.md) +- [DetectDeprecatedComponentFailuresPolicy](policy-csp-admx-pca.md) +- [DetectInstallFailuresPolicy](policy-csp-admx-pca.md) +- [DetectUndetectedInstallersPolicy](policy-csp-admx-pca.md) +- [DetectUpdateFailuresPolicy](policy-csp-admx-pca.md) +- [DisablePcaUIPolicy](policy-csp-admx-pca.md) +- [DetectBlockedDriversPolicy](policy-csp-admx-pca.md) ## ADMX_PeerToPeerCaching -- [EnableWindowsBranchCache_SMB](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-smb) -- [SetDowngrading](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdowngrading) -- [EnableWindowsBranchCache_HostedMultipleServers](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedmultipleservers) -- [EnableWindowsBranchCache_HostedCacheDiscovery](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hostedcachediscovery) -- [SetDataCacheEntryMaxAge](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setdatacacheentrymaxage) -- [EnableWindowsBranchCache_Distributed](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-distributed) -- [EnableWindowsBranchCache_Hosted](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache-hosted) -- [SetCachePercent](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-setcachepercent) -- [EnableWindowsBranchCache](policy-csp-admx-peertopeercaching.md#admx-peertopeercaching-enablewindowsbranchcache) +- [EnableWindowsBranchCache_SMB](policy-csp-admx-peertopeercaching.md) +- [SetDowngrading](policy-csp-admx-peertopeercaching.md) +- [EnableWindowsBranchCache_HostedMultipleServers](policy-csp-admx-peertopeercaching.md) +- [EnableWindowsBranchCache_HostedCacheDiscovery](policy-csp-admx-peertopeercaching.md) +- [SetDataCacheEntryMaxAge](policy-csp-admx-peertopeercaching.md) +- [EnableWindowsBranchCache_Distributed](policy-csp-admx-peertopeercaching.md) +- [EnableWindowsBranchCache_Hosted](policy-csp-admx-peertopeercaching.md) +- [SetCachePercent](policy-csp-admx-peertopeercaching.md) +- [EnableWindowsBranchCache](policy-csp-admx-peertopeercaching.md) ## ADMX_PenTraining -- [PenTrainingOff_1](policy-csp-admx-pentraining.md#admx-pentraining-pentrainingoff-1) -- [PenTrainingOff_2](policy-csp-admx-pentraining.md#admx-pentraining-pentrainingoff-2) +- [PenTrainingOff_1](policy-csp-admx-pentraining.md) +- [PenTrainingOff_2](policy-csp-admx-pentraining.md) ## ADMX_PerformanceDiagnostics -- [WdiScenarioExecutionPolicy_1](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-1) -- [WdiScenarioExecutionPolicy_3](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-3) -- [WdiScenarioExecutionPolicy_4](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-4) -- [WdiScenarioExecutionPolicy_2](policy-csp-admx-performancediagnostics.md#admx-performancediagnostics-wdiscenarioexecutionpolicy-2) +- [WdiScenarioExecutionPolicy_1](policy-csp-admx-performancediagnostics.md) +- [WdiScenarioExecutionPolicy_3](policy-csp-admx-performancediagnostics.md) +- [WdiScenarioExecutionPolicy_4](policy-csp-admx-performancediagnostics.md) +- [WdiScenarioExecutionPolicy_2](policy-csp-admx-performancediagnostics.md) ## ADMX_Power -- [PW_PromptPasswordOnResume](policy-csp-admx-power.md#admx-power-pw-promptpasswordonresume) -- [Dont_PowerOff_AfterShutdown](policy-csp-admx-power.md#admx-power-dont-poweroff-aftershutdown) -- [DCStartMenuButtonAction_2](policy-csp-admx-power.md#admx-power-dcstartmenubuttonaction-2) -- [ACStartMenuButtonAction_2](policy-csp-admx-power.md#admx-power-acstartmenubuttonaction-2) -- [DiskDCPowerDownTimeOut_2](policy-csp-admx-power.md#admx-power-diskdcpowerdowntimeout-2) -- [DiskACPowerDownTimeOut_2](policy-csp-admx-power.md#admx-power-diskacpowerdowntimeout-2) -- [DCBatteryDischargeAction0_2](policy-csp-admx-power.md#admx-power-dcbatterydischargeaction0-2) -- [DCBatteryDischargeLevel0_2](policy-csp-admx-power.md#admx-power-dcbatterydischargelevel0-2) -- [DCBatteryDischargeAction1_2](policy-csp-admx-power.md#admx-power-dcbatterydischargeaction1-2) -- [DCBatteryDischargeLevel1_2](policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1-2) -- [ReserveBatteryNotificationLevel](policy-csp-admx-power.md#admx-power-reservebatterynotificationlevel) -- [DCBatteryDischargeLevel1UINotification_2](policy-csp-admx-power.md#admx-power-dcbatterydischargelevel1uinotification-2) -- [PowerThrottlingTurnOff](policy-csp-admx-power.md#admx-power-powerthrottlingturnoff) -- [InboxActiveSchemeOverride_2](policy-csp-admx-power.md#admx-power-inboxactiveschemeoverride-2) -- [AllowSystemPowerRequestDC](policy-csp-admx-power.md#admx-power-allowsystempowerrequestdc) -- [AllowSystemPowerRequestAC](policy-csp-admx-power.md#admx-power-allowsystempowerrequestac) -- [AllowSystemSleepWithRemoteFilesOpenDC](policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopendc) -- [AllowSystemSleepWithRemoteFilesOpenAC](policy-csp-admx-power.md#admx-power-allowsystemsleepwithremotefilesopenac) -- [DCConnectivityInStandby_2](policy-csp-admx-power.md#admx-power-dcconnectivityinstandby-2) -- [ACConnectivityInStandby_2](policy-csp-admx-power.md#admx-power-acconnectivityinstandby-2) -- [DCCriticalSleepTransitionsDisable_2](policy-csp-admx-power.md#admx-power-dccriticalsleeptransitionsdisable-2) -- [ACCriticalSleepTransitionsDisable_2](policy-csp-admx-power.md#admx-power-accriticalsleeptransitionsdisable-2) -- [CustomActiveSchemeOverride_2](policy-csp-admx-power.md#admx-power-customactiveschemeoverride-2) -- [EnableDesktopSlideShowDC](policy-csp-admx-power.md#admx-power-enabledesktopslideshowdc) -- [EnableDesktopSlideShowAC](policy-csp-admx-power.md#admx-power-enabledesktopslideshowac) +- [PW_PromptPasswordOnResume](policy-csp-admx-power.md) +- [Dont_PowerOff_AfterShutdown](policy-csp-admx-power.md) +- [DCStartMenuButtonAction_2](policy-csp-admx-power.md) +- [ACStartMenuButtonAction_2](policy-csp-admx-power.md) +- [DiskDCPowerDownTimeOut_2](policy-csp-admx-power.md) +- [DiskACPowerDownTimeOut_2](policy-csp-admx-power.md) +- [DCBatteryDischargeAction0_2](policy-csp-admx-power.md) +- [DCBatteryDischargeLevel0_2](policy-csp-admx-power.md) +- [DCBatteryDischargeAction1_2](policy-csp-admx-power.md) +- [DCBatteryDischargeLevel1_2](policy-csp-admx-power.md) +- [ReserveBatteryNotificationLevel](policy-csp-admx-power.md) +- [DCBatteryDischargeLevel1UINotification_2](policy-csp-admx-power.md) +- [PowerThrottlingTurnOff](policy-csp-admx-power.md) +- [InboxActiveSchemeOverride_2](policy-csp-admx-power.md) +- [AllowSystemPowerRequestDC](policy-csp-admx-power.md) +- [AllowSystemPowerRequestAC](policy-csp-admx-power.md) +- [AllowSystemSleepWithRemoteFilesOpenDC](policy-csp-admx-power.md) +- [AllowSystemSleepWithRemoteFilesOpenAC](policy-csp-admx-power.md) +- [DCConnectivityInStandby_2](policy-csp-admx-power.md) +- [ACConnectivityInStandby_2](policy-csp-admx-power.md) +- [DCCriticalSleepTransitionsDisable_2](policy-csp-admx-power.md) +- [ACCriticalSleepTransitionsDisable_2](policy-csp-admx-power.md) +- [CustomActiveSchemeOverride_2](policy-csp-admx-power.md) +- [EnableDesktopSlideShowDC](policy-csp-admx-power.md) +- [EnableDesktopSlideShowAC](policy-csp-admx-power.md) ## ADMX_PowerShellExecutionPolicy -- [EnableUpdateHelpDefaultSourcePath](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) -- [EnableModuleLogging](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) -- [EnableTranscripting](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) -- [EnableScripts](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) -- [EnableUpdateHelpDefaultSourcePath](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) -- [EnableModuleLogging](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablemodulelogging) -- [EnableTranscripting](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) -- [EnableScripts](policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) +- [EnableUpdateHelpDefaultSourcePath](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableModuleLogging](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableTranscripting](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableScripts](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableUpdateHelpDefaultSourcePath](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableModuleLogging](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableTranscripting](policy-csp-admx-powershellexecutionpolicy.md) +- [EnableScripts](policy-csp-admx-powershellexecutionpolicy.md) ## ADMX_PreviousVersions -- [DisableLocalPage_1](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalpage-1) -- [DisableRemotePage_1](policy-csp-admx-previousversions.md#admx-previousversions-disableremotepage-1) -- [HideBackupEntries_1](policy-csp-admx-previousversions.md#admx-previousversions-hidebackupentries-1) -- [DisableLocalRestore_1](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalrestore-1) -- [DisableBackupRestore_1](policy-csp-admx-previousversions.md#admx-previousversions-disablebackuprestore-1) -- [DisableRemoteRestore_1](policy-csp-admx-previousversions.md#admx-previousversions-disableremoterestore-1) -- [DisableLocalPage_2](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalpage-2) -- [DisableRemotePage_2](policy-csp-admx-previousversions.md#admx-previousversions-disableremotepage-2) -- [HideBackupEntries_2](policy-csp-admx-previousversions.md#admx-previousversions-hidebackupentries-2) -- [DisableLocalRestore_2](policy-csp-admx-previousversions.md#admx-previousversions-disablelocalrestore-2) -- [DisableBackupRestore_2](policy-csp-admx-previousversions.md#admx-previousversions-disablebackuprestore-2) -- [DisableRemoteRestore_2](policy-csp-admx-previousversions.md#admx-previousversions-disableremoterestore-2) +- [DisableLocalPage_1](policy-csp-admx-previousversions.md) +- [DisableRemotePage_1](policy-csp-admx-previousversions.md) +- [HideBackupEntries_1](policy-csp-admx-previousversions.md) +- [DisableLocalRestore_1](policy-csp-admx-previousversions.md) +- [DisableBackupRestore_1](policy-csp-admx-previousversions.md) +- [DisableRemoteRestore_1](policy-csp-admx-previousversions.md) +- [DisableLocalPage_2](policy-csp-admx-previousversions.md) +- [DisableRemotePage_2](policy-csp-admx-previousversions.md) +- [HideBackupEntries_2](policy-csp-admx-previousversions.md) +- [DisableLocalRestore_2](policy-csp-admx-previousversions.md) +- [DisableBackupRestore_2](policy-csp-admx-previousversions.md) +- [DisableRemoteRestore_2](policy-csp-admx-previousversions.md) ## ADMX_Printing -- [IntranetPrintersUrl](policy-csp-admx-printing.md#admx-printing-intranetprintersurl) -- [DownlevelBrowse](policy-csp-admx-printing.md#admx-printing-downlevelbrowse) -- [PrinterDirectorySearchScope](policy-csp-admx-printing.md#admx-printing-printerdirectorysearchscope) -- [PackagePointAndPrintOnly](policy-csp-admx-printing.md#admx-printing-packagepointandprintonly) -- [PackagePointAndPrintServerList](policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist) -- [NoDeletePrinter](policy-csp-admx-printing.md#admx-printing-nodeleteprinter) -- [LegacyDefaultPrinterMode](policy-csp-admx-printing.md#admx-printing-legacydefaultprintermode) -- [AllowWebPrinting](policy-csp-admx-printing.md#admx-printing-allowwebprinting) -- [DomainPrinters](policy-csp-admx-printing.md#admx-printing-domainprinters) -- [NonDomainPrinters](policy-csp-admx-printing.md#admx-printing-nondomainprinters) -- [ShowJobTitleInEventLogs](policy-csp-admx-printing.md#admx-printing-showjobtitleineventlogs) -- [ForceSoftwareRasterization](policy-csp-admx-printing.md#admx-printing-forcesoftwarerasterization) -- [EMFDespooling](policy-csp-admx-printing.md#admx-printing-emfdespooling) -- [MXDWUseLegacyOutputFormatMSXPS](policy-csp-admx-printing.md#admx-printing-mxdwuselegacyoutputformatmsxps) -- [PhysicalLocation](policy-csp-admx-printing.md#admx-printing-physicallocation) -- [CustomizedSupportUrl](policy-csp-admx-printing.md#admx-printing-customizedsupporturl) -- [KMPrintersAreBlocked](policy-csp-admx-printing.md#admx-printing-kmprintersareblocked) -- [V4DriverDisallowPrinterExtension](policy-csp-admx-printing.md#admx-printing-v4driverdisallowprinterextension) -- [PrintDriverIsolationExecutionPolicy](policy-csp-admx-printing.md#admx-printing-printdriverisolationexecutionpolicy) -- [DoNotInstallCompatibleDriverFromWindowsUpdate](policy-csp-admx-printing.md#admx-printing-donotinstallcompatibledriverfromwindowsupdate) -- [ApplicationDriverIsolation](policy-csp-admx-printing.md#admx-printing-applicationdriverisolation) -- [PackagePointAndPrintOnly_Win7](policy-csp-admx-printing.md#admx-printing-packagepointandprintonly-win7) -- [PrintDriverIsolationOverrideCompat](policy-csp-admx-printing.md#admx-printing-printdriverisolationoverridecompat) -- [PackagePointAndPrintServerList_Win7](policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist-win7) -- [PhysicalLocationSupport](policy-csp-admx-printing.md#admx-printing-physicallocationsupport) -- [PrinterServerThread](policy-csp-admx-printing.md#admx-printing-printerserverthread) +- [IntranetPrintersUrl](policy-csp-admx-printing.md) +- [DownlevelBrowse](policy-csp-admx-printing.md) +- [PrinterDirectorySearchScope](policy-csp-admx-printing.md) +- [PackagePointAndPrintOnly](policy-csp-admx-printing.md) +- [PackagePointAndPrintServerList](policy-csp-admx-printing.md) +- [NoDeletePrinter](policy-csp-admx-printing.md) +- [LegacyDefaultPrinterMode](policy-csp-admx-printing.md) +- [AllowWebPrinting](policy-csp-admx-printing.md) +- [DomainPrinters](policy-csp-admx-printing.md) +- [NonDomainPrinters](policy-csp-admx-printing.md) +- [ShowJobTitleInEventLogs](policy-csp-admx-printing.md) +- [ForceSoftwareRasterization](policy-csp-admx-printing.md) +- [EMFDespooling](policy-csp-admx-printing.md) +- [MXDWUseLegacyOutputFormatMSXPS](policy-csp-admx-printing.md) +- [PhysicalLocation](policy-csp-admx-printing.md) +- [CustomizedSupportUrl](policy-csp-admx-printing.md) +- [KMPrintersAreBlocked](policy-csp-admx-printing.md) +- [V4DriverDisallowPrinterExtension](policy-csp-admx-printing.md) +- [PrintDriverIsolationExecutionPolicy](policy-csp-admx-printing.md) +- [DoNotInstallCompatibleDriverFromWindowsUpdate](policy-csp-admx-printing.md) +- [ApplicationDriverIsolation](policy-csp-admx-printing.md) +- [PackagePointAndPrintOnly_Win7](policy-csp-admx-printing.md) +- [PrintDriverIsolationOverrideCompat](policy-csp-admx-printing.md) +- [PackagePointAndPrintServerList_Win7](policy-csp-admx-printing.md) +- [PhysicalLocationSupport](policy-csp-admx-printing.md) +- [PrinterServerThread](policy-csp-admx-printing.md) ## ADMX_Printing2 -- [RegisterSpoolerRemoteRpcEndPoint](policy-csp-admx-printing2.md#admx-printing2-registerspoolerremoterpcendpoint) -- [ImmortalPrintQueue](policy-csp-admx-printing2.md#admx-printing2-immortalprintqueue) -- [AutoPublishing](policy-csp-admx-printing2.md#admx-printing2-autopublishing) -- [VerifyPublishedState](policy-csp-admx-printing2.md#admx-printing2-verifypublishedstate) -- [PruningInterval](policy-csp-admx-printing2.md#admx-printing2-pruninginterval) -- [PruningPriority](policy-csp-admx-printing2.md#admx-printing2-pruningpriority) -- [PruningRetries](policy-csp-admx-printing2.md#admx-printing2-pruningretries) -- [PruningRetryLog](policy-csp-admx-printing2.md#admx-printing2-pruningretrylog) -- [PruneDownlevel](policy-csp-admx-printing2.md#admx-printing2-prunedownlevel) +- [RegisterSpoolerRemoteRpcEndPoint](policy-csp-admx-printing2.md) +- [ImmortalPrintQueue](policy-csp-admx-printing2.md) +- [AutoPublishing](policy-csp-admx-printing2.md) +- [VerifyPublishedState](policy-csp-admx-printing2.md) +- [PruningInterval](policy-csp-admx-printing2.md) +- [PruningPriority](policy-csp-admx-printing2.md) +- [PruningRetries](policy-csp-admx-printing2.md) +- [PruningRetryLog](policy-csp-admx-printing2.md) +- [PruneDownlevel](policy-csp-admx-printing2.md) ## ADMX_Programs -- [NoGetPrograms](policy-csp-admx-programs.md#admx-programs-nogetprograms) -- [NoInstalledUpdates](policy-csp-admx-programs.md#admx-programs-noinstalledupdates) -- [NoProgramsAndFeatures](policy-csp-admx-programs.md#admx-programs-noprogramsandfeatures) -- [NoDefaultPrograms](policy-csp-admx-programs.md#admx-programs-nodefaultprograms) -- [NoWindowsFeatures](policy-csp-admx-programs.md#admx-programs-nowindowsfeatures) -- [NoWindowsMarketplace](policy-csp-admx-programs.md#admx-programs-nowindowsmarketplace) -- [NoProgramsCPL](policy-csp-admx-programs.md#admx-programs-noprogramscpl) +- [NoGetPrograms](policy-csp-admx-programs.md) +- [NoInstalledUpdates](policy-csp-admx-programs.md) +- [NoProgramsAndFeatures](policy-csp-admx-programs.md) +- [NoDefaultPrograms](policy-csp-admx-programs.md) +- [NoWindowsFeatures](policy-csp-admx-programs.md) +- [NoWindowsMarketplace](policy-csp-admx-programs.md) +- [NoProgramsCPL](policy-csp-admx-programs.md) ## ADMX_PushToInstall -- [DisablePushToInstall](policy-csp-admx-pushtoinstall.md#admx-pushtoinstall-disablepushtoinstall) +- [DisablePushToInstall](policy-csp-admx-pushtoinstall.md) ## ADMX_QOS -- [QosServiceTypeBestEffort_C](policy-csp-admx-qos.md#admx-qos-qosservicetypebesteffort-c) -- [QosServiceTypeControlledLoad_C](policy-csp-admx-qos.md#admx-qos-qosservicetypecontrolledload-c) -- [QosServiceTypeGuaranteed_C](policy-csp-admx-qos.md#admx-qos-qosservicetypeguaranteed-c) -- [QosServiceTypeNetworkControl_C](policy-csp-admx-qos.md#admx-qos-qosservicetypenetworkcontrol-c) -- [QosServiceTypeQualitative_C](policy-csp-admx-qos.md#admx-qos-qosservicetypequalitative-c) -- [QosServiceTypeBestEffort_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypebesteffort-nc) -- [QosServiceTypeControlledLoad_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypecontrolledload-nc) -- [QosServiceTypeGuaranteed_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypeguaranteed-nc) -- [QosServiceTypeNetworkControl_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypenetworkcontrol-nc) -- [QosServiceTypeQualitative_NC](policy-csp-admx-qos.md#admx-qos-qosservicetypequalitative-nc) -- [QosServiceTypeBestEffort_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypebesteffort-pv) -- [QosServiceTypeControlledLoad_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypecontrolledload-pv) -- [QosServiceTypeGuaranteed_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypeguaranteed-pv) -- [QosServiceTypeNetworkControl_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypenetworkcontrol-pv) -- [QosServiceTypeNonConforming](policy-csp-admx-qos.md#admx-qos-qosservicetypenonconforming) -- [QosServiceTypeQualitative_PV](policy-csp-admx-qos.md#admx-qos-qosservicetypequalitative-pv) -- [QosMaxOutstandingSends](policy-csp-admx-qos.md#admx-qos-qosmaxoutstandingsends) -- [QosNonBestEffortLimit](policy-csp-admx-qos.md#admx-qos-qosnonbesteffortlimit) -- [QosTimerResolution](policy-csp-admx-qos.md#admx-qos-qostimerresolution) +- [QosServiceTypeBestEffort_C](policy-csp-admx-qos.md) +- [QosServiceTypeControlledLoad_C](policy-csp-admx-qos.md) +- [QosServiceTypeGuaranteed_C](policy-csp-admx-qos.md) +- [QosServiceTypeNetworkControl_C](policy-csp-admx-qos.md) +- [QosServiceTypeQualitative_C](policy-csp-admx-qos.md) +- [QosServiceTypeBestEffort_NC](policy-csp-admx-qos.md) +- [QosServiceTypeControlledLoad_NC](policy-csp-admx-qos.md) +- [QosServiceTypeGuaranteed_NC](policy-csp-admx-qos.md) +- [QosServiceTypeNetworkControl_NC](policy-csp-admx-qos.md) +- [QosServiceTypeQualitative_NC](policy-csp-admx-qos.md) +- [QosServiceTypeBestEffort_PV](policy-csp-admx-qos.md) +- [QosServiceTypeControlledLoad_PV](policy-csp-admx-qos.md) +- [QosServiceTypeGuaranteed_PV](policy-csp-admx-qos.md) +- [QosServiceTypeNetworkControl_PV](policy-csp-admx-qos.md) +- [QosServiceTypeNonConforming](policy-csp-admx-qos.md) +- [QosServiceTypeQualitative_PV](policy-csp-admx-qos.md) +- [QosMaxOutstandingSends](policy-csp-admx-qos.md) +- [QosNonBestEffortLimit](policy-csp-admx-qos.md) +- [QosTimerResolution](policy-csp-admx-qos.md) ## ADMX_Radar -- [WdiScenarioExecutionPolicy](policy-csp-admx-radar.md#admx-radar-wdiscenarioexecutionpolicy) +- [WdiScenarioExecutionPolicy](policy-csp-admx-radar.md) ## ADMX_Reliability -- [ShutdownEventTrackerStateFile](policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) -- [ShutdownReason](policy-csp-admx-reliability.md#admx-reliability-shutdownreason) -- [EE_EnablePersistentTimeStamp](policy-csp-admx-reliability.md#admx-reliability-ee-enablepersistenttimestamp) -- [PCH_ReportShutdownEvents](policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) +- [ShutdownEventTrackerStateFile](policy-csp-admx-reliability.md) +- [ShutdownReason](policy-csp-admx-reliability.md) +- [EE_EnablePersistentTimeStamp](policy-csp-admx-reliability.md) +- [PCH_ReportShutdownEvents](policy-csp-admx-reliability.md) ## ADMX_RemoteAssistance -- [RA_EncryptedTicketOnly](policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-encryptedticketonly) -- [RA_Optimize_Bandwidth](policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-optimize-bandwidth) +- [RA_EncryptedTicketOnly](policy-csp-admx-remoteassistance.md) +- [RA_Optimize_Bandwidth](policy-csp-admx-remoteassistance.md) ## ADMX_RemovableStorage -- [RemovableStorageClasses_DenyAll_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-1) -- [CDandDVD_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-1) -- [CDandDVD_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-1) -- [CustomClasses_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-1) -- [CustomClasses_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-1) -- [FloppyDrives_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-1) -- [FloppyDrives_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-1) -- [RemovableDisks_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-1) -- [RemovableDisks_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denywrite-access-1) -- [AccessRights_RebootTime_1](policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-1) -- [TapeDrives_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-1) -- [TapeDrives_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-1) -- [WPDDevices_DenyRead_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-1) -- [WPDDevices_DenyWrite_Access_1](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-1) -- [RemovableStorageClasses_DenyAll_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-2) -- [Removable_Remote_Allow_Access](policy-csp-admx-removablestorage.md#admx-removablestorage-removable-remote-allow-access) -- [CDandDVD_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyexecute-access-2) -- [CDandDVD_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-2) -- [CDandDVD_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-2) -- [CustomClasses_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-2) -- [CustomClasses_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-2) -- [FloppyDrives_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyexecute-access-2) -- [FloppyDrives_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-2) -- [FloppyDrives_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-2) -- [RemovableDisks_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyexecute-access-2) -- [RemovableDisks_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-2) -- [AccessRights_RebootTime_2](policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-2) -- [TapeDrives_DenyExecute_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyexecute-access-2) -- [TapeDrives_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-2) -- [TapeDrives_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-2) -- [WPDDevices_DenyRead_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-2) -- [WPDDevices_DenyWrite_Access_2](policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-2) +- [RemovableStorageClasses_DenyAll_Access_1](policy-csp-admx-removablestorage.md) +- [CDandDVD_DenyRead_Access_1](policy-csp-admx-removablestorage.md) +- [CDandDVD_DenyWrite_Access_1](policy-csp-admx-removablestorage.md) +- [CustomClasses_DenyRead_Access_1](policy-csp-admx-removablestorage.md) +- [CustomClasses_DenyWrite_Access_1](policy-csp-admx-removablestorage.md) +- [FloppyDrives_DenyRead_Access_1](policy-csp-admx-removablestorage.md) +- [FloppyDrives_DenyWrite_Access_1](policy-csp-admx-removablestorage.md) +- [RemovableDisks_DenyRead_Access_1](policy-csp-admx-removablestorage.md) +- [RemovableDisks_DenyWrite_Access_1](policy-csp-admx-removablestorage.md) +- [AccessRights_RebootTime_1](policy-csp-admx-removablestorage.md) +- [TapeDrives_DenyRead_Access_1](policy-csp-admx-removablestorage.md) +- [TapeDrives_DenyWrite_Access_1](policy-csp-admx-removablestorage.md) +- [WPDDevices_DenyRead_Access_1](policy-csp-admx-removablestorage.md) +- [WPDDevices_DenyWrite_Access_1](policy-csp-admx-removablestorage.md) +- [RemovableStorageClasses_DenyAll_Access_2](policy-csp-admx-removablestorage.md) +- [Removable_Remote_Allow_Access](policy-csp-admx-removablestorage.md) +- [CDandDVD_DenyExecute_Access_2](policy-csp-admx-removablestorage.md) +- [CDandDVD_DenyRead_Access_2](policy-csp-admx-removablestorage.md) +- [CDandDVD_DenyWrite_Access_2](policy-csp-admx-removablestorage.md) +- [CustomClasses_DenyRead_Access_2](policy-csp-admx-removablestorage.md) +- [CustomClasses_DenyWrite_Access_2](policy-csp-admx-removablestorage.md) +- [FloppyDrives_DenyExecute_Access_2](policy-csp-admx-removablestorage.md) +- [FloppyDrives_DenyRead_Access_2](policy-csp-admx-removablestorage.md) +- [FloppyDrives_DenyWrite_Access_2](policy-csp-admx-removablestorage.md) +- [RemovableDisks_DenyExecute_Access_2](policy-csp-admx-removablestorage.md) +- [RemovableDisks_DenyRead_Access_2](policy-csp-admx-removablestorage.md) +- [AccessRights_RebootTime_2](policy-csp-admx-removablestorage.md) +- [TapeDrives_DenyExecute_Access_2](policy-csp-admx-removablestorage.md) +- [TapeDrives_DenyRead_Access_2](policy-csp-admx-removablestorage.md) +- [TapeDrives_DenyWrite_Access_2](policy-csp-admx-removablestorage.md) +- [WPDDevices_DenyRead_Access_2](policy-csp-admx-removablestorage.md) +- [WPDDevices_DenyWrite_Access_2](policy-csp-admx-removablestorage.md) ## ADMX_RPC -- [RpcIgnoreDelegationFailure](policy-csp-admx-rpc.md#admx-rpc-rpcignoredelegationfailure) -- [RpcStateInformation](policy-csp-admx-rpc.md#admx-rpc-rpcstateinformation) -- [RpcExtendedErrorInformation](policy-csp-admx-rpc.md#admx-rpc-rpcextendederrorinformation) -- [RpcMinimumHttpConnectionTimeout](policy-csp-admx-rpc.md#admx-rpc-rpcminimumhttpconnectiontimeout) +- [RpcIgnoreDelegationFailure](policy-csp-admx-rpc.md) +- [RpcStateInformation](policy-csp-admx-rpc.md) +- [RpcExtendedErrorInformation](policy-csp-admx-rpc.md) +- [RpcMinimumHttpConnectionTimeout](policy-csp-admx-rpc.md) ## ADMX_sam -- [SamNGCKeyROCAValidation](policy-csp-admx-sam.md#admx-sam-samngckeyrocavalidation) +- [SamNGCKeyROCAValidation](policy-csp-admx-sam.md) ## ADMX_Scripts -- [Run_Logoff_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-logoff-script-visible) -- [Run_Logon_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-logon-script-visible) -- [Run_Legacy_Logon_Script_Hidden](policy-csp-admx-scripts.md#admx-scripts-run-legacy-logon-script-hidden) -- [Run_Logon_Script_Sync_1](policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-1) -- [Run_User_PS_Scripts_First](policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) -- [Allow_Logon_Script_NetbiosDisabled](policy-csp-admx-scripts.md#admx-scripts-allow-logon-script-netbiosdisabled) -- [Run_Shutdown_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-shutdown-script-visible) -- [Run_Startup_Script_Visible](policy-csp-admx-scripts.md#admx-scripts-run-startup-script-visible) -- [Run_Logon_Script_Sync_2](policy-csp-admx-scripts.md#admx-scripts-run-logon-script-sync-2) -- [Run_Startup_Script_Sync](policy-csp-admx-scripts.md#admx-scripts-run-startup-script-sync) -- [Run_Computer_PS_Scripts_First](policy-csp-admx-scripts.md#admx-scripts-run-computer-ps-scripts-first) -- [Run_User_PS_Scripts_First](policy-csp-admx-scripts.md#admx-scripts-run-user-ps-scripts-first) -- [MaxGPOScriptWaitPolicy](policy-csp-admx-scripts.md#admx-scripts-maxgposcriptwaitpolicy) +- [Run_Logoff_Script_Visible](policy-csp-admx-scripts.md) +- [Run_Logon_Script_Visible](policy-csp-admx-scripts.md) +- [Run_Legacy_Logon_Script_Hidden](policy-csp-admx-scripts.md) +- [Run_Logon_Script_Sync_1](policy-csp-admx-scripts.md) +- [Run_User_PS_Scripts_First](policy-csp-admx-scripts.md) +- [Allow_Logon_Script_NetbiosDisabled](policy-csp-admx-scripts.md) +- [Run_Shutdown_Script_Visible](policy-csp-admx-scripts.md) +- [Run_Startup_Script_Visible](policy-csp-admx-scripts.md) +- [Run_Logon_Script_Sync_2](policy-csp-admx-scripts.md) +- [Run_Startup_Script_Sync](policy-csp-admx-scripts.md) +- [Run_Computer_PS_Scripts_First](policy-csp-admx-scripts.md) +- [Run_User_PS_Scripts_First](policy-csp-admx-scripts.md) +- [MaxGPOScriptWaitPolicy](policy-csp-admx-scripts.md) ## ADMX_sdiageng -- [ScriptedDiagnosticsSecurityPolicy](policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticssecuritypolicy) -- [ScriptedDiagnosticsExecutionPolicy](policy-csp-admx-sdiageng.md#admx-sdiageng-scripteddiagnosticsexecutionpolicy) -- [BetterWhenConnected](policy-csp-admx-sdiageng.md#admx-sdiageng-betterwhenconnected) +- [ScriptedDiagnosticsSecurityPolicy](policy-csp-admx-sdiageng.md) +- [ScriptedDiagnosticsExecutionPolicy](policy-csp-admx-sdiageng.md) +- [BetterWhenConnected](policy-csp-admx-sdiageng.md) ## ADMX_sdiagschd -- [ScheduledDiagnosticsExecutionPolicy](policy-csp-admx-sdiagschd.md#admx-sdiagschd-scheduleddiagnosticsexecutionpolicy) +- [ScheduledDiagnosticsExecutionPolicy](policy-csp-admx-sdiagschd.md) ## ADMX_Securitycenter -- [SecurityCenter_SecurityCenterInDomain](policy-csp-admx-securitycenter.md#admx-securitycenter-securitycenter-securitycenterindomain) +- [SecurityCenter_SecurityCenterInDomain](policy-csp-admx-securitycenter.md) ## ADMX_Sensors -- [DisableLocation_1](policy-csp-admx-sensors.md#admx-sensors-disablelocation-1) -- [DisableLocationScripting_1](policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-1) -- [DisableSensors_1](policy-csp-admx-sensors.md#admx-sensors-disablesensors-1) -- [DisableLocationScripting_2](policy-csp-admx-sensors.md#admx-sensors-disablelocationscripting-2) -- [DisableSensors_2](policy-csp-admx-sensors.md#admx-sensors-disablesensors-2) +- [DisableLocation_1](policy-csp-admx-sensors.md) +- [DisableLocationScripting_1](policy-csp-admx-sensors.md) +- [DisableSensors_1](policy-csp-admx-sensors.md) +- [DisableLocationScripting_2](policy-csp-admx-sensors.md) +- [DisableSensors_2](policy-csp-admx-sensors.md) ## ADMX_ServerManager -- [Do_not_display_Manage_Your_Server_page](policy-csp-admx-servermanager.md#admx-servermanager-do-not-display-manage-your-server-page) -- [ServerManagerAutoRefreshRate](policy-csp-admx-servermanager.md#admx-servermanager-servermanagerautorefreshrate) -- [DoNotLaunchInitialConfigurationTasks](policy-csp-admx-servermanager.md#admx-servermanager-donotlaunchinitialconfigurationtasks) -- [DoNotLaunchServerManager](policy-csp-admx-servermanager.md#admx-servermanager-donotlaunchservermanager) +- [Do_not_display_Manage_Your_Server_page](policy-csp-admx-servermanager.md) +- [ServerManagerAutoRefreshRate](policy-csp-admx-servermanager.md) +- [DoNotLaunchInitialConfigurationTasks](policy-csp-admx-servermanager.md) +- [DoNotLaunchServerManager](policy-csp-admx-servermanager.md) ## ADMX_Servicing -- [Servicing](policy-csp-admx-servicing.md#admx-servicing-servicing) +- [Servicing](policy-csp-admx-servicing.md) ## ADMX_SettingSync -- [DisableSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablesettingsync) -- [DisableApplicationSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disableapplicationsettingsync) -- [DisableAppSyncSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disableappsyncsettingsync) -- [DisableDesktopThemeSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disabledesktopthemesettingsync) -- [DisableSyncOnPaidNetwork](policy-csp-admx-settingsync.md#admx-settingsync-disablesynconpaidnetwork) -- [DisableWindowsSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablewindowssettingsync) -- [DisableCredentialsSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablecredentialssettingsync) -- [DisablePersonalizationSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablepersonalizationsettingsync) -- [DisableStartLayoutSettingSync](policy-csp-admx-settingsync.md#admx-settingsync-disablestartlayoutsettingsync) +- [DisableSettingSync](policy-csp-admx-settingsync.md) +- [DisableApplicationSettingSync](policy-csp-admx-settingsync.md) +- [DisableAppSyncSettingSync](policy-csp-admx-settingsync.md) +- [DisableDesktopThemeSettingSync](policy-csp-admx-settingsync.md) +- [DisableSyncOnPaidNetwork](policy-csp-admx-settingsync.md) +- [DisableWindowsSettingSync](policy-csp-admx-settingsync.md) +- [DisableCredentialsSettingSync](policy-csp-admx-settingsync.md) +- [DisablePersonalizationSettingSync](policy-csp-admx-settingsync.md) +- [DisableStartLayoutSettingSync](policy-csp-admx-settingsync.md) ## ADMX_SharedFolders -- [PublishDfsRoots](policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) -- [PublishSharedFolders](policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) +- [PublishDfsRoots](policy-csp-admx-sharedfolders.md) +- [PublishSharedFolders](policy-csp-admx-sharedfolders.md) ## ADMX_Sharing -- [NoInplaceSharing](policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) -- [DisableHomeGroup](policy-csp-admx-sharing.md#admx-sharing-disablehomegroup) +- [NoInplaceSharing](policy-csp-admx-sharing.md) +- [DisableHomeGroup](policy-csp-admx-sharing.md) ## ADMX_ShellCommandPromptRegEditTools -- [DisallowApps](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) -- [DisableRegedit](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) -- [DisableCMD](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) -- [RestrictApps](policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-restrictapps) +- [DisallowApps](policy-csp-admx-shellcommandpromptregedittools.md) +- [DisableRegedit](policy-csp-admx-shellcommandpromptregedittools.md) +- [DisableCMD](policy-csp-admx-shellcommandpromptregedittools.md) +- [RestrictApps](policy-csp-admx-shellcommandpromptregedittools.md) ## ADMX_Smartcard -- [AllowCertificatesWithNoEKU](policy-csp-admx-smartcard.md#admx-smartcard-allowcertificateswithnoeku) -- [EnumerateECCCerts](policy-csp-admx-smartcard.md#admx-smartcard-enumerateecccerts) -- [AllowIntegratedUnblock](policy-csp-admx-smartcard.md#admx-smartcard-allowintegratedunblock) -- [AllowSignatureOnlyKeys](policy-csp-admx-smartcard.md#admx-smartcard-allowsignatureonlykeys) -- [AllowTimeInvalidCertificates](policy-csp-admx-smartcard.md#admx-smartcard-allowtimeinvalidcertificates) -- [X509HintsNeeded](policy-csp-admx-smartcard.md#admx-smartcard-x509hintsneeded) -- [CertPropRootCleanupString](policy-csp-admx-smartcard.md#admx-smartcard-certproprootcleanupstring) -- [IntegratedUnblockPromptString](policy-csp-admx-smartcard.md#admx-smartcard-integratedunblockpromptstring) -- [FilterDuplicateCerts](policy-csp-admx-smartcard.md#admx-smartcard-filterduplicatecerts) -- [ForceReadingAllCertificates](policy-csp-admx-smartcard.md#admx-smartcard-forcereadingallcertificates) -- [SCPnPNotification](policy-csp-admx-smartcard.md#admx-smartcard-scpnpnotification) -- [DisallowPlaintextPin](policy-csp-admx-smartcard.md#admx-smartcard-disallowplaintextpin) -- [ReverseSubject](policy-csp-admx-smartcard.md#admx-smartcard-reversesubject) -- [CertPropEnabledString](policy-csp-admx-smartcard.md#admx-smartcard-certpropenabledstring) -- [CertPropRootEnabledString](policy-csp-admx-smartcard.md#admx-smartcard-certproprootenabledstring) -- [SCPnPEnabled](policy-csp-admx-smartcard.md#admx-smartcard-scpnpenabled) +- [AllowCertificatesWithNoEKU](policy-csp-admx-smartcard.md) +- [EnumerateECCCerts](policy-csp-admx-smartcard.md) +- [AllowIntegratedUnblock](policy-csp-admx-smartcard.md) +- [AllowSignatureOnlyKeys](policy-csp-admx-smartcard.md) +- [AllowTimeInvalidCertificates](policy-csp-admx-smartcard.md) +- [X509HintsNeeded](policy-csp-admx-smartcard.md) +- [CertPropRootCleanupString](policy-csp-admx-smartcard.md) +- [IntegratedUnblockPromptString](policy-csp-admx-smartcard.md) +- [FilterDuplicateCerts](policy-csp-admx-smartcard.md) +- [ForceReadingAllCertificates](policy-csp-admx-smartcard.md) +- [SCPnPNotification](policy-csp-admx-smartcard.md) +- [DisallowPlaintextPin](policy-csp-admx-smartcard.md) +- [ReverseSubject](policy-csp-admx-smartcard.md) +- [CertPropEnabledString](policy-csp-admx-smartcard.md) +- [CertPropRootEnabledString](policy-csp-admx-smartcard.md) +- [SCPnPEnabled](policy-csp-admx-smartcard.md) ## ADMX_Snmp -- [SNMP_Communities](policy-csp-admx-snmp.md#admx-snmp-snmp-communities) -- [SNMP_PermittedManagers](policy-csp-admx-snmp.md#admx-snmp-snmp-permittedmanagers) -- [SNMP_Traps_Public](policy-csp-admx-snmp.md#admx-snmp-snmp-traps-public) +- [SNMP_Communities](policy-csp-admx-snmp.md) +- [SNMP_PermittedManagers](policy-csp-admx-snmp.md) +- [SNMP_Traps_Public](policy-csp-admx-snmp.md) ## ADMX_SoundRec -- [Soundrec_DiableApplication_TitleText_1](policy-csp-admx-soundrec.md#admx-soundrec-soundrec-diableapplication-titletext-1) -- [Soundrec_DiableApplication_TitleText_2](policy-csp-admx-soundrec.md#admx-soundrec-soundrec-diableapplication-titletext-2) +- [Soundrec_DiableApplication_TitleText_1](policy-csp-admx-soundrec.md) +- [Soundrec_DiableApplication_TitleText_2](policy-csp-admx-soundrec.md) ## ADMX_srmfci -- [AccessDeniedConfiguration](policy-csp-admx-srmfci.md#admx-srmfci-accessdeniedconfiguration) -- [EnableShellAccessCheck](policy-csp-admx-srmfci.md#admx-srmfci-enableshellaccesscheck) -- [EnableManualUX](policy-csp-admx-srmfci.md#admx-srmfci-enablemanualux) -- [CentralClassificationList](policy-csp-admx-srmfci.md#admx-srmfci-centralclassificationlist) +- [AccessDeniedConfiguration](policy-csp-admx-srmfci.md) +- [EnableShellAccessCheck](policy-csp-admx-srmfci.md) +- [EnableManualUX](policy-csp-admx-srmfci.md) +- [CentralClassificationList](policy-csp-admx-srmfci.md) ## ADMX_StartMenu -- [MemCheckBoxInRunDlg](policy-csp-admx-startmenu.md#admx-startmenu-memcheckboxinrundlg) -- [ForceStartMenuLogOff](policy-csp-admx-startmenu.md#admx-startmenu-forcestartmenulogoff) -- [AddSearchInternetLinkInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-addsearchinternetlinkinstartmenu) -- [ShowRunInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-showruninstartmenu) -- [PowerButtonAction](policy-csp-admx-startmenu.md#admx-startmenu-powerbuttonaction) -- [ClearRecentDocsOnExit](policy-csp-admx-startmenu.md#admx-startmenu-clearrecentdocsonexit) -- [ClearRecentProgForNewUserInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-clearrecentprogfornewuserinstartmenu) -- [ClearTilesOnExit](policy-csp-admx-startmenu.md#admx-startmenu-cleartilesonexit) -- [NoToolbarsOnTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-notoolbarsontaskbar) -- [NoSearchCommInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomminstartmenu) -- [NoSearchFilesInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchfilesinstartmenu) -- [NoSearchInternetInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchinternetinstartmenu) -- [NoSearchProgramsInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchprogramsinstartmenu) -- [NoResolveSearch](policy-csp-admx-startmenu.md#admx-startmenu-noresolvesearch) -- [NoResolveTrack](policy-csp-admx-startmenu.md#admx-startmenu-noresolvetrack) -- [NoStartPage](policy-csp-admx-startmenu.md#admx-startmenu-nostartpage) -- [GoToDesktopOnSignIn](policy-csp-admx-startmenu.md#admx-startmenu-gotodesktoponsignin) -- [GreyMSIAds](policy-csp-admx-startmenu.md#admx-startmenu-greymsiads) -- [NoTrayItemsDisplay](policy-csp-admx-startmenu.md#admx-startmenu-notrayitemsdisplay) -- [DesktopAppsFirstInAppsView](policy-csp-admx-startmenu.md#admx-startmenu-desktopappsfirstinappsview) -- [LockTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-locktaskbar) -- [StartPinAppsWhenInstalled](policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) -- [NoSetTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) -- [NoTaskGrouping](policy-csp-admx-startmenu.md#admx-startmenu-notaskgrouping) -- [NoChangeStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) -- [NoUninstallFromStart](policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) -- [NoTrayContextMenu](policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) -- [NoMoreProgramsList](policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) -- [NoClose](policy-csp-admx-startmenu.md#admx-startmenu-noclose) -- [NoBalloonTip](policy-csp-admx-startmenu.md#admx-startmenu-noballoontip) -- [NoTaskBarClock](policy-csp-admx-startmenu.md#admx-startmenu-notaskbarclock) -- [NoCommonGroups](policy-csp-admx-startmenu.md#admx-startmenu-nocommongroups) -- [NoSMConfigurePrograms](policy-csp-admx-startmenu.md#admx-startmenu-nosmconfigureprograms) -- [NoSMMyDocuments](policy-csp-admx-startmenu.md#admx-startmenu-nosmmydocuments) -- [NoStartMenuDownload](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenudownload) -- [NoFavoritesMenu](policy-csp-admx-startmenu.md#admx-startmenu-nofavoritesmenu) -- [NoGamesFolderOnStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nogamesfolderonstartmenu) -- [NoHelp](policy-csp-admx-startmenu.md#admx-startmenu-nohelp) -- [NoStartMenuHomegroup](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuhomegroup) -- [NoWindowsUpdate](policy-csp-admx-startmenu.md#admx-startmenu-nowindowsupdate) -- [StartMenuLogOff](policy-csp-admx-startmenu.md#admx-startmenu-startmenulogoff) -- [NoSMMyMusic](policy-csp-admx-startmenu.md#admx-startmenu-nosmmymusic) -- [NoNetAndDialupConnect](policy-csp-admx-startmenu.md#admx-startmenu-nonetanddialupconnect) -- [NoSMMyNetworkPlaces](policy-csp-admx-startmenu.md#admx-startmenu-nosmmynetworkplaces) -- [NoSMMyPictures](policy-csp-admx-startmenu.md#admx-startmenu-nosmmypictures) -- [NoPinnedPrograms](policy-csp-admx-startmenu.md#admx-startmenu-nopinnedprograms) -- [NoSetFolders](policy-csp-admx-startmenu.md#admx-startmenu-nosetfolders) -- [NoRecentDocsMenu](policy-csp-admx-startmenu.md#admx-startmenu-norecentdocsmenu) -- [NoStartMenuRecordedTV](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenurecordedtv) -- [NoRun](policy-csp-admx-startmenu.md#admx-startmenu-norun) -- [NoSearchComputerLinkInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearchcomputerlinkinstartmenu) -- [NoFind](policy-csp-admx-startmenu.md#admx-startmenu-nofind) -- [NoSearchEverywhereLinkInStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nosearcheverywherelinkinstartmenu) -- [RemoveUnDockPCButton](policy-csp-admx-startmenu.md#admx-startmenu-removeundockpcbutton) -- [NoUserFolderOnStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nouserfolderonstartmenu) -- [NoUserNameOnStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nousernameonstartmenu) -- [NoStartMenuSubFolders](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenusubfolders) -- [NoStartMenuVideos](policy-csp-admx-startmenu.md#admx-startmenu-nostartmenuvideos) -- [DisableGlobalSearchOnAppsView](policy-csp-admx-startmenu.md#admx-startmenu-disableglobalsearchonappsview) -- [ShowRunAsDifferentUserInStart](policy-csp-admx-startmenu.md#admx-startmenu-showrunasdifferentuserinstart) -- [QuickLaunchEnabled](policy-csp-admx-startmenu.md#admx-startmenu-quicklaunchenabled) -- [ShowStartOnDisplayWithForegroundOnWinKey](policy-csp-admx-startmenu.md#admx-startmenu-showstartondisplaywithforegroundonwinkey) -- [ShowAppsViewOnStart](policy-csp-admx-startmenu.md#admx-startmenu-showappsviewonstart) -- [NoAutoTrayNotify](policy-csp-admx-startmenu.md#admx-startmenu-noautotraynotify) -- [Intellimenus](policy-csp-admx-startmenu.md#admx-startmenu-intellimenus) -- [NoInstrumentation](policy-csp-admx-startmenu.md#admx-startmenu-noinstrumentation) -- [StartPinAppsWhenInstalled](policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) -- [NoSetTaskbar](policy-csp-admx-startmenu.md#admx-startmenu-nosettaskbar) -- [NoChangeStartMenu](policy-csp-admx-startmenu.md#admx-startmenu-nochangestartmenu) -- [NoUninstallFromStart](policy-csp-admx-startmenu.md#admx-startmenu-nouninstallfromstart) -- [NoTrayContextMenu](policy-csp-admx-startmenu.md#admx-startmenu-notraycontextmenu) -- [NoMoreProgramsList](policy-csp-admx-startmenu.md#admx-startmenu-nomoreprogramslist) -- [HidePowerOptions](policy-csp-admx-startmenu.md#admx-startmenu-hidepoweroptions) -- [NoRun](policy-csp-admx-startmenu.md#admx-startmenu-norun) +- [MemCheckBoxInRunDlg](policy-csp-admx-startmenu.md) +- [ForceStartMenuLogOff](policy-csp-admx-startmenu.md) +- [AddSearchInternetLinkInStartMenu](policy-csp-admx-startmenu.md) +- [ShowRunInStartMenu](policy-csp-admx-startmenu.md) +- [PowerButtonAction](policy-csp-admx-startmenu.md) +- [ClearRecentDocsOnExit](policy-csp-admx-startmenu.md) +- [ClearRecentProgForNewUserInStartMenu](policy-csp-admx-startmenu.md) +- [ClearTilesOnExit](policy-csp-admx-startmenu.md) +- [NoToolbarsOnTaskbar](policy-csp-admx-startmenu.md) +- [NoSearchCommInStartMenu](policy-csp-admx-startmenu.md) +- [NoSearchFilesInStartMenu](policy-csp-admx-startmenu.md) +- [NoSearchInternetInStartMenu](policy-csp-admx-startmenu.md) +- [NoSearchProgramsInStartMenu](policy-csp-admx-startmenu.md) +- [NoResolveSearch](policy-csp-admx-startmenu.md) +- [NoResolveTrack](policy-csp-admx-startmenu.md) +- [NoStartPage](policy-csp-admx-startmenu.md) +- [GoToDesktopOnSignIn](policy-csp-admx-startmenu.md) +- [GreyMSIAds](policy-csp-admx-startmenu.md) +- [NoTrayItemsDisplay](policy-csp-admx-startmenu.md) +- [DesktopAppsFirstInAppsView](policy-csp-admx-startmenu.md) +- [LockTaskbar](policy-csp-admx-startmenu.md) +- [StartPinAppsWhenInstalled](policy-csp-admx-startmenu.md) +- [NoSetTaskbar](policy-csp-admx-startmenu.md) +- [NoTaskGrouping](policy-csp-admx-startmenu.md) +- [NoChangeStartMenu](policy-csp-admx-startmenu.md) +- [NoUninstallFromStart](policy-csp-admx-startmenu.md) +- [NoTrayContextMenu](policy-csp-admx-startmenu.md) +- [NoMoreProgramsList](policy-csp-admx-startmenu.md) +- [NoClose](policy-csp-admx-startmenu.md) +- [NoBalloonTip](policy-csp-admx-startmenu.md) +- [NoTaskBarClock](policy-csp-admx-startmenu.md) +- [NoCommonGroups](policy-csp-admx-startmenu.md) +- [NoSMConfigurePrograms](policy-csp-admx-startmenu.md) +- [NoSMMyDocuments](policy-csp-admx-startmenu.md) +- [NoStartMenuDownload](policy-csp-admx-startmenu.md) +- [NoFavoritesMenu](policy-csp-admx-startmenu.md) +- [NoGamesFolderOnStartMenu](policy-csp-admx-startmenu.md) +- [NoHelp](policy-csp-admx-startmenu.md) +- [NoStartMenuHomegroup](policy-csp-admx-startmenu.md) +- [NoWindowsUpdate](policy-csp-admx-startmenu.md) +- [StartMenuLogOff](policy-csp-admx-startmenu.md) +- [NoSMMyMusic](policy-csp-admx-startmenu.md) +- [NoNetAndDialupConnect](policy-csp-admx-startmenu.md) +- [NoSMMyNetworkPlaces](policy-csp-admx-startmenu.md) +- [NoSMMyPictures](policy-csp-admx-startmenu.md) +- [NoPinnedPrograms](policy-csp-admx-startmenu.md) +- [NoSetFolders](policy-csp-admx-startmenu.md) +- [NoRecentDocsMenu](policy-csp-admx-startmenu.md) +- [NoStartMenuRecordedTV](policy-csp-admx-startmenu.md) +- [NoRun](policy-csp-admx-startmenu.md) +- [NoSearchComputerLinkInStartMenu](policy-csp-admx-startmenu.md) +- [NoFind](policy-csp-admx-startmenu.md) +- [NoSearchEverywhereLinkInStartMenu](policy-csp-admx-startmenu.md) +- [RemoveUnDockPCButton](policy-csp-admx-startmenu.md) +- [NoUserFolderOnStartMenu](policy-csp-admx-startmenu.md) +- [NoUserNameOnStartMenu](policy-csp-admx-startmenu.md) +- [NoStartMenuSubFolders](policy-csp-admx-startmenu.md) +- [NoStartMenuVideos](policy-csp-admx-startmenu.md) +- [DisableGlobalSearchOnAppsView](policy-csp-admx-startmenu.md) +- [ShowRunAsDifferentUserInStart](policy-csp-admx-startmenu.md) +- [QuickLaunchEnabled](policy-csp-admx-startmenu.md) +- [ShowStartOnDisplayWithForegroundOnWinKey](policy-csp-admx-startmenu.md) +- [ShowAppsViewOnStart](policy-csp-admx-startmenu.md) +- [NoAutoTrayNotify](policy-csp-admx-startmenu.md) +- [Intellimenus](policy-csp-admx-startmenu.md) +- [NoInstrumentation](policy-csp-admx-startmenu.md) +- [StartPinAppsWhenInstalled](policy-csp-admx-startmenu.md) +- [NoSetTaskbar](policy-csp-admx-startmenu.md) +- [NoChangeStartMenu](policy-csp-admx-startmenu.md) +- [NoUninstallFromStart](policy-csp-admx-startmenu.md) +- [NoTrayContextMenu](policy-csp-admx-startmenu.md) +- [NoMoreProgramsList](policy-csp-admx-startmenu.md) +- [HidePowerOptions](policy-csp-admx-startmenu.md) +- [NoRun](policy-csp-admx-startmenu.md) ## ADMX_SystemRestore -- [SR_DisableConfig](policy-csp-admx-systemrestore.md#admx-systemrestore-sr-disableconfig) +- [SR_DisableConfig](policy-csp-admx-systemrestore.md) ## ADMX_TabletPCInputPanel -- [Prediction_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-prediction-1) -- [IPTIPTarget_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptarget-1) -- [IPTIPTouchTarget_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptouchtarget-1) -- [RareChar_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-rarechar-1) -- [EdgeTarget_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-edgetarget-1) -- [AutoComplete_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-autocomplete-1) -- [PasswordSecurity_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-passwordsecurity-1) -- [ScratchOut_1](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-scratchout-1) -- [Prediction_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-prediction-2) -- [IPTIPTarget_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptarget-2) -- [IPTIPTouchTarget_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-iptiptouchtarget-2) -- [RareChar_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-rarechar-2) -- [EdgeTarget_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-edgetarget-2) -- [AutoComplete_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-autocomplete-2) -- [PasswordSecurity_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-passwordsecurity-2) -- [ScratchOut_2](policy-csp-admx-tabletpcinputpanel.md#admx-tabletpcinputpanel-scratchout-2) +- [Prediction_1](policy-csp-admx-tabletpcinputpanel.md) +- [IPTIPTarget_1](policy-csp-admx-tabletpcinputpanel.md) +- [IPTIPTouchTarget_1](policy-csp-admx-tabletpcinputpanel.md) +- [RareChar_1](policy-csp-admx-tabletpcinputpanel.md) +- [EdgeTarget_1](policy-csp-admx-tabletpcinputpanel.md) +- [AutoComplete_1](policy-csp-admx-tabletpcinputpanel.md) +- [PasswordSecurity_1](policy-csp-admx-tabletpcinputpanel.md) +- [ScratchOut_1](policy-csp-admx-tabletpcinputpanel.md) +- [Prediction_2](policy-csp-admx-tabletpcinputpanel.md) +- [IPTIPTarget_2](policy-csp-admx-tabletpcinputpanel.md) +- [IPTIPTouchTarget_2](policy-csp-admx-tabletpcinputpanel.md) +- [RareChar_2](policy-csp-admx-tabletpcinputpanel.md) +- [EdgeTarget_2](policy-csp-admx-tabletpcinputpanel.md) +- [AutoComplete_2](policy-csp-admx-tabletpcinputpanel.md) +- [PasswordSecurity_2](policy-csp-admx-tabletpcinputpanel.md) +- [ScratchOut_2](policy-csp-admx-tabletpcinputpanel.md) ## ADMX_TabletShell -- [DisableInkball_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disableinkball-1) -- [DisableNoteWriterPrinting_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disablenotewriterprinting-1) -- [DisableSnippingTool_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disablesnippingtool-1) -- [DisableJournal_1](policy-csp-admx-tabletshell.md#admx-tabletshell-disablejournal-1) -- [TurnOffFeedback_1](policy-csp-admx-tabletshell.md#admx-tabletshell-turnofffeedback-1) -- [PreventBackEscMapping_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventbackescmapping-1) -- [PreventLaunchApp_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventlaunchapp-1) -- [PreventPressAndHold_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventpressandhold-1) -- [TurnOffButtons_1](policy-csp-admx-tabletshell.md#admx-tabletshell-turnoffbuttons-1) -- [PreventFlicksLearningMode_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflickslearningmode-1) -- [PreventFlicks_1](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflicks-1) -- [DisableInkball_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disableinkball-2) -- [DisableNoteWriterPrinting_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disablenotewriterprinting-2) -- [DisableSnippingTool_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disablesnippingtool-2) -- [DisableJournal_2](policy-csp-admx-tabletshell.md#admx-tabletshell-disablejournal-2) -- [TurnOffFeedback_2](policy-csp-admx-tabletshell.md#admx-tabletshell-turnofffeedback-2) -- [PreventBackEscMapping_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventbackescmapping-2) -- [PreventLaunchApp_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventlaunchapp-2) -- [PreventPressAndHold_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventpressandhold-2) -- [TurnOffButtons_2](policy-csp-admx-tabletshell.md#admx-tabletshell-turnoffbuttons-2) -- [PreventFlicksLearningMode_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflickslearningmode-2) -- [PreventFlicks_2](policy-csp-admx-tabletshell.md#admx-tabletshell-preventflicks-2) +- [DisableInkball_1](policy-csp-admx-tabletshell.md) +- [DisableNoteWriterPrinting_1](policy-csp-admx-tabletshell.md) +- [DisableSnippingTool_1](policy-csp-admx-tabletshell.md) +- [DisableJournal_1](policy-csp-admx-tabletshell.md) +- [TurnOffFeedback_1](policy-csp-admx-tabletshell.md) +- [PreventBackEscMapping_1](policy-csp-admx-tabletshell.md) +- [PreventLaunchApp_1](policy-csp-admx-tabletshell.md) +- [PreventPressAndHold_1](policy-csp-admx-tabletshell.md) +- [TurnOffButtons_1](policy-csp-admx-tabletshell.md) +- [PreventFlicksLearningMode_1](policy-csp-admx-tabletshell.md) +- [PreventFlicks_1](policy-csp-admx-tabletshell.md) +- [DisableInkball_2](policy-csp-admx-tabletshell.md) +- [DisableNoteWriterPrinting_2](policy-csp-admx-tabletshell.md) +- [DisableSnippingTool_2](policy-csp-admx-tabletshell.md) +- [DisableJournal_2](policy-csp-admx-tabletshell.md) +- [TurnOffFeedback_2](policy-csp-admx-tabletshell.md) +- [PreventBackEscMapping_2](policy-csp-admx-tabletshell.md) +- [PreventLaunchApp_2](policy-csp-admx-tabletshell.md) +- [PreventPressAndHold_2](policy-csp-admx-tabletshell.md) +- [TurnOffButtons_2](policy-csp-admx-tabletshell.md) +- [PreventFlicksLearningMode_2](policy-csp-admx-tabletshell.md) +- [PreventFlicks_2](policy-csp-admx-tabletshell.md) ## ADMX_Taskbar -- [EnableLegacyBalloonNotifications](policy-csp-admx-taskbar.md#admx-taskbar-enablelegacyballoonnotifications) -- [NoPinningToDestinations](policy-csp-admx-taskbar.md#admx-taskbar-nopinningtodestinations) -- [NoPinningToTaskbar](policy-csp-admx-taskbar.md#admx-taskbar-nopinningtotaskbar) -- [NoPinningStoreToTaskbar](policy-csp-admx-taskbar.md#admx-taskbar-nopinningstoretotaskbar) -- [TaskbarNoMultimon](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnomultimon) -- [NoRemoteDestinations](policy-csp-admx-taskbar.md#admx-taskbar-noremotedestinations) -- [TaskbarLockAll](policy-csp-admx-taskbar.md#admx-taskbar-taskbarlockall) -- [TaskbarNoAddRemoveToolbar](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoaddremovetoolbar) -- [TaskbarNoRedock](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoredock) -- [TaskbarNoDragToolbar](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnodragtoolbar) -- [TaskbarNoResize](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnoresize) -- [DisableNotificationCenter](policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) -- [TaskbarNoPinnedList](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) -- [HideSCAPower](policy-csp-admx-taskbar.md#admx-taskbar-hidescapower) -- [HideSCANetwork](policy-csp-admx-taskbar.md#admx-taskbar-hidescanetwork) -- [HideSCAHealth](policy-csp-admx-taskbar.md#admx-taskbar-hidescahealth) -- [HideSCAVolume](policy-csp-admx-taskbar.md#admx-taskbar-hidescavolume) -- [ShowWindowsStoreAppsOnTaskbar](policy-csp-admx-taskbar.md#admx-taskbar-showwindowsstoreappsontaskbar) -- [TaskbarNoNotification](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnonotification) -- [NoSystraySystemPromotion](policy-csp-admx-taskbar.md#admx-taskbar-nosystraysystempromotion) -- [NoBalloonFeatureAdvertisements](policy-csp-admx-taskbar.md#admx-taskbar-noballoonfeatureadvertisements) -- [TaskbarNoThumbnail](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnothumbnail) -- [DisableNotificationCenter](policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) -- [TaskbarNoPinnedList](policy-csp-admx-taskbar.md#admx-taskbar-taskbarnopinnedlist) +- [EnableLegacyBalloonNotifications](policy-csp-admx-taskbar.md) +- [NoPinningToDestinations](policy-csp-admx-taskbar.md) +- [NoPinningToTaskbar](policy-csp-admx-taskbar.md) +- [NoPinningStoreToTaskbar](policy-csp-admx-taskbar.md) +- [TaskbarNoMultimon](policy-csp-admx-taskbar.md) +- [NoRemoteDestinations](policy-csp-admx-taskbar.md) +- [TaskbarLockAll](policy-csp-admx-taskbar.md) +- [TaskbarNoAddRemoveToolbar](policy-csp-admx-taskbar.md) +- [TaskbarNoRedock](policy-csp-admx-taskbar.md) +- [TaskbarNoDragToolbar](policy-csp-admx-taskbar.md) +- [TaskbarNoResize](policy-csp-admx-taskbar.md) +- [DisableNotificationCenter](policy-csp-admx-taskbar.md) +- [TaskbarNoPinnedList](policy-csp-admx-taskbar.md) +- [HideSCAPower](policy-csp-admx-taskbar.md) +- [HideSCANetwork](policy-csp-admx-taskbar.md) +- [HideSCAHealth](policy-csp-admx-taskbar.md) +- [HideSCAVolume](policy-csp-admx-taskbar.md) +- [ShowWindowsStoreAppsOnTaskbar](policy-csp-admx-taskbar.md) +- [TaskbarNoNotification](policy-csp-admx-taskbar.md) +- [NoSystraySystemPromotion](policy-csp-admx-taskbar.md) +- [NoBalloonFeatureAdvertisements](policy-csp-admx-taskbar.md) +- [TaskbarNoThumbnail](policy-csp-admx-taskbar.md) +- [DisableNotificationCenter](policy-csp-admx-taskbar.md) +- [TaskbarNoPinnedList](policy-csp-admx-taskbar.md) ## ADMX_tcpip -- [6to4_Router_Name](policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name) -- [6to4_Router_Name_Resolution_Interval](policy-csp-admx-tcpip.md#admx-tcpip-6to4-router-name-resolution-interval) -- [6to4_State](policy-csp-admx-tcpip.md#admx-tcpip-6to4-state) -- [IPHTTPS_ClientState](policy-csp-admx-tcpip.md#admx-tcpip-iphttps-clientstate) -- [ISATAP_Router_Name](policy-csp-admx-tcpip.md#admx-tcpip-isatap-router-name) -- [ISATAP_State](policy-csp-admx-tcpip.md#admx-tcpip-isatap-state) -- [Teredo_Client_Port](policy-csp-admx-tcpip.md#admx-tcpip-teredo-client-port) -- [Teredo_Default_Qualified](policy-csp-admx-tcpip.md#admx-tcpip-teredo-default-qualified) -- [Teredo_Refresh_Rate](policy-csp-admx-tcpip.md#admx-tcpip-teredo-refresh-rate) -- [Teredo_Server_Name](policy-csp-admx-tcpip.md#admx-tcpip-teredo-server-name) -- [Teredo_State](policy-csp-admx-tcpip.md#admx-tcpip-teredo-state) -- [IP_Stateless_Autoconfiguration_Limits_State](policy-csp-admx-tcpip.md#admx-tcpip-ip-stateless-autoconfiguration-limits-state) -- [Windows_Scaling_Heuristics_State](policy-csp-admx-tcpip.md#admx-tcpip-windows-scaling-heuristics-state) +- [6to4_Router_Name](policy-csp-admx-tcpip.md) +- [6to4_Router_Name_Resolution_Interval](policy-csp-admx-tcpip.md) +- [6to4_State](policy-csp-admx-tcpip.md) +- [IPHTTPS_ClientState](policy-csp-admx-tcpip.md) +- [ISATAP_Router_Name](policy-csp-admx-tcpip.md) +- [ISATAP_State](policy-csp-admx-tcpip.md) +- [Teredo_Client_Port](policy-csp-admx-tcpip.md) +- [Teredo_Default_Qualified](policy-csp-admx-tcpip.md) +- [Teredo_Refresh_Rate](policy-csp-admx-tcpip.md) +- [Teredo_Server_Name](policy-csp-admx-tcpip.md) +- [Teredo_State](policy-csp-admx-tcpip.md) +- [IP_Stateless_Autoconfiguration_Limits_State](policy-csp-admx-tcpip.md) +- [Windows_Scaling_Heuristics_State](policy-csp-admx-tcpip.md) ## ADMX_TerminalServer -- [TS_GATEWAY_POLICY_ENABLE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-gateway-policy-enable) -- [TS_GATEWAY_POLICY_AUTH_METHOD](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-gateway-policy-auth-method) -- [TS_GATEWAY_POLICY_SERVER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-gateway-policy-server) -- [TS_CLIENT_ALLOW_UNSIGNED_FILES_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-unsigned-files-1) -- [TS_CLIENT_ALLOW_SIGNED_FILES_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-signed-files-1) -- [TS_CLIENT_DISABLE_PASSWORD_SAVING_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-disable-password-saving-1) -- [TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-trusted-certificate-thumbprints-2) -- [TS_RemoteControl_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-remotecontrol-1) -- [TS_EASY_PRINT_User](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-easy-print-user) -- [TS_START_PROGRAM_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-start-program-1) -- [TS_Session_End_On_Limit_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-session-end-on-limit-1) -- [TS_SESSIONS_Idle_Limit_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-idle-limit-1) -- [TS_SESSIONS_Limits_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-limits-1) -- [TS_SESSIONS_Disconnected_Timeout_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-disconnected-timeout-1) -- [TS_RADC_DefaultConnection](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-radc-defaultconnection) -- [TS_LICENSE_SECGROUP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-license-secgroup) -- [TS_PreventLicenseUpgrade](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-preventlicenseupgrade) -- [TS_CLIENT_ALLOW_UNSIGNED_FILES_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-unsigned-files-2) -- [TS_CLIENT_ALLOW_SIGNED_FILES_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-allow-signed-files-2) -- [TS_SERVER_AUTH](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-auth) -- [TS_CLIENT_DISABLE_HARDWARE_MODE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-disable-hardware-mode) -- [TS_PROMT_CREDS_CLIENT_COMP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-promt-creds-client-comp) -- [TS_USB_REDIRECTION_DISABLE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-usb-redirection-disable) -- [TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-trusted-certificate-thumbprints-1) -- [TS_CLIENT_TURN_OFF_UDP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-turn-off-udp) -- [TS_AUTO_RECONNECT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-auto-reconnect) -- [TS_KEEP_ALIVE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-keep-alive) -- [TS_FORCIBLE_LOGOFF](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-forcible-logoff) -- [TS_MAX_CON_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-max-con-policy) -- [TS_SINGLE_SESSION](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-single-session) -- [TS_SELECT_NETWORK_DETECT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-select-network-detect) -- [TS_SELECT_TRANSPORT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-select-transport) -- [TS_RemoteControl_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-remotecontrol-2) -- [TS_RDSAppX_WaitForRegistration](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-rdsappx-waitforregistration) -- [TS_CLIENT_AUDIO](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-audio) -- [TS_CLIENT_AUDIO_CAPTURE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-audio-capture) -- [TS_TIME_ZONE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-time-zone) -- [TS_UIA](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-uia) -- [TS_CLIENT_CLIPBOARD](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-clipboard) -- [TS_CLIENT_COM](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-com) -- [TS_CLIENT_LPT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-lpt) -- [TS_SMART_CARD](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-smart-card) -- [TS_CLIENT_PNP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-pnp) -- [TS_CAMERA_REDIRECTION](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-camera-redirection) -- [TS_CLIENT_AUDIO_QUALITY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-audio-quality) -- [TS_LICENSE_TOOLTIP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-license-tooltip) -- [TS_LICENSING_MODE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-licensing-mode) -- [TS_LICENSE_SERVERS](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-license-servers) -- [TS_CLIENT_PRINTER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-printer) -- [TS_CLIENT_DEFAULT_M](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-client-default-m) -- [TS_FALLBACKPRINTDRIVERTYPE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-fallbackprintdrivertype) -- [TS_EASY_PRINT](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-easy-print) -- [TS_DELETE_ROAMING_USER_PROFILES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-delete-roaming-user-profiles) -- [TS_USER_PROFILES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-profiles) -- [TS_USER_HOME](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-home) -- [TS_USER_MANDATORY_PROFILES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-mandatory-profiles) -- [TS_SD_ClustName](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sd-clustname) -- [TS_SD_Loc](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sd-loc) -- [TS_JOIN_SESSION_DIRECTORY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-join-session-directory) -- [TS_SD_EXPOSE_ADDRESS](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sd-expose-address) -- [TS_TURNOFF_SINGLEAPP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-turnoff-singleapp) -- [TS_SERVER_COMPRESSOR](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-compressor) -- [TS_SERVER_AVC_HW_ENCODE_PREFERRED](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-avc-hw-encode-preferred) -- [TS_SERVER_IMAGE_QUALITY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-image-quality) -- [TS_SERVER_PROFILE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-profile) -- [TS_SERVER_LEGACY_RFX](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-legacy-rfx) -- [TS_DISABLE_REMOTE_DESKTOP_WALLPAPER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-disable-remote-desktop-wallpaper) -- [TS_COLORDEPTH](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-colordepth) -- [TS_MAXDISPLAYRES](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-maxdisplayres) -- [TS_MAXMONITOR](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-maxmonitor) -- [TS_SERVER_AVC444_MODE_PREFERRED](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-avc444-mode-preferred) -- [TS_EnableVirtualGraphics](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-enablevirtualgraphics) -- [TS_SERVER_VISEXP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-visexp) -- [TS_RemoteDesktopVirtualGraphics](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-remotedesktopvirtualgraphics) -- [TS_NoDisconnectMenu](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-nodisconnectmenu) -- [TS_NoSecurityMenu](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-nosecuritymenu) -- [TS_START_PROGRAM_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-start-program-2) -- [TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-advanced-remotefx-remoteapp) -- [TS_DX_USE_FULL_HWGPU](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-dx-use-full-hwgpu) -- [TS_SERVER_WDDM_GRAPHICS_DRIVER](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-server-wddm-graphics-driver) -- [TS_TSCC_PERMISSIONS_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-tscc-permissions-policy) -- [TS_SECURITY_LAYER_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-security-layer-policy) -- [TS_USER_AUTHENTICATION_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-user-authentication-policy) -- [TS_CERTIFICATE_TEMPLATE_POLICY](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-certificate-template-policy) -- [TS_Session_End_On_Limit_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-session-end-on-limit-2) -- [TS_SESSIONS_Idle_Limit_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-idle-limit-2) -- [TS_SESSIONS_Limits_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-limits-2) -- [TS_SESSIONS_Disconnected_Timeout_2](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-sessions-disconnected-timeout-2) -- [TS_TEMP_DELETE](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-temp-delete) -- [TS_TEMP_PER_SESSION](policy-csp-admx-terminalserver.md#admx-terminalserver-ts-temp-per-session) +- [TS_GATEWAY_POLICY_ENABLE](policy-csp-admx-terminalserver.md) +- [TS_GATEWAY_POLICY_AUTH_METHOD](policy-csp-admx-terminalserver.md) +- [TS_GATEWAY_POLICY_SERVER](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_ALLOW_UNSIGNED_FILES_1](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_ALLOW_SIGNED_FILES_1](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_DISABLE_PASSWORD_SAVING_1](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2](policy-csp-admx-terminalserver.md) +- [TS_RemoteControl_1](policy-csp-admx-terminalserver.md) +- [TS_EASY_PRINT_User](policy-csp-admx-terminalserver.md) +- [TS_START_PROGRAM_1](policy-csp-admx-terminalserver.md) +- [TS_Session_End_On_Limit_1](policy-csp-admx-terminalserver.md) +- [TS_SESSIONS_Idle_Limit_1](policy-csp-admx-terminalserver.md) +- [TS_SESSIONS_Limits_1](policy-csp-admx-terminalserver.md) +- [TS_SESSIONS_Disconnected_Timeout_1](policy-csp-admx-terminalserver.md) +- [TS_RADC_DefaultConnection](policy-csp-admx-terminalserver.md) +- [TS_LICENSE_SECGROUP](policy-csp-admx-terminalserver.md) +- [TS_PreventLicenseUpgrade](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_ALLOW_UNSIGNED_FILES_2](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_ALLOW_SIGNED_FILES_2](policy-csp-admx-terminalserver.md) +- [TS_SERVER_AUTH](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_DISABLE_HARDWARE_MODE](policy-csp-admx-terminalserver.md) +- [TS_PROMT_CREDS_CLIENT_COMP](policy-csp-admx-terminalserver.md) +- [TS_USB_REDIRECTION_DISABLE](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_TURN_OFF_UDP](policy-csp-admx-terminalserver.md) +- [TS_AUTO_RECONNECT](policy-csp-admx-terminalserver.md) +- [TS_KEEP_ALIVE](policy-csp-admx-terminalserver.md) +- [TS_FORCIBLE_LOGOFF](policy-csp-admx-terminalserver.md) +- [TS_MAX_CON_POLICY](policy-csp-admx-terminalserver.md) +- [TS_SINGLE_SESSION](policy-csp-admx-terminalserver.md) +- [TS_SELECT_NETWORK_DETECT](policy-csp-admx-terminalserver.md) +- [TS_SELECT_TRANSPORT](policy-csp-admx-terminalserver.md) +- [TS_RemoteControl_2](policy-csp-admx-terminalserver.md) +- [TS_RDSAppX_WaitForRegistration](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_AUDIO](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_AUDIO_CAPTURE](policy-csp-admx-terminalserver.md) +- [TS_TIME_ZONE](policy-csp-admx-terminalserver.md) +- [TS_UIA](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_CLIPBOARD](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_COM](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_LPT](policy-csp-admx-terminalserver.md) +- [TS_SMART_CARD](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_PNP](policy-csp-admx-terminalserver.md) +- [TS_CAMERA_REDIRECTION](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_AUDIO_QUALITY](policy-csp-admx-terminalserver.md) +- [TS_LICENSE_TOOLTIP](policy-csp-admx-terminalserver.md) +- [TS_LICENSING_MODE](policy-csp-admx-terminalserver.md) +- [TS_LICENSE_SERVERS](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_PRINTER](policy-csp-admx-terminalserver.md) +- [TS_CLIENT_DEFAULT_M](policy-csp-admx-terminalserver.md) +- [TS_FALLBACKPRINTDRIVERTYPE](policy-csp-admx-terminalserver.md) +- [TS_EASY_PRINT](policy-csp-admx-terminalserver.md) +- [TS_DELETE_ROAMING_USER_PROFILES](policy-csp-admx-terminalserver.md) +- [TS_USER_PROFILES](policy-csp-admx-terminalserver.md) +- [TS_USER_HOME](policy-csp-admx-terminalserver.md) +- [TS_USER_MANDATORY_PROFILES](policy-csp-admx-terminalserver.md) +- [TS_SD_ClustName](policy-csp-admx-terminalserver.md) +- [TS_SD_Loc](policy-csp-admx-terminalserver.md) +- [TS_JOIN_SESSION_DIRECTORY](policy-csp-admx-terminalserver.md) +- [TS_SD_EXPOSE_ADDRESS](policy-csp-admx-terminalserver.md) +- [TS_TURNOFF_SINGLEAPP](policy-csp-admx-terminalserver.md) +- [TS_SERVER_COMPRESSOR](policy-csp-admx-terminalserver.md) +- [TS_SERVER_AVC_HW_ENCODE_PREFERRED](policy-csp-admx-terminalserver.md) +- [TS_SERVER_IMAGE_QUALITY](policy-csp-admx-terminalserver.md) +- [TS_SERVER_PROFILE](policy-csp-admx-terminalserver.md) +- [TS_SERVER_LEGACY_RFX](policy-csp-admx-terminalserver.md) +- [TS_DISABLE_REMOTE_DESKTOP_WALLPAPER](policy-csp-admx-terminalserver.md) +- [TS_COLORDEPTH](policy-csp-admx-terminalserver.md) +- [TS_MAXDISPLAYRES](policy-csp-admx-terminalserver.md) +- [TS_MAXMONITOR](policy-csp-admx-terminalserver.md) +- [TS_SERVER_AVC444_MODE_PREFERRED](policy-csp-admx-terminalserver.md) +- [TS_EnableVirtualGraphics](policy-csp-admx-terminalserver.md) +- [TS_SERVER_VISEXP](policy-csp-admx-terminalserver.md) +- [TS_RemoteDesktopVirtualGraphics](policy-csp-admx-terminalserver.md) +- [TS_NoDisconnectMenu](policy-csp-admx-terminalserver.md) +- [TS_NoSecurityMenu](policy-csp-admx-terminalserver.md) +- [TS_START_PROGRAM_2](policy-csp-admx-terminalserver.md) +- [TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP](policy-csp-admx-terminalserver.md) +- [TS_DX_USE_FULL_HWGPU](policy-csp-admx-terminalserver.md) +- [TS_SERVER_WDDM_GRAPHICS_DRIVER](policy-csp-admx-terminalserver.md) +- [TS_TSCC_PERMISSIONS_POLICY](policy-csp-admx-terminalserver.md) +- [TS_SECURITY_LAYER_POLICY](policy-csp-admx-terminalserver.md) +- [TS_USER_AUTHENTICATION_POLICY](policy-csp-admx-terminalserver.md) +- [TS_CERTIFICATE_TEMPLATE_POLICY](policy-csp-admx-terminalserver.md) +- [TS_Session_End_On_Limit_2](policy-csp-admx-terminalserver.md) +- [TS_SESSIONS_Idle_Limit_2](policy-csp-admx-terminalserver.md) +- [TS_SESSIONS_Limits_2](policy-csp-admx-terminalserver.md) +- [TS_SESSIONS_Disconnected_Timeout_2](policy-csp-admx-terminalserver.md) +- [TS_TEMP_DELETE](policy-csp-admx-terminalserver.md) +- [TS_TEMP_PER_SESSION](policy-csp-admx-terminalserver.md) ## ADMX_Thumbnails -- [DisableThumbsDBOnNetworkFolders](policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbsdbonnetworkfolders) -- [DisableThumbnailsOnNetworkFolders](policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnailsonnetworkfolders) -- [DisableThumbnails](policy-csp-admx-thumbnails.md#admx-thumbnails-disablethumbnails) +- [DisableThumbsDBOnNetworkFolders](policy-csp-admx-thumbnails.md) +- [DisableThumbnailsOnNetworkFolders](policy-csp-admx-thumbnails.md) +- [DisableThumbnails](policy-csp-admx-thumbnails.md) ## ADMX_TouchInput -- [TouchInputOff_1](policy-csp-admx-touchinput.md#admx-touchinput-touchinputoff-1) -- [PanningEverywhereOff_1](policy-csp-admx-touchinput.md#admx-touchinput-panningeverywhereoff-1) -- [TouchInputOff_2](policy-csp-admx-touchinput.md#admx-touchinput-touchinputoff-2) -- [PanningEverywhereOff_2](policy-csp-admx-touchinput.md#admx-touchinput-panningeverywhereoff-2) +- [TouchInputOff_1](policy-csp-admx-touchinput.md) +- [PanningEverywhereOff_1](policy-csp-admx-touchinput.md) +- [TouchInputOff_2](policy-csp-admx-touchinput.md) +- [PanningEverywhereOff_2](policy-csp-admx-touchinput.md) ## ADMX_TPM -- [OptIntoDSHA_Name](policy-csp-admx-tpm.md#admx-tpm-optintodsha-name) -- [OSManagedAuth_Name](policy-csp-admx-tpm.md#admx-tpm-osmanagedauth-name) -- [BlockedCommandsList_Name](policy-csp-admx-tpm.md#admx-tpm-blockedcommandslist-name) -- [ClearTPMIfNotReady_Name](policy-csp-admx-tpm.md#admx-tpm-cleartpmifnotready-name) -- [UseLegacyDAP_Name](policy-csp-admx-tpm.md#admx-tpm-uselegacydap-name) -- [IgnoreDefaultList_Name](policy-csp-admx-tpm.md#admx-tpm-ignoredefaultlist-name) -- [IgnoreLocalList_Name](policy-csp-admx-tpm.md#admx-tpm-ignorelocallist-name) -- [StandardUserAuthorizationFailureIndividualThreshold_Name](policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureindividualthreshold-name) -- [StandardUserAuthorizationFailureDuration_Name](policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailureduration-name) -- [StandardUserAuthorizationFailureTotalThreshold_Name](policy-csp-admx-tpm.md#admx-tpm-standarduserauthorizationfailuretotalthreshold-name) +- [OptIntoDSHA_Name](policy-csp-admx-tpm.md) +- [OSManagedAuth_Name](policy-csp-admx-tpm.md) +- [BlockedCommandsList_Name](policy-csp-admx-tpm.md) +- [ClearTPMIfNotReady_Name](policy-csp-admx-tpm.md) +- [UseLegacyDAP_Name](policy-csp-admx-tpm.md) +- [IgnoreDefaultList_Name](policy-csp-admx-tpm.md) +- [IgnoreLocalList_Name](policy-csp-admx-tpm.md) +- [StandardUserAuthorizationFailureIndividualThreshold_Name](policy-csp-admx-tpm.md) +- [StandardUserAuthorizationFailureDuration_Name](policy-csp-admx-tpm.md) +- [StandardUserAuthorizationFailureTotalThreshold_Name](policy-csp-admx-tpm.md) ## ADMX_UserExperienceVirtualization -- [MicrosoftOffice2013AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) -- [MicrosoftOffice2016AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) -- [Calculator](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) -- [MicrosoftOffice2013CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) -- [MicrosoftOffice2016CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) -- [MicrosoftOffice2013ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) -- [MicrosoftOffice2016ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) -- [MicrosoftOffice2013InfoPathBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) -- [InternetExplorer10](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) -- [InternetExplorer11](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) -- [InternetExplorer8](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) -- [InternetExplorer9](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) -- [InternetExplorerCommon](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) -- [MicrosoftOffice2013LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) -- [MicrosoftOffice2016LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) -- [MicrosoftOffice2010Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) -- [MicrosoftOffice2013Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) -- [MicrosoftOffice2016Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) -- [MicrosoftOffice2010Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) -- [MicrosoftOffice2013Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) -- [MicrosoftOffice2016Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) -- [MicrosoftOffice2010InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) -- [MicrosoftOffice2013InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) -- [MicrosoftOffice2010Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) -- [MicrosoftOffice2013Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) -- [MicrosoftOffice2016Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) -- [MicrosoftOffice2010Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) -- [MicrosoftOffice2013Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) -- [MicrosoftOffice2013UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) -- [MicrosoftOffice2016Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) -- [MicrosoftOffice2016UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) -- [MicrosoftOffice365Access2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) -- [MicrosoftOffice365Access2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) -- [MicrosoftOffice365Common2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) -- [MicrosoftOffice365Common2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) -- [MicrosoftOffice365Excel2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) -- [MicrosoftOffice365Excel2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) -- [MicrosoftOffice365InfoPath2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) -- [MicrosoftOffice365Lync2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) -- [MicrosoftOffice365Lync2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) -- [MicrosoftOffice365OneNote2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) -- [MicrosoftOffice365OneNote2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) -- [MicrosoftOffice365Outlook2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) -- [MicrosoftOffice365Outlook2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) -- [MicrosoftOffice365PowerPoint2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) -- [MicrosoftOffice365PowerPoint2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) -- [MicrosoftOffice365Project2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) -- [MicrosoftOffice365Project2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) -- [MicrosoftOffice365Publisher2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) -- [MicrosoftOffice365Publisher2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) -- [MicrosoftOffice365SharePointDesigner2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) -- [MicrosoftOffice365Visio2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) -- [MicrosoftOffice365Visio2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) -- [MicrosoftOffice365Word2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) -- [MicrosoftOffice365Word2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) -- [MicrosoftOffice2013OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) -- [MicrosoftOffice2016OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) -- [MicrosoftOffice2010OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) -- [MicrosoftOffice2013OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) -- [MicrosoftOffice2016OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) -- [MicrosoftOffice2010Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) -- [MicrosoftOffice2013Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) -- [MicrosoftOffice2016Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) -- [MicrosoftOffice2010PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) -- [MicrosoftOffice2013PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) -- [MicrosoftOffice2016PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) -- [MicrosoftOffice2010Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) -- [MicrosoftOffice2013Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) -- [MicrosoftOffice2016Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) -- [MicrosoftOffice2010Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) -- [MicrosoftOffice2013Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) -- [MicrosoftOffice2016Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) -- [MicrosoftOffice2010SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) -- [MicrosoftOffice2013SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) -- [MicrosoftOffice2010SharePointWorkspace](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) -- [MicrosoftOffice2010Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) -- [MicrosoftOffice2013Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) -- [MicrosoftOffice2016Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) -- [MicrosoftOffice2010Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) -- [MicrosoftOffice2013Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) -- [MicrosoftOffice2016Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) -- [Notepad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) -- [MicrosoftOffice2013OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) -- [MicrosoftOffice2016OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) -- [MicrosoftOffice2013OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) -- [MicrosoftOffice2016OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) -- [MicrosoftOffice2013PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) -- [MicrosoftOffice2016PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) -- [MicrosoftOffice2013ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) -- [MicrosoftOffice2016ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) -- [MicrosoftOffice2013PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) -- [MicrosoftOffice2016PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) -- [MicrosoftOffice2013SharePointDesignerBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) -- [MicrosoftOffice2013VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) -- [MicrosoftOffice2016VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) -- [MicrosoftOffice2013WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) -- [MicrosoftOffice2016WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) -- [Wordpad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) -- [ConfigureSyncMethod](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) -- [DisableWin8Sync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) -- [SyncProviderPingEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) -- [MaxPackageSizeInBytes](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) -- [SettingsStoragePath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) -- [SyncOverMeteredNetwork](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) -- [SyncOverMeteredNetworkWhenRoaming](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) -- [RepositoryTimeout](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) -- [DisableWindowsOSSettings](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) -- [SyncEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) -- [ConfigureVdi](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) -- [Finance](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) -- [Games](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) -- [Maps](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) -- [Music](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) -- [News](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) -- [Reader](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) -- [Sports](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) -- [Travel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) -- [Video](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) -- [Weather](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) -- [MicrosoftOffice2013AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013accessbackup) -- [MicrosoftOffice2016AccessBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016accessbackup) -- [Calculator](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-calculator) -- [MicrosoftOffice2013CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013commonbackup) -- [MicrosoftOffice2016CommonBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016commonbackup) -- [MicrosoftOffice2013ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excelbackup) -- [MicrosoftOffice2016ExcelBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excelbackup) -- [MicrosoftOffice2013InfoPathBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopathbackup) -- [InternetExplorer10](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer10) -- [InternetExplorer11](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer11) -- [InternetExplorer8](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer8) -- [InternetExplorer9](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorer9) -- [InternetExplorerCommon](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-internetexplorercommon) -- [MicrosoftOffice2013LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lyncbackup) -- [MicrosoftOffice2016LyncBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lyncbackup) -- [MicrosoftOffice2010Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010access) -- [MicrosoftOffice2013Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013access) -- [MicrosoftOffice2016Access](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016access) -- [MicrosoftOffice2010Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010excel) -- [MicrosoftOffice2013Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013excel) -- [MicrosoftOffice2016Excel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016excel) -- [MicrosoftOffice2010InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010infopath) -- [MicrosoftOffice2013InfoPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013infopath) -- [MicrosoftOffice2010Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010lync) -- [MicrosoftOffice2013Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013lync) -- [MicrosoftOffice2016Lync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016lync) -- [MicrosoftOffice2010Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010common) -- [MicrosoftOffice2013Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013common) -- [MicrosoftOffice2013UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013uploadcenter) -- [MicrosoftOffice2016Common](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016common) -- [MicrosoftOffice2016UploadCenter](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016uploadcenter) -- [MicrosoftOffice365Access2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2013) -- [MicrosoftOffice365Access2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365access2016) -- [MicrosoftOffice365Common2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2013) -- [MicrosoftOffice365Common2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365common2016) -- [MicrosoftOffice365Excel2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2013) -- [MicrosoftOffice365Excel2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365excel2016) -- [MicrosoftOffice365InfoPath2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365infopath2013) -- [MicrosoftOffice365Lync2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2013) -- [MicrosoftOffice365Lync2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365lync2016) -- [MicrosoftOffice365OneNote2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2013) -- [MicrosoftOffice365OneNote2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365onenote2016) -- [MicrosoftOffice365Outlook2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2013) -- [MicrosoftOffice365Outlook2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365outlook2016) -- [MicrosoftOffice365PowerPoint2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2013) -- [MicrosoftOffice365PowerPoint2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365powerpoint2016) -- [MicrosoftOffice365Project2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2013) -- [MicrosoftOffice365Project2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365project2016) -- [MicrosoftOffice365Publisher2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2013) -- [MicrosoftOffice365Publisher2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365publisher2016) -- [MicrosoftOffice365SharePointDesigner2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365sharepointdesigner2013) -- [MicrosoftOffice365Visio2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2013) -- [MicrosoftOffice365Visio2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365visio2016) -- [MicrosoftOffice365Word2013](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2013) -- [MicrosoftOffice365Word2016](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice365word2016) -- [MicrosoftOffice2013OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onedriveforbusiness) -- [MicrosoftOffice2016OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onedriveforbusiness) -- [MicrosoftOffice2010OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010onenote) -- [MicrosoftOffice2013OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenote) -- [MicrosoftOffice2016OneNote](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenote) -- [MicrosoftOffice2010Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010outlook) -- [MicrosoftOffice2013Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlook) -- [MicrosoftOffice2016Outlook](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlook) -- [MicrosoftOffice2010PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010powerpoint) -- [MicrosoftOffice2013PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpoint) -- [MicrosoftOffice2016PowerPoint](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpoint) -- [MicrosoftOffice2010Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010project) -- [MicrosoftOffice2013Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013project) -- [MicrosoftOffice2016Project](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016project) -- [MicrosoftOffice2010Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010publisher) -- [MicrosoftOffice2013Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisher) -- [MicrosoftOffice2016Publisher](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisher) -- [MicrosoftOffice2010SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointdesigner) -- [MicrosoftOffice2013SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesigner) -- [MicrosoftOffice2010SharePointWorkspace](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010sharepointworkspace) -- [MicrosoftOffice2010Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010visio) -- [MicrosoftOffice2013Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visio) -- [MicrosoftOffice2016Visio](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visio) -- [MicrosoftOffice2010Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2010word) -- [MicrosoftOffice2013Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013word) -- [MicrosoftOffice2016Word](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016word) -- [Notepad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-notepad) -- [MicrosoftOffice2013OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013onenotebackup) -- [MicrosoftOffice2016OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016onenotebackup) -- [MicrosoftOffice2013OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013outlookbackup) -- [MicrosoftOffice2016OutlookBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016outlookbackup) -- [MicrosoftOffice2013PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013powerpointbackup) -- [MicrosoftOffice2016PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016powerpointbackup) -- [MicrosoftOffice2013ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013projectbackup) -- [MicrosoftOffice2016ProjectBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016projectbackup) -- [MicrosoftOffice2013PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013publisherbackup) -- [MicrosoftOffice2016PublisherBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016publisherbackup) -- [MicrosoftOffice2013SharePointDesignerBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013sharepointdesignerbackup) -- [MicrosoftOffice2013VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013visiobackup) -- [MicrosoftOffice2016VisioBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016visiobackup) -- [MicrosoftOffice2013WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2013wordbackup) -- [MicrosoftOffice2016WordBackup](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-microsoftoffice2016wordbackup) -- [Wordpad](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-wordpad) -- [ConfigureSyncMethod](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configuresyncmethod) -- [ContactITDescription](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactitdescription) -- [ContactITUrl](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-contactiturl) -- [DisableWin8Sync](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewin8sync) -- [EnableUEV](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-enableuev) -- [FirstUseNotificationEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-firstusenotificationenabled) -- [SyncProviderPingEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncproviderpingenabled) -- [MaxPackageSizeInBytes](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maxpackagesizeinbytes) -- [SettingsStoragePath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingsstoragepath) -- [SettingsTemplateCatalogPath](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-settingstemplatecatalogpath) -- [SyncOverMeteredNetwork](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetwork) -- [SyncOverMeteredNetworkWhenRoaming](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncovermeterednetworkwhenroaming) -- [SyncUnlistedWindows8Apps](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncunlistedwindows8apps) -- [RepositoryTimeout](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-repositorytimeout) -- [DisableWindowsOSSettings](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-disablewindowsossettings) -- [TrayIconEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-trayiconenabled) -- [SyncEnabled](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-syncenabled) -- [ConfigureVdi](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-configurevdi) -- [Finance](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-finance) -- [Games](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-games) -- [Maps](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-maps) -- [Music](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-music) -- [News](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-news) -- [Reader](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-reader) -- [Sports](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-sports) -- [Travel](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-travel) -- [Video](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-video) -- [Weather](policy-csp-admx-userexperiencevirtualization.md#admx-userexperiencevirtualization-weather) +- [MicrosoftOffice2013AccessBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016AccessBackup](policy-csp-admx-userexperiencevirtualization.md) +- [Calculator](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013CommonBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016CommonBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013ExcelBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016ExcelBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013InfoPathBackup](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer10](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer11](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer8](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer9](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorerCommon](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013LyncBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016LyncBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Access](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Access](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Access](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Excel](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Excel](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Excel](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010InfoPath](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013InfoPath](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Lync](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Lync](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Lync](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Common](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Common](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013UploadCenter](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Common](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016UploadCenter](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Access2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Access2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Common2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Common2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Excel2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Excel2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365InfoPath2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Lync2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Lync2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365OneNote2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365OneNote2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Outlook2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Outlook2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365PowerPoint2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365PowerPoint2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Project2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Project2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Publisher2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Publisher2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365SharePointDesigner2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Visio2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Visio2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Word2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Word2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010OneNote](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OneNote](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OneNote](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Outlook](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Outlook](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Outlook](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010PowerPoint](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013PowerPoint](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016PowerPoint](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Project](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Project](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Project](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Publisher](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Publisher](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Publisher](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010SharePointWorkspace](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Visio](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Visio](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Visio](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Word](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Word](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Word](policy-csp-admx-userexperiencevirtualization.md) +- [Notepad](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OutlookBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OutlookBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013ProjectBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016ProjectBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013PublisherBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016PublisherBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013SharePointDesignerBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013VisioBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016VisioBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013WordBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016WordBackup](policy-csp-admx-userexperiencevirtualization.md) +- [Wordpad](policy-csp-admx-userexperiencevirtualization.md) +- [ConfigureSyncMethod](policy-csp-admx-userexperiencevirtualization.md) +- [DisableWin8Sync](policy-csp-admx-userexperiencevirtualization.md) +- [SyncProviderPingEnabled](policy-csp-admx-userexperiencevirtualization.md) +- [MaxPackageSizeInBytes](policy-csp-admx-userexperiencevirtualization.md) +- [SettingsStoragePath](policy-csp-admx-userexperiencevirtualization.md) +- [SyncOverMeteredNetwork](policy-csp-admx-userexperiencevirtualization.md) +- [SyncOverMeteredNetworkWhenRoaming](policy-csp-admx-userexperiencevirtualization.md) +- [RepositoryTimeout](policy-csp-admx-userexperiencevirtualization.md) +- [DisableWindowsOSSettings](policy-csp-admx-userexperiencevirtualization.md) +- [SyncEnabled](policy-csp-admx-userexperiencevirtualization.md) +- [ConfigureVdi](policy-csp-admx-userexperiencevirtualization.md) +- [Finance](policy-csp-admx-userexperiencevirtualization.md) +- [Games](policy-csp-admx-userexperiencevirtualization.md) +- [Maps](policy-csp-admx-userexperiencevirtualization.md) +- [Music](policy-csp-admx-userexperiencevirtualization.md) +- [News](policy-csp-admx-userexperiencevirtualization.md) +- [Reader](policy-csp-admx-userexperiencevirtualization.md) +- [Sports](policy-csp-admx-userexperiencevirtualization.md) +- [Travel](policy-csp-admx-userexperiencevirtualization.md) +- [Video](policy-csp-admx-userexperiencevirtualization.md) +- [Weather](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013AccessBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016AccessBackup](policy-csp-admx-userexperiencevirtualization.md) +- [Calculator](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013CommonBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016CommonBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013ExcelBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016ExcelBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013InfoPathBackup](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer10](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer11](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer8](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorer9](policy-csp-admx-userexperiencevirtualization.md) +- [InternetExplorerCommon](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013LyncBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016LyncBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Access](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Access](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Access](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Excel](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Excel](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Excel](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010InfoPath](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013InfoPath](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Lync](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Lync](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Lync](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Common](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Common](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013UploadCenter](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Common](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016UploadCenter](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Access2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Access2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Common2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Common2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Excel2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Excel2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365InfoPath2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Lync2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Lync2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365OneNote2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365OneNote2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Outlook2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Outlook2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365PowerPoint2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365PowerPoint2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Project2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Project2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Publisher2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Publisher2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365SharePointDesigner2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Visio2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Visio2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Word2013](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice365Word2016](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OneDriveForBusiness](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010OneNote](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OneNote](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OneNote](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Outlook](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Outlook](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Outlook](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010PowerPoint](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013PowerPoint](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016PowerPoint](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Project](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Project](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Project](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Publisher](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Publisher](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Publisher](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013SharePointDesigner](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010SharePointWorkspace](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Visio](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Visio](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Visio](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2010Word](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013Word](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016Word](policy-csp-admx-userexperiencevirtualization.md) +- [Notepad](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OneNoteBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013OutlookBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016OutlookBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016PowerPointBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013ProjectBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016ProjectBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013PublisherBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016PublisherBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013SharePointDesignerBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013VisioBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016VisioBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2013WordBackup](policy-csp-admx-userexperiencevirtualization.md) +- [MicrosoftOffice2016WordBackup](policy-csp-admx-userexperiencevirtualization.md) +- [Wordpad](policy-csp-admx-userexperiencevirtualization.md) +- [ConfigureSyncMethod](policy-csp-admx-userexperiencevirtualization.md) +- [ContactITDescription](policy-csp-admx-userexperiencevirtualization.md) +- [ContactITUrl](policy-csp-admx-userexperiencevirtualization.md) +- [DisableWin8Sync](policy-csp-admx-userexperiencevirtualization.md) +- [EnableUEV](policy-csp-admx-userexperiencevirtualization.md) +- [FirstUseNotificationEnabled](policy-csp-admx-userexperiencevirtualization.md) +- [SyncProviderPingEnabled](policy-csp-admx-userexperiencevirtualization.md) +- [MaxPackageSizeInBytes](policy-csp-admx-userexperiencevirtualization.md) +- [SettingsStoragePath](policy-csp-admx-userexperiencevirtualization.md) +- [SettingsTemplateCatalogPath](policy-csp-admx-userexperiencevirtualization.md) +- [SyncOverMeteredNetwork](policy-csp-admx-userexperiencevirtualization.md) +- [SyncOverMeteredNetworkWhenRoaming](policy-csp-admx-userexperiencevirtualization.md) +- [SyncUnlistedWindows8Apps](policy-csp-admx-userexperiencevirtualization.md) +- [RepositoryTimeout](policy-csp-admx-userexperiencevirtualization.md) +- [DisableWindowsOSSettings](policy-csp-admx-userexperiencevirtualization.md) +- [TrayIconEnabled](policy-csp-admx-userexperiencevirtualization.md) +- [SyncEnabled](policy-csp-admx-userexperiencevirtualization.md) +- [ConfigureVdi](policy-csp-admx-userexperiencevirtualization.md) +- [Finance](policy-csp-admx-userexperiencevirtualization.md) +- [Games](policy-csp-admx-userexperiencevirtualization.md) +- [Maps](policy-csp-admx-userexperiencevirtualization.md) +- [Music](policy-csp-admx-userexperiencevirtualization.md) +- [News](policy-csp-admx-userexperiencevirtualization.md) +- [Reader](policy-csp-admx-userexperiencevirtualization.md) +- [Sports](policy-csp-admx-userexperiencevirtualization.md) +- [Travel](policy-csp-admx-userexperiencevirtualization.md) +- [Video](policy-csp-admx-userexperiencevirtualization.md) +- [Weather](policy-csp-admx-userexperiencevirtualization.md) ## ADMX_UserProfiles -- [LimitSize](policy-csp-admx-userprofiles.md#admx-userprofiles-limitsize) -- [SlowLinkTimeOut](policy-csp-admx-userprofiles.md#admx-userprofiles-slowlinktimeout) -- [CleanupProfiles](policy-csp-admx-userprofiles.md#admx-userprofiles-cleanupprofiles) -- [DontForceUnloadHive](policy-csp-admx-userprofiles.md#admx-userprofiles-dontforceunloadhive) -- [ProfileErrorAction](policy-csp-admx-userprofiles.md#admx-userprofiles-profileerroraction) -- [LeaveAppMgmtData](policy-csp-admx-userprofiles.md#admx-userprofiles-leaveappmgmtdata) -- [USER_HOME](policy-csp-admx-userprofiles.md#admx-userprofiles-user-home) -- [UserInfoAccessAction](policy-csp-admx-userprofiles.md#admx-userprofiles-userinfoaccessaction) +- [LimitSize](policy-csp-admx-userprofiles.md) +- [SlowLinkTimeOut](policy-csp-admx-userprofiles.md) +- [CleanupProfiles](policy-csp-admx-userprofiles.md) +- [DontForceUnloadHive](policy-csp-admx-userprofiles.md) +- [ProfileErrorAction](policy-csp-admx-userprofiles.md) +- [LeaveAppMgmtData](policy-csp-admx-userprofiles.md) +- [USER_HOME](policy-csp-admx-userprofiles.md) +- [UserInfoAccessAction](policy-csp-admx-userprofiles.md) ## ADMX_W32Time -- [W32TIME_POLICY_CONFIG](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-config) -- [W32TIME_POLICY_CONFIGURE_NTPCLIENT](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-configure-ntpclient) -- [W32TIME_POLICY_ENABLE_NTPCLIENT](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-enable-ntpclient) -- [W32TIME_POLICY_ENABLE_NTPSERVER](policy-csp-admx-w32time.md#admx-w32time-w32time-policy-enable-ntpserver) +- [W32TIME_POLICY_CONFIG](policy-csp-admx-w32time.md) +- [W32TIME_POLICY_CONFIGURE_NTPCLIENT](policy-csp-admx-w32time.md) +- [W32TIME_POLICY_ENABLE_NTPCLIENT](policy-csp-admx-w32time.md) +- [W32TIME_POLICY_ENABLE_NTPSERVER](policy-csp-admx-w32time.md) ## ADMX_WCM -- [WCM_DisablePowerManagement](policy-csp-admx-wcm.md#admx-wcm-wcm-disablepowermanagement) -- [WCM_EnableSoftDisconnect](policy-csp-admx-wcm.md#admx-wcm-wcm-enablesoftdisconnect) -- [WCM_MinimizeConnections](policy-csp-admx-wcm.md#admx-wcm-wcm-minimizeconnections) +- [WCM_DisablePowerManagement](policy-csp-admx-wcm.md) +- [WCM_EnableSoftDisconnect](policy-csp-admx-wcm.md) +- [WCM_MinimizeConnections](policy-csp-admx-wcm.md) ## ADMX_WDI -- [WdiDpsScenarioExecutionPolicy](policy-csp-admx-wdi.md#admx-wdi-wdidpsscenarioexecutionpolicy) -- [WdiDpsScenarioDataSizeLimitPolicy](policy-csp-admx-wdi.md#admx-wdi-wdidpsscenariodatasizelimitpolicy) +- [WdiDpsScenarioExecutionPolicy](policy-csp-admx-wdi.md) +- [WdiDpsScenarioDataSizeLimitPolicy](policy-csp-admx-wdi.md) ## ADMX_WinCal -- [TurnOffWinCal_1](policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-1) -- [TurnOffWinCal_2](policy-csp-admx-wincal.md#admx-wincal-turnoffwincal-2) +- [TurnOffWinCal_1](policy-csp-admx-wincal.md) +- [TurnOffWinCal_2](policy-csp-admx-wincal.md) ## ADMX_WindowsColorSystem -- [ProhibitChangingInstalledProfileList_1](policy-csp-admx-windowscolorsystem.md#admx-windowscolorsystem-prohibitchanginginstalledprofilelist-1) -- [ProhibitChangingInstalledProfileList_2](policy-csp-admx-windowscolorsystem.md#admx-windowscolorsystem-prohibitchanginginstalledprofilelist-2) +- [ProhibitChangingInstalledProfileList_1](policy-csp-admx-windowscolorsystem.md) +- [ProhibitChangingInstalledProfileList_2](policy-csp-admx-windowscolorsystem.md) ## ADMX_WindowsConnectNow -- [WCN_DisableWcnUi_1](policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-1) -- [WCN_EnableRegistrar](policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-enableregistrar) -- [WCN_DisableWcnUi_2](policy-csp-admx-windowsconnectnow.md#admx-windowsconnectnow-wcn-disablewcnui-2) +- [WCN_DisableWcnUi_1](policy-csp-admx-windowsconnectnow.md) +- [WCN_EnableRegistrar](policy-csp-admx-windowsconnectnow.md) +- [WCN_DisableWcnUi_2](policy-csp-admx-windowsconnectnow.md) ## ADMX_WindowsExplorer -- [EnforceShellExtensionSecurity](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enforceshellextensionsecurity) -- [NoBackButton](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nobackbutton) -- [NoPlacesBar](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noplacesbar) -- [NoFileMRU](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemru) -- [PlacesBar](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-placesbar) -- [DisableBindDirectlyToPropertySetStorage](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) -- [DisableKnownFolders](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableknownfolders) -- [ConfirmFileDelete](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-confirmfiledelete) -- [NoFolderOptions](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofolderoptions) -- [NoRecycleFiles](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norecyclefiles) -- [NoRunAsInstallPrompt](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-norunasinstallprompt) -- [LinkResolveIgnoreLinkInfo](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-linkresolveignorelinkinfo) -- [NoDrives](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodrives) -- [NoManageMyComputerVerb](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomanagemycomputerverb) -- [DefaultLibrariesLocation](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) -- [RecycleBinSize](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-recyclebinsize) -- [MaxRecentDocs](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-maxrecentdocs) -- [NoWorkgroupContents](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noworkgroupcontents) -- [NoEntireNetwork](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noentirenetwork) -- [TryHarderPinnedOpenSearch](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedopensearch) -- [TryHarderPinnedLibrary](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-tryharderpinnedlibrary) -- [NoViewOnDrive](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewondrive) -- [NoNetConnectDisconnect](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonetconnectdisconnect) -- [NoCDBurning](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocdburning) -- [NoDFSTab](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nodfstab) -- [NoViewContextMenu](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noviewcontextmenu) -- [NoFileMenu](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nofilemenu) -- [NoHardwareTab](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nohardwaretab) -- [NoShellSearchButton](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-noshellsearchbutton) -- [NoSecurityTab](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosecuritytab) -- [NoMyComputerSharedDocuments](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nomycomputershareddocuments) -- [NoSearchInternetTryHarderButton](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nosearchinternettryharderbutton) -- [NoChangeKeyboardNavigationIndicators](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangekeyboardnavigationindicators) -- [NoChangeAnimation](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nochangeanimation) -- [PromptRunasInstallNetPath](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-promptrunasinstallnetpath) -- [ExplorerRibbonStartsMinimized](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) -- [NoCacheThumbNailPictures](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nocachethumbnailpictures) -- [DisableSearchBoxSuggestions](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablesearchboxsuggestions) -- [NoStrCmpLogical](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) -- [ShellProtocolProtectedModeTitle_1](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-1) -- [HideContentViewModeSnippets](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-hidecontentviewmodesnippets) -- [NoWindowsHotKeys](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nowindowshotkeys) -- [DisableIndexedLibraryExperience](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disableindexedlibraryexperience) -- [ClassicShell](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-classicshell) -- [IZ_Policy_OpenSearchQuery_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) -- [IZ_Policy_OpenSearchPreview_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) -- [IZ_Policy_OpenSearchQuery_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) -- [IZ_Policy_OpenSearchPreview_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) -- [IZ_Policy_OpenSearchQuery_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) -- [IZ_Policy_OpenSearchPreview_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) -- [IZ_Policy_OpenSearchQuery_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) -- [IZ_Policy_OpenSearchPreview_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) -- [IZ_Policy_OpenSearchQuery_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) -- [IZ_Policy_OpenSearchPreview_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) -- [IZ_Policy_OpenSearchQuery_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) -- [IZ_Policy_OpenSearchPreview_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) -- [IZ_Policy_OpenSearchQuery_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) -- [IZ_Policy_OpenSearchPreview_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) -- [IZ_Policy_OpenSearchQuery_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) -- [IZ_Policy_OpenSearchPreview_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) -- [IZ_Policy_OpenSearchQuery_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) -- [IZ_Policy_OpenSearchPreview_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) -- [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) -- [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) -- [EnableShellShortcutIconRemotePath](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enableshellshortcuticonremotepath) -- [EnableSmartScreen](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-enablesmartscreen) -- [DisableBindDirectlyToPropertySetStorage](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-disablebinddirectlytopropertysetstorage) -- [NoNewAppAlert](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nonewappalert) -- [DefaultLibrariesLocation](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-defaultlibrarieslocation) -- [ShowHibernateOption](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showhibernateoption) -- [ShowSleepOption](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-showsleepoption) -- [ExplorerRibbonStartsMinimized](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-explorerribbonstartsminimized) -- [NoStrCmpLogical](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-nostrcmplogical) -- [ShellProtocolProtectedModeTitle_2](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-shellprotocolprotectedmodetitle-2) -- [CheckSameSourceAndTargetForFRAndDFS](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-checksamesourceandtargetforfranddfs) -- [IZ_Policy_OpenSearchQuery_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internet) -- [IZ_Policy_OpenSearchPreview_Internet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internet) -- [IZ_Policy_OpenSearchQuery_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranet) -- [IZ_Policy_OpenSearchPreview_Intranet](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranet) -- [IZ_Policy_OpenSearchQuery_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachine) -- [IZ_Policy_OpenSearchPreview_LocalMachine](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachine) -- [IZ_Policy_OpenSearchQuery_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-internetlockdown) -- [IZ_Policy_OpenSearchPreview_InternetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-internetlockdown) -- [IZ_Policy_OpenSearchQuery_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-intranetlockdown) -- [IZ_Policy_OpenSearchPreview_IntranetLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-intranetlockdown) -- [IZ_Policy_OpenSearchQuery_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-localmachinelockdown) -- [IZ_Policy_OpenSearchPreview_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-localmachinelockdown) -- [IZ_Policy_OpenSearchQuery_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restrictedlockdown) -- [IZ_Policy_OpenSearchPreview_RestrictedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restrictedlockdown) -- [IZ_Policy_OpenSearchQuery_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trustedlockdown) -- [IZ_Policy_OpenSearchPreview_TrustedLockdown](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trustedlockdown) -- [IZ_Policy_OpenSearchQuery_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-restricted) -- [IZ_Policy_OpenSearchPreview_Restricted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-restricted) -- [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchquery-trusted) -- [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md#admx-windowsexplorer-iz-policy-opensearchpreview-trusted) +- [EnforceShellExtensionSecurity](policy-csp-admx-windowsexplorer.md) +- [NoBackButton](policy-csp-admx-windowsexplorer.md) +- [NoPlacesBar](policy-csp-admx-windowsexplorer.md) +- [NoFileMRU](policy-csp-admx-windowsexplorer.md) +- [PlacesBar](policy-csp-admx-windowsexplorer.md) +- [DisableBindDirectlyToPropertySetStorage](policy-csp-admx-windowsexplorer.md) +- [DisableKnownFolders](policy-csp-admx-windowsexplorer.md) +- [ConfirmFileDelete](policy-csp-admx-windowsexplorer.md) +- [NoFolderOptions](policy-csp-admx-windowsexplorer.md) +- [NoRecycleFiles](policy-csp-admx-windowsexplorer.md) +- [NoRunAsInstallPrompt](policy-csp-admx-windowsexplorer.md) +- [LinkResolveIgnoreLinkInfo](policy-csp-admx-windowsexplorer.md) +- [NoDrives](policy-csp-admx-windowsexplorer.md) +- [NoManageMyComputerVerb](policy-csp-admx-windowsexplorer.md) +- [DefaultLibrariesLocation](policy-csp-admx-windowsexplorer.md) +- [RecycleBinSize](policy-csp-admx-windowsexplorer.md) +- [MaxRecentDocs](policy-csp-admx-windowsexplorer.md) +- [NoWorkgroupContents](policy-csp-admx-windowsexplorer.md) +- [NoEntireNetwork](policy-csp-admx-windowsexplorer.md) +- [TryHarderPinnedOpenSearch](policy-csp-admx-windowsexplorer.md) +- [TryHarderPinnedLibrary](policy-csp-admx-windowsexplorer.md) +- [NoViewOnDrive](policy-csp-admx-windowsexplorer.md) +- [NoNetConnectDisconnect](policy-csp-admx-windowsexplorer.md) +- [NoCDBurning](policy-csp-admx-windowsexplorer.md) +- [NoDFSTab](policy-csp-admx-windowsexplorer.md) +- [NoViewContextMenu](policy-csp-admx-windowsexplorer.md) +- [NoFileMenu](policy-csp-admx-windowsexplorer.md) +- [NoHardwareTab](policy-csp-admx-windowsexplorer.md) +- [NoShellSearchButton](policy-csp-admx-windowsexplorer.md) +- [NoSecurityTab](policy-csp-admx-windowsexplorer.md) +- [NoMyComputerSharedDocuments](policy-csp-admx-windowsexplorer.md) +- [NoSearchInternetTryHarderButton](policy-csp-admx-windowsexplorer.md) +- [NoChangeKeyboardNavigationIndicators](policy-csp-admx-windowsexplorer.md) +- [NoChangeAnimation](policy-csp-admx-windowsexplorer.md) +- [PromptRunasInstallNetPath](policy-csp-admx-windowsexplorer.md) +- [ExplorerRibbonStartsMinimized](policy-csp-admx-windowsexplorer.md) +- [NoCacheThumbNailPictures](policy-csp-admx-windowsexplorer.md) +- [DisableSearchBoxSuggestions](policy-csp-admx-windowsexplorer.md) +- [NoStrCmpLogical](policy-csp-admx-windowsexplorer.md) +- [ShellProtocolProtectedModeTitle_1](policy-csp-admx-windowsexplorer.md) +- [HideContentViewModeSnippets](policy-csp-admx-windowsexplorer.md) +- [NoWindowsHotKeys](policy-csp-admx-windowsexplorer.md) +- [DisableIndexedLibraryExperience](policy-csp-admx-windowsexplorer.md) +- [ClassicShell](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Internet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Internet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Intranet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Intranet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_LocalMachine](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_LocalMachine](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_InternetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_InternetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_IntranetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_IntranetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_RestrictedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_RestrictedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_TrustedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_TrustedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Restricted](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Restricted](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md) +- [EnableShellShortcutIconRemotePath](policy-csp-admx-windowsexplorer.md) +- [EnableSmartScreen](policy-csp-admx-windowsexplorer.md) +- [DisableBindDirectlyToPropertySetStorage](policy-csp-admx-windowsexplorer.md) +- [NoNewAppAlert](policy-csp-admx-windowsexplorer.md) +- [DefaultLibrariesLocation](policy-csp-admx-windowsexplorer.md) +- [ShowHibernateOption](policy-csp-admx-windowsexplorer.md) +- [ShowSleepOption](policy-csp-admx-windowsexplorer.md) +- [ExplorerRibbonStartsMinimized](policy-csp-admx-windowsexplorer.md) +- [NoStrCmpLogical](policy-csp-admx-windowsexplorer.md) +- [ShellProtocolProtectedModeTitle_2](policy-csp-admx-windowsexplorer.md) +- [CheckSameSourceAndTargetForFRAndDFS](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Internet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Internet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Intranet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Intranet](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_LocalMachine](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_LocalMachine](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_InternetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_InternetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_IntranetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_IntranetLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_LocalMachineLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_RestrictedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_RestrictedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_TrustedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_TrustedLockdown](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Restricted](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Restricted](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchQuery_Trusted](policy-csp-admx-windowsexplorer.md) +- [IZ_Policy_OpenSearchPreview_Trusted](policy-csp-admx-windowsexplorer.md) ## ADMX_WindowsMediaDRM -- [DisableOnline](policy-csp-admx-windowsmediadrm.md#admx-windowsmediadrm-disableonline) +- [DisableOnline](policy-csp-admx-windowsmediadrm.md) ## ADMX_WindowsMediaPlayer -- [ConfigureHTTPProxySettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurehttpproxysettings) -- [ConfigureMMSProxySettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configuremmsproxysettings) -- [NetworkBuffering](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-networkbuffering) -- [ConfigureRTSPProxySettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-configurertspproxysettings) -- [DisableNetworkSettings](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablenetworksettings) -- [WindowsStreamingMediaProtocols](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-windowsstreamingmediaprotocols) -- [EnableScreenSaver](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-enablescreensaver) -- [PolicyCodecUpdate](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-policycodecupdate) -- [PreventCDDVDMetadataRetrieval](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventcddvdmetadataretrieval) -- [PreventMusicFileMetadataRetrieval](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventmusicfilemetadataretrieval) -- [PreventRadioPresetsRetrieval](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventradiopresetsretrieval) -- [DoNotShowAnchor](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-donotshowanchor) -- [HidePrivacyTab](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hideprivacytab) -- [HideSecurityTab](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-hidesecuritytab) -- [SkinLockDown](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-skinlockdown) -- [DisableSetupFirstUseConfiguration](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disablesetupfirstuseconfiguration) -- [DisableAutoUpdate](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-disableautoupdate) -- [PreventWMPDeskTopShortcut](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventwmpdesktopshortcut) -- [PreventLibrarySharing](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventlibrarysharing) -- [PreventQuickLaunchShortcut](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventquicklaunchshortcut) -- [DontUseFrameInterpolation](policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-dontuseframeinterpolation) +- [ConfigureHTTPProxySettings](policy-csp-admx-windowsmediaplayer.md) +- [ConfigureMMSProxySettings](policy-csp-admx-windowsmediaplayer.md) +- [NetworkBuffering](policy-csp-admx-windowsmediaplayer.md) +- [ConfigureRTSPProxySettings](policy-csp-admx-windowsmediaplayer.md) +- [DisableNetworkSettings](policy-csp-admx-windowsmediaplayer.md) +- [WindowsStreamingMediaProtocols](policy-csp-admx-windowsmediaplayer.md) +- [EnableScreenSaver](policy-csp-admx-windowsmediaplayer.md) +- [PolicyCodecUpdate](policy-csp-admx-windowsmediaplayer.md) +- [PreventCDDVDMetadataRetrieval](policy-csp-admx-windowsmediaplayer.md) +- [PreventMusicFileMetadataRetrieval](policy-csp-admx-windowsmediaplayer.md) +- [PreventRadioPresetsRetrieval](policy-csp-admx-windowsmediaplayer.md) +- [DoNotShowAnchor](policy-csp-admx-windowsmediaplayer.md) +- [HidePrivacyTab](policy-csp-admx-windowsmediaplayer.md) +- [HideSecurityTab](policy-csp-admx-windowsmediaplayer.md) +- [SkinLockDown](policy-csp-admx-windowsmediaplayer.md) +- [DisableSetupFirstUseConfiguration](policy-csp-admx-windowsmediaplayer.md) +- [DisableAutoUpdate](policy-csp-admx-windowsmediaplayer.md) +- [PreventWMPDeskTopShortcut](policy-csp-admx-windowsmediaplayer.md) +- [PreventLibrarySharing](policy-csp-admx-windowsmediaplayer.md) +- [PreventQuickLaunchShortcut](policy-csp-admx-windowsmediaplayer.md) +- [DontUseFrameInterpolation](policy-csp-admx-windowsmediaplayer.md) ## ADMX_WindowsRemoteManagement -- [DisallowKerberos_2](policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-2) -- [DisallowKerberos_1](policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-1) +- [DisallowKerberos_2](policy-csp-admx-windowsremotemanagement.md) +- [DisallowKerberos_1](policy-csp-admx-windowsremotemanagement.md) ## ADMX_WindowsStore -- [DisableOSUpgrade_1](policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-1) -- [RemoveWindowsStore_1](policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-1) -- [DisableAutoDownloadWin8](policy-csp-admx-windowsstore.md#admx-windowsstore-disableautodownloadwin8) -- [DisableOSUpgrade_2](policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-2) -- [RemoveWindowsStore_2](policy-csp-admx-windowsstore.md#admx-windowsstore-removewindowsstore-2) +- [DisableOSUpgrade_1](policy-csp-admx-windowsstore.md) +- [RemoveWindowsStore_1](policy-csp-admx-windowsstore.md) +- [DisableAutoDownloadWin8](policy-csp-admx-windowsstore.md) +- [DisableOSUpgrade_2](policy-csp-admx-windowsstore.md) +- [RemoveWindowsStore_2](policy-csp-admx-windowsstore.md) ## ADMX_WinInit -- [Hiberboot](policy-csp-admx-wininit.md#admx-wininit-hiberboot) -- [ShutdownTimeoutHungSessionsDescription](policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription) -- [DisableNamedPipeShutdownPolicyDescription](policy-csp-admx-wininit.md#admx-wininit-disablenamedpipeshutdownpolicydescription) +- [Hiberboot](policy-csp-admx-wininit.md) +- [ShutdownTimeoutHungSessionsDescription](policy-csp-admx-wininit.md) +- [DisableNamedPipeShutdownPolicyDescription](policy-csp-admx-wininit.md) ## ADMX_WinLogon -- [CustomShell](policy-csp-admx-winlogon.md#admx-winlogon-customshell) -- [LogonHoursNotificationPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-logonhoursnotificationpolicydescription) -- [ReportCachedLogonPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) -- [LogonHoursPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-logonhourspolicydescription) -- [SoftwareSASGeneration](policy-csp-admx-winlogon.md#admx-winlogon-softwaresasgeneration) -- [DisplayLastLogonInfoDescription](policy-csp-admx-winlogon.md#admx-winlogon-displaylastlogoninfodescription) -- [ReportCachedLogonPolicyDescription](policy-csp-admx-winlogon.md#admx-winlogon-reportcachedlogonpolicydescription) +- [CustomShell](policy-csp-admx-winlogon.md) +- [LogonHoursNotificationPolicyDescription](policy-csp-admx-winlogon.md) +- [ReportCachedLogonPolicyDescription](policy-csp-admx-winlogon.md) +- [LogonHoursPolicyDescription](policy-csp-admx-winlogon.md) +- [SoftwareSASGeneration](policy-csp-admx-winlogon.md) +- [DisplayLastLogonInfoDescription](policy-csp-admx-winlogon.md) +- [ReportCachedLogonPolicyDescription](policy-csp-admx-winlogon.md) ## ADMX_Winsrv -- [AllowBlockingAppsAtShutdown](policy-csp-admx-winsrv.md#admx-winsrv-allowblockingappsatshutdown) +- [AllowBlockingAppsAtShutdown](policy-csp-admx-winsrv.md) ## ADMX_wlansvc -- [SetPINPreferred](policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) -- [SetPINEnforced](policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced) -- [SetCost](policy-csp-admx-wlansvc.md#admx-wlansvc-setcost) +- [SetPINPreferred](policy-csp-admx-wlansvc.md) +- [SetPINEnforced](policy-csp-admx-wlansvc.md) +- [SetCost](policy-csp-admx-wlansvc.md) ## ADMX_WordWheel -- [CustomSearch](policy-csp-admx-wordwheel.md#admx-wordwheel-customsearch) +- [CustomSearch](policy-csp-admx-wordwheel.md) ## ADMX_WorkFoldersClient -- [Pol_UserEnableTokenBroker](policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol-userenabletokenbroker) -- [Pol_UserEnableWorkFolders](policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol-userenableworkfolders) -- [Pol_MachineEnableWorkFolders](policy-csp-admx-workfoldersclient.md#admx-workfoldersclient-pol-machineenableworkfolders) +- [Pol_UserEnableTokenBroker](policy-csp-admx-workfoldersclient.md) +- [Pol_UserEnableWorkFolders](policy-csp-admx-workfoldersclient.md) +- [Pol_MachineEnableWorkFolders](policy-csp-admx-workfoldersclient.md) ## ADMX_WPN -- [QuietHoursDailyBeginMinute](policy-csp-admx-wpn.md#admx-wpn-quiethoursdailybeginminute) -- [QuietHoursDailyEndMinute](policy-csp-admx-wpn.md#admx-wpn-quiethoursdailyendminute) -- [NoCallsDuringQuietHours](policy-csp-admx-wpn.md#admx-wpn-nocallsduringquiethours) -- [NoQuietHours](policy-csp-admx-wpn.md#admx-wpn-noquiethours) -- [NoToastNotification](policy-csp-admx-wpn.md#admx-wpn-notoastnotification) -- [NoLockScreenToastNotification](policy-csp-admx-wpn.md#admx-wpn-nolockscreentoastnotification) -- [NoToastNotification](policy-csp-admx-wpn.md#admx-wpn-notoastnotification) +- [QuietHoursDailyBeginMinute](policy-csp-admx-wpn.md) +- [QuietHoursDailyEndMinute](policy-csp-admx-wpn.md) +- [NoCallsDuringQuietHours](policy-csp-admx-wpn.md) +- [NoQuietHours](policy-csp-admx-wpn.md) +- [NoToastNotification](policy-csp-admx-wpn.md) +- [NoLockScreenToastNotification](policy-csp-admx-wpn.md) +- [NoToastNotification](policy-csp-admx-wpn.md) ## AppRuntime -- [AllowMicrosoftAccountsToBeOptional](policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AllowMicrosoftAccountsToBeOptional](policy-csp-appruntime.md) ## AppVirtualization -- [AllowAppVClient](policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [ClientCoexistenceAllowMigrationmode](policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [IntegrationAllowRootUser](policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [IntegrationAllowRootGlobal](policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AllowRoamingFileExclusions](policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AllowRoamingRegistryExclusions](policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AllowPackageCleanup](policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AllowPublishingRefreshUX](policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [PublishingAllowServer1](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [PublishingAllowServer2](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [PublishingAllowServer3](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [PublishingAllowServer4](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [PublishingAllowServer5](policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AllowReportingServer](policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AllowPackageScripts](policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [StreamingAllowHighCostLaunch](policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [StreamingAllowCertificateFilterForClient_SSL](policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [StreamingSupportBranchCache](policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [StreamingAllowLocationProvider](policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [StreamingAllowPackageInstallationRoot](policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [StreamingAllowPackageSourceRoot](policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [StreamingAllowReestablishmentInterval](policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [StreamingAllowReestablishmentRetries](policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [StreamingSharedContentStoreMode](policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AllowStreamingAutoload](policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [StreamingVerifyCertificateRevocationList](policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AllowDynamicVirtualization](policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [VirtualComponentsAllowList](policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [AllowAppVClient](policy-csp-appvirtualization.md) +- [ClientCoexistenceAllowMigrationmode](policy-csp-appvirtualization.md) +- [IntegrationAllowRootUser](policy-csp-appvirtualization.md) +- [IntegrationAllowRootGlobal](policy-csp-appvirtualization.md) +- [AllowRoamingFileExclusions](policy-csp-appvirtualization.md) +- [AllowRoamingRegistryExclusions](policy-csp-appvirtualization.md) +- [AllowPackageCleanup](policy-csp-appvirtualization.md) +- [AllowPublishingRefreshUX](policy-csp-appvirtualization.md) +- [PublishingAllowServer1](policy-csp-appvirtualization.md) +- [PublishingAllowServer2](policy-csp-appvirtualization.md) +- [PublishingAllowServer3](policy-csp-appvirtualization.md) +- [PublishingAllowServer4](policy-csp-appvirtualization.md) +- [PublishingAllowServer5](policy-csp-appvirtualization.md) +- [AllowReportingServer](policy-csp-appvirtualization.md) +- [AllowPackageScripts](policy-csp-appvirtualization.md) +- [StreamingAllowHighCostLaunch](policy-csp-appvirtualization.md) +- [StreamingAllowCertificateFilterForClient_SSL](policy-csp-appvirtualization.md) +- [StreamingSupportBranchCache](policy-csp-appvirtualization.md) +- [StreamingAllowLocationProvider](policy-csp-appvirtualization.md) +- [StreamingAllowPackageInstallationRoot](policy-csp-appvirtualization.md) +- [StreamingAllowPackageSourceRoot](policy-csp-appvirtualization.md) +- [StreamingAllowReestablishmentInterval](policy-csp-appvirtualization.md) +- [StreamingAllowReestablishmentRetries](policy-csp-appvirtualization.md) +- [StreamingSharedContentStoreMode](policy-csp-appvirtualization.md) +- [AllowStreamingAutoload](policy-csp-appvirtualization.md) +- [StreamingVerifyCertificateRevocationList](policy-csp-appvirtualization.md) +- [AllowDynamicVirtualization](policy-csp-appvirtualization.md) +- [VirtualComponentsAllowList](policy-csp-appvirtualization.md) ## AttachmentManager -- [DoNotPreserveZoneInformation](policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [HideZoneInfoMechanism](policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [NotifyAntivirusPrograms](policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [DoNotPreserveZoneInformation](policy-csp-attachmentmanager.md) +- [HideZoneInfoMechanism](policy-csp-attachmentmanager.md) +- [NotifyAntivirusPrograms](policy-csp-attachmentmanager.md) ## Autoplay -- [DisallowAutoplayForNonVolumeDevices](policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [SetDefaultAutoRunBehavior](policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [TurnOffAutoPlay](policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [DisallowAutoplayForNonVolumeDevices](policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [SetDefaultAutoRunBehavior](policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [TurnOffAutoPlay](policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [DisallowAutoplayForNonVolumeDevices](policy-csp-autoplay.md) +- [SetDefaultAutoRunBehavior](policy-csp-autoplay.md) +- [TurnOffAutoPlay](policy-csp-autoplay.md) +- [DisallowAutoplayForNonVolumeDevices](policy-csp-autoplay.md) +- [SetDefaultAutoRunBehavior](policy-csp-autoplay.md) +- [TurnOffAutoPlay](policy-csp-autoplay.md) ## Cellular -- [ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [ShowAppCellularAccessUI](policy-csp-cellular.md) ## Connectivity -- [HardenedUNCPaths](policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [ProhibitInstallationAndConfigurationOfNetworkBridge](policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [DisableDownloadingOfPrintDriversOverHTTP](policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [DiablePrintingOverHTTP](policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [HardenedUNCPaths](policy-csp-connectivity.md) +- [ProhibitInstallationAndConfigurationOfNetworkBridge](policy-csp-connectivity.md) +- [DisableDownloadingOfPrintDriversOverHTTP](policy-csp-connectivity.md) +- [DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](policy-csp-connectivity.md) +- [DiablePrintingOverHTTP](policy-csp-connectivity.md) ## CredentialProviders -- [BlockPicturePassword](policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [AllowPINLogon](policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [BlockPicturePassword](policy-csp-credentialproviders.md) +- [AllowPINLogon](policy-csp-credentialproviders.md) ## CredentialsDelegation -- [RemoteHostAllowsDelegationOfNonExportableCredentials](policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [RemoteHostAllowsDelegationOfNonExportableCredentials](policy-csp-credentialsdelegation.md) ## CredentialsUI -- [DisablePasswordReveal](policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [DisablePasswordReveal](policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [EnumerateAdministrators](policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [DisablePasswordReveal](policy-csp-credentialsui.md) +- [DisablePasswordReveal](policy-csp-credentialsui.md) +- [EnumerateAdministrators](policy-csp-credentialsui.md) ## DataUsage -- [SetCost3G](policy-csp-datausage.md#datausage-setcost3g) -- [SetCost4G](policy-csp-datausage.md#datausage-setcost4g) +- [SetCost3G](policy-csp-datausage.md) +- [SetCost4G](policy-csp-datausage.md) ## DeliveryOptimization -- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md) ## Desktop -- [PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md) ## DesktopAppInstaller -- [EnableAppInstaller](policy-csp-desktopappinstaller.md#desktopappinstaller-enableappinstaller) -- [EnableSettings](policy-csp-desktopappinstaller.md#desktopappinstaller-enablesettings) -- [EnableExperimentalFeatures](policy-csp-desktopappinstaller.md#desktopappinstaller-enableexperimentalfeatures) -- [EnableLocalManifestFiles](policy-csp-desktopappinstaller.md#desktopappinstaller-enablelocalmanifestfiles) -- [EnableHashOverride](policy-csp-desktopappinstaller.md#desktopappinstaller-enablehashoverride) -- [EnableDefaultSource](policy-csp-desktopappinstaller.md#desktopappinstaller-enabledefaultsource) -- [EnableMicrosoftStoreSource](policy-csp-desktopappinstaller.md#desktopappinstaller-enablemicrosoftstoresource) -- [SourceAutoUpdateInterval](policy-csp-desktopappinstaller.md#desktopappinstaller-sourceautoupdateinterval) -- [EnableAdditionalSources](policy-csp-desktopappinstaller.md#desktopappinstaller-enableadditionalsources) -- [EnableAllowedSources](policy-csp-desktopappinstaller.md#desktopappinstaller-enableallowedsources) -- [EnableMSAppInstallerProtocol](policy-csp-desktopappinstaller.md#desktopappinstaller-enablemsappinstallerprotocol) +- [EnableAppInstaller](policy-csp-desktopappinstaller.md) +- [EnableSettings](policy-csp-desktopappinstaller.md) +- [EnableExperimentalFeatures](policy-csp-desktopappinstaller.md) +- [EnableLocalManifestFiles](policy-csp-desktopappinstaller.md) +- [EnableHashOverride](policy-csp-desktopappinstaller.md) +- [EnableDefaultSource](policy-csp-desktopappinstaller.md) +- [EnableMicrosoftStoreSource](policy-csp-desktopappinstaller.md) +- [SourceAutoUpdateInterval](policy-csp-desktopappinstaller.md) +- [EnableAdditionalSources](policy-csp-desktopappinstaller.md) +- [EnableAllowedSources](policy-csp-desktopappinstaller.md) +- [EnableMSAppInstallerProtocol](policy-csp-desktopappinstaller.md) ## DeviceInstallation -- [PreventInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceinstanceids) -- [PreventInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md#deviceinstallation-enableinstallationpolicylayering) -- [AllowInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceinstanceids) -- [PreventDeviceMetadataFromNetwork](policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [PreventInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) +- [PreventInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) +- [PreventInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) +- [PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](policy-csp-deviceinstallation.md) +- [EnableInstallationPolicyLayering](policy-csp-deviceinstallation.md) +- [AllowInstallationOfMatchingDeviceSetupClasses](policy-csp-deviceinstallation.md) +- [AllowInstallationOfMatchingDeviceIDs](policy-csp-deviceinstallation.md) +- [AllowInstallationOfMatchingDeviceInstanceIDs](policy-csp-deviceinstallation.md) +- [PreventDeviceMetadataFromNetwork](policy-csp-deviceinstallation.md) ## DeviceLock -- [PreventLockScreenSlideShow](policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [PreventEnablingLockScreenCamera](policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [PreventLockScreenSlideShow](policy-csp-devicelock.md) +- [PreventEnablingLockScreenCamera](policy-csp-devicelock.md) ## ErrorReporting -- [DisableWindowsErrorReporting](policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [DisplayErrorNotification](policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [DoNotSendAdditionalData](policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [PreventCriticalErrorDisplay](policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [CustomizeConsentSettings](policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [DisableWindowsErrorReporting](policy-csp-errorreporting.md) +- [DisplayErrorNotification](policy-csp-errorreporting.md) +- [DoNotSendAdditionalData](policy-csp-errorreporting.md) +- [PreventCriticalErrorDisplay](policy-csp-errorreporting.md) +- [CustomizeConsentSettings](policy-csp-errorreporting.md) ## EventLogService -- [ControlEventLogBehavior](policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [SpecifyMaximumFileSizeApplicationLog](policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [SpecifyMaximumFileSizeSecurityLog](policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [SpecifyMaximumFileSizeSystemLog](policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [ControlEventLogBehavior](policy-csp-eventlogservice.md) +- [SpecifyMaximumFileSizeApplicationLog](policy-csp-eventlogservice.md) +- [SpecifyMaximumFileSizeSecurityLog](policy-csp-eventlogservice.md) +- [SpecifyMaximumFileSizeSystemLog](policy-csp-eventlogservice.md) ## FileExplorer -- [TurnOffDataExecutionPreventionForExplorer](policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [TurnOffHeapTerminationOnCorruption](policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [TurnOffDataExecutionPreventionForExplorer](policy-csp-fileexplorer.md) +- [TurnOffHeapTerminationOnCorruption](policy-csp-fileexplorer.md) ## InternetExplorer -- [AddSearchProvider](policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [DisableSecondaryHomePageChange](policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [DisableProxyChange](policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [DisableSearchProviderChange](policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [DisableCustomerExperienceImprovementProgramParticipation](policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [AllowSuggestedSites](policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) -- [DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [DisableFirstRunWizard](policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [DisableFlipAheadFeature](policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [DisableHomePageChange](policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [PreventManagingSmartScreenFilter](policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [SearchProviderList](policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [AllowActiveXFiltering](policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [AllowEnterpriseModeSiteList](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [SendSitesNotInEnterpriseSiteListToEdge](policy-csp-internetexplorer.md#internetexplorer-sendsitesnotinenterprisesitelisttoedge) -- [ConfigureEdgeRedirectChannel](policy-csp-internetexplorer.md#internetexplorer-configureedgeredirectchannel) -- [KeepIntranetSitesInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-keepintranetsitesininternetexplorer) -- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md#internetexplorer-allowsavetargetasiniemode) -- [DisableInternetExplorerApp](policy-csp-internetexplorer.md#internetexplorer-disableinternetexplorerapp) -- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md#internetexplorer-enableextendediemodehotkeys) -- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md#internetexplorer-resetzoomfordialoginiemode) -- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md#internetexplorer-enableglobalwindowlistiniemode) -- [JScriptReplacement](policy-csp-internetexplorer.md#internetexplorer-jscriptreplacement) -- [AllowInternetExplorerStandardsMode](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [AllowInternetExplorer7PolicyList](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [DisableEncryptionSupport](policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [AllowEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [AllowInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [IncludeAllLocalSites](policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [IncludeAllNetworkPaths](policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [AllowIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [AllowLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [AllowLockedDownInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [AllowLockedDownIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [AllowLockedDownLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [AllowLockedDownRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [AllowsLockedDownTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [AllowsRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [AllowSiteToZoneAssignmentList](policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [AllowTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [LockedDownInternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [IntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [LockedDownIntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [TrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [LockedDownTrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [RestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [LockedDownRestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [LocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [LockedDownLocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [LockedDownInternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [IntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [LockedDownIntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [TrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [LockedDownTrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [RestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [LockedDownRestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [LocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [LockedDownLocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [LockedDownInternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [IntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [LockedDownIntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [TrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [LockedDownTrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [RestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [LockedDownRestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [LocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [LockedDownLocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [IntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [LocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [IntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [LocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [LockedDownInternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [IntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [LockedDownIntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [TrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [RestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [LocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [LockedDownInternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [IntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [LockedDownIntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [TrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [LockedDownTrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [RestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [LocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [LockedDownLocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [LockedDownInternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [IntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [LockedDownIntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [TrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [RestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [LocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [LockedDownInternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [IntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [LockedDownIntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [TrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [LockedDownTrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [RestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [LockedDownRestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [LocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [LockedDownLocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [LockedDownInternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [IntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [LockedDownIntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [TrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [LockedDownTrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [RestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [LockedDownRestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [LocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [LockedDownLocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [LockedDownInternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [IntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [LockedDownIntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [TrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [LockedDownTrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [RestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [LocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [LockedDownLocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [AllowAddOnList](policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [DoNotBlockOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [DoNotBlockOutdatedActiveXControlsOnSpecificDomains](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [DisableEnclosureDownloading](policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [DisableBypassOfSmartScreenWarnings](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [DisableBypassOfSmartScreenWarningsAboutUncommonFiles](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [AllowOneWordEntry](policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [AllowEnterpriseModeFromToolsMenu](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [RestrictedSitesZoneAllowActiveScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [RestrictedSitesZoneAllowBinaryAndScriptBehaviors](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [RestrictedSitesZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [AllowDeletingBrowsingHistoryOnExit](policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [RestrictedSitesZoneAllowFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [RestrictedSitesZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [RestrictedSitesZoneAllowMETAREFRESH](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [RestrictedSitesZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [AllowSoftwareWhenSignatureIsInvalid](policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [CheckServerCertificateRevocation](policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [CheckSignaturesOnDownloadedPrograms](policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [DisableConfiguringHistory](policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [DoNotAllowActiveXControlsInProtectedMode](policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [RestrictedSitesZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [RestrictedSitesZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [RestrictedSitesZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [ConsistentMimeHandlingInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [MimeSniffingSafetyFeatureInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [MKProtocolSecurityRestrictionInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [NotificationBarInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [ProtectionFromZoneElevationInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [RestrictActiveXInstallInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [RestrictFileDownloadInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [IntranetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [LocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [LockedDownInternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [LockedDownLocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [LockedDownRestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [LockedDownTrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [RestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [TrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [RestrictedSitesZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [DisableDeletingUserVisitedWebsites](policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [DisableIgnoringCertificateErrors](policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [PreventPerUserInstallationOfActiveXControls](policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [RemoveRunThisTimeButtonForOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [RestrictedSitesZoneRunActiveXControlsAndPlugins](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [RestrictedSitesZoneScriptingOfJavaApplets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [SpecifyUseOfActiveXInstallerService](policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [DisableCrashDetection](policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [DisableInPrivateBrowsing](policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [DisableSecuritySettingsCheck](policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [DisableProcessesInEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [AllowCertificateAddressMismatchWarning](policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [RestrictedSitesZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetZoneEnableProtectedMode](policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [RestrictedSitesZoneTurnOnProtectedMode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [AllowAutoComplete](policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [RestrictedSitesZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [LockedDownIntranetJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [DisableHTMLApplication](policy-csp-internetexplorer.md#internetexplorer-disablehtmlapplication) -- [AddSearchProvider](policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [DisableSecondaryHomePageChange](policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [DisableUpdateCheck](policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [DisableProxyChange](policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [DisableSearchProviderChange](policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [DisableCustomerExperienceImprovementProgramParticipation](policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) -- [AllowSuggestedSites](policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) -- [DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) -- [DisableFirstRunWizard](policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [DisableFlipAheadFeature](policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) -- [DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) -- [NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) -- [PreventManagingSmartScreenFilter](policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [SearchProviderList](policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [DoNotAllowUsersToAddSites](policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [DoNotAllowUsersToChangePolicies](policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [AllowActiveXFiltering](policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [AllowEnterpriseModeSiteList](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [SendSitesNotInEnterpriseSiteListToEdge](policy-csp-internetexplorer.md#internetexplorer-sendsitesnotinenterprisesitelisttoedge) -- [ConfigureEdgeRedirectChannel](policy-csp-internetexplorer.md#internetexplorer-configureedgeredirectchannel) -- [KeepIntranetSitesInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-keepintranetsitesininternetexplorer) -- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md#internetexplorer-allowsavetargetasiniemode) -- [DisableInternetExplorerApp](policy-csp-internetexplorer.md#internetexplorer-disableinternetexplorerapp) -- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md#internetexplorer-enableextendediemodehotkeys) -- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md#internetexplorer-resetzoomfordialoginiemode) -- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md#internetexplorer-enableglobalwindowlistiniemode) -- [JScriptReplacement](policy-csp-internetexplorer.md#internetexplorer-jscriptreplacement) -- [AllowInternetExplorerStandardsMode](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [AllowInternetExplorer7PolicyList](policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [DisableEncryptionSupport](policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [AllowEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [AllowInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [IncludeAllLocalSites](policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [IncludeAllNetworkPaths](policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [AllowIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [AllowLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [AllowLockedDownInternetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [AllowLockedDownIntranetZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [AllowLockedDownLocalMachineZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [AllowLockedDownRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [AllowsLockedDownTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [AllowsRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [AllowSiteToZoneAssignmentList](policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [AllowTrustedSitesZoneTemplate](policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [LockedDownInternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [IntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [LockedDownIntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [TrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [LockedDownTrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [RestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [LockedDownRestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [LocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [LockedDownLocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [LockedDownInternetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [IntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [LockedDownIntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [TrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [LockedDownTrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [RestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [LockedDownRestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [LocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [LockedDownLocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [LockedDownInternetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [IntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [LockedDownIntranetZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [TrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [LockedDownTrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [RestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [LockedDownRestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [LocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [LockedDownLocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [IntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [LocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [IntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [LocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [LockedDownInternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [IntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [LockedDownIntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [TrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [RestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [LocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [LockedDownInternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [IntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [LockedDownIntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [TrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [LockedDownTrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [RestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [LocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [LockedDownLocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [LockedDownInternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [IntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [LockedDownIntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [TrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [RestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [LocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [LockedDownInternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [IntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [LockedDownIntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [TrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [LockedDownTrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [RestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [LockedDownRestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [LocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [LockedDownLocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [LockedDownInternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [IntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [LockedDownIntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [TrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [LockedDownTrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [RestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [LockedDownRestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [LocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [LockedDownLocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [LockedDownInternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [IntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [LockedDownIntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [TrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [LockedDownTrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [RestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [LocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [LockedDownLocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [AllowAddOnList](policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [DoNotBlockOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [DoNotBlockOutdatedActiveXControlsOnSpecificDomains](policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [DisableEnclosureDownloading](policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [DisableBypassOfSmartScreenWarnings](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [DisableBypassOfSmartScreenWarningsAboutUncommonFiles](policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [AllowOneWordEntry](policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [AllowEnterpriseModeFromToolsMenu](policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [RestrictedSitesZoneAllowActiveScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [RestrictedSitesZoneAllowBinaryAndScriptBehaviors](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [RestrictedSitesZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [AllowDeletingBrowsingHistoryOnExit](policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [AllowFallbackToSSL3](policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [RestrictedSitesZoneAllowFileDownloads](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [RestrictedSitesZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [RestrictedSitesZoneAllowMETAREFRESH](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [RestrictedSitesZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [AllowSoftwareWhenSignatureIsInvalid](policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [CheckServerCertificateRevocation](policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [CheckSignaturesOnDownloadedPrograms](policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [DisableConfiguringHistory](policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [DoNotAllowActiveXControlsInProtectedMode](policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [RestrictedSitesZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [RestrictedSitesZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [RestrictedSitesZoneEnableMIMESniffing](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [ConsistentMimeHandlingInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [MimeSniffingSafetyFeatureInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [MKProtocolSecurityRestrictionInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [NotificationBarInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [ProtectionFromZoneElevationInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [RestrictActiveXInstallInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [RestrictFileDownloadInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [IntranetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [LocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [LockedDownInternetZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [LockedDownLocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [LockedDownRestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [LockedDownTrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [RestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [TrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [RestrictedSitesZoneLogonOptions](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [DisableDeletingUserVisitedWebsites](policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [DisableIgnoringCertificateErrors](policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [PreventPerUserInstallationOfActiveXControls](policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [RemoveRunThisTimeButtonForOutdatedActiveXControls](policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [RestrictedSitesZoneRunActiveXControlsAndPlugins](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [RestrictedSitesZoneScriptingOfJavaApplets](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [SecurityZonesUseOnlyMachineSettings](policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [SpecifyUseOfActiveXInstallerService](policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [DisableCrashDetection](policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [DisableInPrivateBrowsing](policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [DisableSecuritySettingsCheck](policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [DisableProcessesInEnhancedProtectedMode](policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [AllowCertificateAddressMismatchWarning](policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [RestrictedSitesZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetZoneEnableProtectedMode](policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [RestrictedSitesZoneTurnOnProtectedMode](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [RestrictedSitesZoneUsePopupBlocker](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [LockedDownIntranetJavaPermissions](policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [DisableHTMLApplication](policy-csp-internetexplorer.md#internetexplorer-disablehtmlapplication) +- [AddSearchProvider](policy-csp-internetexplorer.md) +- [DisableSecondaryHomePageChange](policy-csp-internetexplorer.md) +- [DisableProxyChange](policy-csp-internetexplorer.md) +- [DisableSearchProviderChange](policy-csp-internetexplorer.md) +- [DisableCustomerExperienceImprovementProgramParticipation](policy-csp-internetexplorer.md) +- [AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md) +- [AllowSuggestedSites](policy-csp-internetexplorer.md) +- [DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md) +- [DisableCompatView](policy-csp-internetexplorer.md) +- [DisableFeedsBackgroundSync](policy-csp-internetexplorer.md) +- [DisableFirstRunWizard](policy-csp-internetexplorer.md) +- [DisableFlipAheadFeature](policy-csp-internetexplorer.md) +- [DisableGeolocation](policy-csp-internetexplorer.md) +- [DisableHomePageChange](policy-csp-internetexplorer.md) +- [DisableWebAddressAutoComplete](policy-csp-internetexplorer.md) +- [NewTabDefaultPage](policy-csp-internetexplorer.md) +- [PreventManagingSmartScreenFilter](policy-csp-internetexplorer.md) +- [SearchProviderList](policy-csp-internetexplorer.md) +- [AllowActiveXFiltering](policy-csp-internetexplorer.md) +- [AllowEnterpriseModeSiteList](policy-csp-internetexplorer.md) +- [SendSitesNotInEnterpriseSiteListToEdge](policy-csp-internetexplorer.md) +- [ConfigureEdgeRedirectChannel](policy-csp-internetexplorer.md) +- [KeepIntranetSitesInInternetExplorer](policy-csp-internetexplorer.md) +- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md) +- [DisableInternetExplorerApp](policy-csp-internetexplorer.md) +- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md) +- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md) +- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md) +- [JScriptReplacement](policy-csp-internetexplorer.md) +- [AllowInternetExplorerStandardsMode](policy-csp-internetexplorer.md) +- [AllowInternetExplorer7PolicyList](policy-csp-internetexplorer.md) +- [DisableEncryptionSupport](policy-csp-internetexplorer.md) +- [AllowEnhancedProtectedMode](policy-csp-internetexplorer.md) +- [AllowInternetZoneTemplate](policy-csp-internetexplorer.md) +- [IncludeAllLocalSites](policy-csp-internetexplorer.md) +- [IncludeAllNetworkPaths](policy-csp-internetexplorer.md) +- [AllowIntranetZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLocalMachineZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownInternetZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownIntranetZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownLocalMachineZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [AllowsLockedDownTrustedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [AllowsRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [AllowSiteToZoneAssignmentList](policy-csp-internetexplorer.md) +- [AllowTrustedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [InternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [IntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [InternetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [IntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [InternetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [IntranetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [InternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [IntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [IntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [InternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [IntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [TrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [IntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [TrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [InternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [IntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [InternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [IntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [InternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [IntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [InternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [IntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [AllowAddOnList](policy-csp-internetexplorer.md) +- [DoNotBlockOutdatedActiveXControls](policy-csp-internetexplorer.md) +- [DoNotBlockOutdatedActiveXControlsOnSpecificDomains](policy-csp-internetexplorer.md) +- [DisableEnclosureDownloading](policy-csp-internetexplorer.md) +- [DisableBypassOfSmartScreenWarnings](policy-csp-internetexplorer.md) +- [DisableBypassOfSmartScreenWarningsAboutUncommonFiles](policy-csp-internetexplorer.md) +- [AllowOneWordEntry](policy-csp-internetexplorer.md) +- [AllowEnterpriseModeFromToolsMenu](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowActiveScripting](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowBinaryAndScriptBehaviors](policy-csp-internetexplorer.md) +- [InternetZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md) +- [AllowDeletingBrowsingHistoryOnExit](policy-csp-internetexplorer.md) +- [InternetZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowFileDownloads](policy-csp-internetexplorer.md) +- [InternetZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowMETAREFRESH](policy-csp-internetexplorer.md) +- [InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md) +- [InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md) +- [InternetZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md) +- [AllowSoftwareWhenSignatureIsInvalid](policy-csp-internetexplorer.md) +- [InternetZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md) +- [CheckServerCertificateRevocation](policy-csp-internetexplorer.md) +- [CheckSignaturesOnDownloadedPrograms](policy-csp-internetexplorer.md) +- [DisableConfiguringHistory](policy-csp-internetexplorer.md) +- [DoNotAllowActiveXControlsInProtectedMode](policy-csp-internetexplorer.md) +- [InternetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md) +- [InternetZoneEnableMIMESniffing](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableMIMESniffing](policy-csp-internetexplorer.md) +- [InternetZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md) +- [ConsistentMimeHandlingInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [MimeSniffingSafetyFeatureInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [MKProtocolSecurityRestrictionInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [NotificationBarInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [ProtectionFromZoneElevationInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [RestrictActiveXInstallInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [RestrictFileDownloadInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [InternetZoneJavaPermissions](policy-csp-internetexplorer.md) +- [IntranetZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [TrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [InternetZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md) +- [InternetZoneLogonOptions](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneLogonOptions](policy-csp-internetexplorer.md) +- [DisableDeletingUserVisitedWebsites](policy-csp-internetexplorer.md) +- [DisableIgnoringCertificateErrors](policy-csp-internetexplorer.md) +- [PreventPerUserInstallationOfActiveXControls](policy-csp-internetexplorer.md) +- [RemoveRunThisTimeButtonForOutdatedActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneRunActiveXControlsAndPlugins](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneScriptingOfJavaApplets](policy-csp-internetexplorer.md) +- [InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md) +- [SpecifyUseOfActiveXInstallerService](policy-csp-internetexplorer.md) +- [DisableCrashDetection](policy-csp-internetexplorer.md) +- [DisableInPrivateBrowsing](policy-csp-internetexplorer.md) +- [DisableSecuritySettingsCheck](policy-csp-internetexplorer.md) +- [DisableProcessesInEnhancedProtectedMode](policy-csp-internetexplorer.md) +- [AllowCertificateAddressMismatchWarning](policy-csp-internetexplorer.md) +- [InternetZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md) +- [InternetZoneEnableProtectedMode](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneTurnOnProtectedMode](policy-csp-internetexplorer.md) +- [AllowAutoComplete](policy-csp-internetexplorer.md) +- [InternetZoneUsePopupBlocker](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneUsePopupBlocker](policy-csp-internetexplorer.md) +- [InternetZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md) +- [LockedDownIntranetJavaPermissions](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md) +- [DisableHTMLApplication](policy-csp-internetexplorer.md) +- [AddSearchProvider](policy-csp-internetexplorer.md) +- [DisableSecondaryHomePageChange](policy-csp-internetexplorer.md) +- [DisableUpdateCheck](policy-csp-internetexplorer.md) +- [DisableProxyChange](policy-csp-internetexplorer.md) +- [DisableSearchProviderChange](policy-csp-internetexplorer.md) +- [DisableCustomerExperienceImprovementProgramParticipation](policy-csp-internetexplorer.md) +- [AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md) +- [AllowSuggestedSites](policy-csp-internetexplorer.md) +- [DisableCompatView](policy-csp-internetexplorer.md) +- [DisableFeedsBackgroundSync](policy-csp-internetexplorer.md) +- [DisableFirstRunWizard](policy-csp-internetexplorer.md) +- [DisableFlipAheadFeature](policy-csp-internetexplorer.md) +- [DisableGeolocation](policy-csp-internetexplorer.md) +- [DisableWebAddressAutoComplete](policy-csp-internetexplorer.md) +- [NewTabDefaultPage](policy-csp-internetexplorer.md) +- [PreventManagingSmartScreenFilter](policy-csp-internetexplorer.md) +- [SearchProviderList](policy-csp-internetexplorer.md) +- [DoNotAllowUsersToAddSites](policy-csp-internetexplorer.md) +- [DoNotAllowUsersToChangePolicies](policy-csp-internetexplorer.md) +- [AllowActiveXFiltering](policy-csp-internetexplorer.md) +- [AllowEnterpriseModeSiteList](policy-csp-internetexplorer.md) +- [SendSitesNotInEnterpriseSiteListToEdge](policy-csp-internetexplorer.md) +- [ConfigureEdgeRedirectChannel](policy-csp-internetexplorer.md) +- [KeepIntranetSitesInInternetExplorer](policy-csp-internetexplorer.md) +- [AllowSaveTargetAsInIEMode](policy-csp-internetexplorer.md) +- [DisableInternetExplorerApp](policy-csp-internetexplorer.md) +- [EnableExtendedIEModeHotkeys](policy-csp-internetexplorer.md) +- [ResetZoomForDialogInIEMode](policy-csp-internetexplorer.md) +- [EnableGlobalWindowListInIEMode](policy-csp-internetexplorer.md) +- [JScriptReplacement](policy-csp-internetexplorer.md) +- [AllowInternetExplorerStandardsMode](policy-csp-internetexplorer.md) +- [AllowInternetExplorer7PolicyList](policy-csp-internetexplorer.md) +- [DisableEncryptionSupport](policy-csp-internetexplorer.md) +- [AllowEnhancedProtectedMode](policy-csp-internetexplorer.md) +- [AllowInternetZoneTemplate](policy-csp-internetexplorer.md) +- [IncludeAllLocalSites](policy-csp-internetexplorer.md) +- [IncludeAllNetworkPaths](policy-csp-internetexplorer.md) +- [AllowIntranetZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLocalMachineZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownInternetZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownIntranetZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownLocalMachineZoneTemplate](policy-csp-internetexplorer.md) +- [AllowLockedDownRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [AllowsLockedDownTrustedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [AllowsRestrictedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [AllowSiteToZoneAssignmentList](policy-csp-internetexplorer.md) +- [AllowTrustedSitesZoneTemplate](policy-csp-internetexplorer.md) +- [InternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [IntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowAccessToDataSources](policy-csp-internetexplorer.md) +- [InternetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [IntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowFontDownloads](policy-csp-internetexplorer.md) +- [InternetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [IntranetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowScriptlets](policy-csp-internetexplorer.md) +- [InternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [IntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [IntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](policy-csp-internetexplorer.md) +- [InternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [IntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [TrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [IntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [TrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneNavigateWindowsAndFrames](policy-csp-internetexplorer.md) +- [InternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [IntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](policy-csp-internetexplorer.md) +- [InternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [IntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowSmartScreenIE](policy-csp-internetexplorer.md) +- [InternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [IntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowUserDataPersistence](policy-csp-internetexplorer.md) +- [InternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [IntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownIntranetZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [TrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneAllowLessPrivilegedSites](policy-csp-internetexplorer.md) +- [AllowAddOnList](policy-csp-internetexplorer.md) +- [DoNotBlockOutdatedActiveXControls](policy-csp-internetexplorer.md) +- [DoNotBlockOutdatedActiveXControlsOnSpecificDomains](policy-csp-internetexplorer.md) +- [DisableEnclosureDownloading](policy-csp-internetexplorer.md) +- [DisableBypassOfSmartScreenWarnings](policy-csp-internetexplorer.md) +- [DisableBypassOfSmartScreenWarningsAboutUncommonFiles](policy-csp-internetexplorer.md) +- [AllowOneWordEntry](policy-csp-internetexplorer.md) +- [AllowEnterpriseModeFromToolsMenu](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowActiveScripting](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowBinaryAndScriptBehaviors](policy-csp-internetexplorer.md) +- [InternetZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowCopyPasteViaScript](policy-csp-internetexplorer.md) +- [AllowDeletingBrowsingHistoryOnExit](policy-csp-internetexplorer.md) +- [InternetZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](policy-csp-internetexplorer.md) +- [AllowFallbackToSSL3](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowFileDownloads](policy-csp-internetexplorer.md) +- [InternetZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowLoadingOfXAMLFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowMETAREFRESH](policy-csp-internetexplorer.md) +- [InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](policy-csp-internetexplorer.md) +- [InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](policy-csp-internetexplorer.md) +- [InternetZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowScriptInitiatedWindows](policy-csp-internetexplorer.md) +- [AllowSoftwareWhenSignatureIsInvalid](policy-csp-internetexplorer.md) +- [InternetZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](policy-csp-internetexplorer.md) +- [CheckServerCertificateRevocation](policy-csp-internetexplorer.md) +- [CheckSignaturesOnDownloadedPrograms](policy-csp-internetexplorer.md) +- [DisableConfiguringHistory](policy-csp-internetexplorer.md) +- [DoNotAllowActiveXControlsInProtectedMode](policy-csp-internetexplorer.md) +- [InternetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneDownloadSignedActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneDownloadUnsignedActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](policy-csp-internetexplorer.md) +- [InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](policy-csp-internetexplorer.md) +- [InternetZoneEnableMIMESniffing](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableMIMESniffing](policy-csp-internetexplorer.md) +- [InternetZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](policy-csp-internetexplorer.md) +- [ConsistentMimeHandlingInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [MimeSniffingSafetyFeatureInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [MKProtocolSecurityRestrictionInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [NotificationBarInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [ProtectionFromZoneElevationInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [RestrictActiveXInstallInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [RestrictFileDownloadInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](policy-csp-internetexplorer.md) +- [InternetZoneJavaPermissions](policy-csp-internetexplorer.md) +- [IntranetZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownInternetZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownLocalMachineZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownRestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [LockedDownTrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [TrustedSitesZoneJavaPermissions](policy-csp-internetexplorer.md) +- [InternetZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](policy-csp-internetexplorer.md) +- [InternetZoneLogonOptions](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneLogonOptions](policy-csp-internetexplorer.md) +- [DisableDeletingUserVisitedWebsites](policy-csp-internetexplorer.md) +- [DisableIgnoringCertificateErrors](policy-csp-internetexplorer.md) +- [PreventPerUserInstallationOfActiveXControls](policy-csp-internetexplorer.md) +- [RemoveRunThisTimeButtonForOutdatedActiveXControls](policy-csp-internetexplorer.md) +- [InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneRunActiveXControlsAndPlugins](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneScriptingOfJavaApplets](policy-csp-internetexplorer.md) +- [SecurityZonesUseOnlyMachineSettings](policy-csp-internetexplorer.md) +- [InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](policy-csp-internetexplorer.md) +- [SpecifyUseOfActiveXInstallerService](policy-csp-internetexplorer.md) +- [DisableCrashDetection](policy-csp-internetexplorer.md) +- [DisableInPrivateBrowsing](policy-csp-internetexplorer.md) +- [DisableSecuritySettingsCheck](policy-csp-internetexplorer.md) +- [DisableProcessesInEnhancedProtectedMode](policy-csp-internetexplorer.md) +- [AllowCertificateAddressMismatchWarning](policy-csp-internetexplorer.md) +- [InternetZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneEnableCrossSiteScriptingFilter](policy-csp-internetexplorer.md) +- [InternetZoneEnableProtectedMode](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneTurnOnProtectedMode](policy-csp-internetexplorer.md) +- [InternetZoneUsePopupBlocker](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneUsePopupBlocker](policy-csp-internetexplorer.md) +- [InternetZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md) +- [LockedDownIntranetJavaPermissions](policy-csp-internetexplorer.md) +- [RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](policy-csp-internetexplorer.md) +- [DisableHTMLApplication](policy-csp-internetexplorer.md) ## Kerberos -- [RequireKerberosArmoring](policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [KerberosClientSupportsClaimsCompoundArmor](policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [RequireStrictKDCValidation](policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [SetMaximumContextTokenSize](policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [AllowForestSearchOrder](policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [RequireKerberosArmoring](policy-csp-kerberos.md) +- [KerberosClientSupportsClaimsCompoundArmor](policy-csp-kerberos.md) +- [RequireStrictKDCValidation](policy-csp-kerberos.md) +- [SetMaximumContextTokenSize](policy-csp-kerberos.md) +- [AllowForestSearchOrder](policy-csp-kerberos.md) ## LocalSecurityAuthority -- [AllowCustomSSPsAPs](policy-csp-lsa.md#localsecurityauthority-allowcustomsspsaps) +- [AllowCustomSSPsAPs](policy-csp-lsa.md) ## MixedReality -- [ConfigureNtpClient](policy-csp-mixedreality.md#mixedreality-configurentpclient) -- [NtpClientEnabled](policy-csp-mixedreality.md#mixedreality-ntpclientenabled) +- [ConfigureNtpClient](policy-csp-mixedreality.md) +- [NtpClientEnabled](policy-csp-mixedreality.md) ## MSSecurityGuide -- [ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [ConfigureSMBV1Server](policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [ConfigureSMBV1ClientDriver](policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [EnableStructuredExceptionHandlingOverwriteProtection](policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [WDigestAuthentication](policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](policy-csp-mssecurityguide.md) +- [ConfigureSMBV1Server](policy-csp-mssecurityguide.md) +- [ConfigureSMBV1ClientDriver](policy-csp-mssecurityguide.md) +- [EnableStructuredExceptionHandlingOverwriteProtection](policy-csp-mssecurityguide.md) +- [WDigestAuthentication](policy-csp-mssecurityguide.md) +- [TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](policy-csp-mssecurityguide.md) ## MSSLegacy -- [IPv6SourceRoutingProtectionLevel](policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [IPSourceRoutingProtectionLevel](policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [IPv6SourceRoutingProtectionLevel](policy-csp-msslegacy.md) +- [IPSourceRoutingProtectionLevel](policy-csp-msslegacy.md) +- [AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](policy-csp-msslegacy.md) +- [AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](policy-csp-msslegacy.md) ## Power -- [AllowStandbyWhenSleepingPluggedIn](policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [RequirePasswordWhenComputerWakesOnBattery](policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [RequirePasswordWhenComputerWakesPluggedIn](policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [StandbyTimeoutPluggedIn](policy-csp-power.md#power-standbytimeoutpluggedin) -- [StandbyTimeoutOnBattery](policy-csp-power.md#power-standbytimeoutonbattery) -- [HibernateTimeoutPluggedIn](policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [HibernateTimeoutOnBattery](policy-csp-power.md#power-hibernatetimeoutonbattery) -- [DisplayOffTimeoutPluggedIn](policy-csp-power.md#power-displayofftimeoutpluggedin) -- [DisplayOffTimeoutOnBattery](policy-csp-power.md#power-displayofftimeoutonbattery) -- [AllowStandbyStatesWhenSleepingOnBattery](policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [AllowStandbyWhenSleepingPluggedIn](policy-csp-power.md) +- [RequirePasswordWhenComputerWakesOnBattery](policy-csp-power.md) +- [RequirePasswordWhenComputerWakesPluggedIn](policy-csp-power.md) +- [StandbyTimeoutPluggedIn](policy-csp-power.md) +- [StandbyTimeoutOnBattery](policy-csp-power.md) +- [HibernateTimeoutPluggedIn](policy-csp-power.md) +- [HibernateTimeoutOnBattery](policy-csp-power.md) +- [DisplayOffTimeoutPluggedIn](policy-csp-power.md) +- [DisplayOffTimeoutOnBattery](policy-csp-power.md) +- [AllowStandbyStatesWhenSleepingOnBattery](policy-csp-power.md) ## Printers -- [PointAndPrintRestrictions_User](policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [EnableDeviceControlUser](policy-csp-printers.md#printers-enabledevicecontroluser) -- [ApprovedUsbPrintDevicesUser](policy-csp-printers.md#printers-approvedusbprintdevicesuser) -- [PointAndPrintRestrictions](policy-csp-printers.md#printers-pointandprintrestrictions) -- [PublishPrinters](policy-csp-printers.md#printers-publishprinters) -- [EnableDeviceControl](policy-csp-printers.md#printers-enabledevicecontrol) -- [ApprovedUsbPrintDevices](policy-csp-printers.md#printers-approvedusbprintdevices) -- [RestrictDriverInstallationToAdministrators](policy-csp-printers.md#printers-restrictdriverinstallationtoadministrators) -- [ConfigureCopyFilesPolicy](policy-csp-printers.md#printers-configurecopyfilespolicy) -- [ConfigureDriverValidationLevel](policy-csp-printers.md#printers-configuredrivervalidationlevel) -- [ManageDriverExclusionList](policy-csp-printers.md#printers-managedriverexclusionlist) -- [ConfigureRpcListenerPolicy](policy-csp-printers.md#printers-configurerpclistenerpolicy) -- [ConfigureRpcConnectionPolicy](policy-csp-printers.md#printers-configurerpcconnectionpolicy) -- [ConfigureRpcTcpPort](policy-csp-printers.md#printers-configurerpctcpport) -- [ConfigureIppPageCountsPolicy](policy-csp-printers.md#printers-configureipppagecountspolicy) -- [ConfigureRedirectionGuardPolicy](policy-csp-printers.md#printers-configureredirectionguardpolicy) +- [PointAndPrintRestrictions_User](policy-csp-printers.md) +- [EnableDeviceControlUser](policy-csp-printers.md) +- [ApprovedUsbPrintDevicesUser](policy-csp-printers.md) +- [PointAndPrintRestrictions](policy-csp-printers.md) +- [PublishPrinters](policy-csp-printers.md) +- [EnableDeviceControl](policy-csp-printers.md) +- [ApprovedUsbPrintDevices](policy-csp-printers.md) +- [RestrictDriverInstallationToAdministrators](policy-csp-printers.md) +- [ConfigureCopyFilesPolicy](policy-csp-printers.md) +- [ConfigureDriverValidationLevel](policy-csp-printers.md) +- [ManageDriverExclusionList](policy-csp-printers.md) +- [ConfigureRpcListenerPolicy](policy-csp-printers.md) +- [ConfigureRpcConnectionPolicy](policy-csp-printers.md) +- [ConfigureRpcTcpPort](policy-csp-printers.md) +- [ConfigureIppPageCountsPolicy](policy-csp-printers.md) +- [ConfigureRedirectionGuardPolicy](policy-csp-printers.md) ## RemoteAssistance -- [UnsolicitedRemoteAssistance](policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [SolicitedRemoteAssistance](policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [CustomizeWarningMessages](policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [SessionLogging](policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [UnsolicitedRemoteAssistance](policy-csp-remoteassistance.md) +- [SolicitedRemoteAssistance](policy-csp-remoteassistance.md) +- [CustomizeWarningMessages](policy-csp-remoteassistance.md) +- [SessionLogging](policy-csp-remoteassistance.md) ## RemoteDesktopServices -- [DoNotAllowPasswordSaving](policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [AllowUsersToConnectRemotely](policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [DoNotAllowDriveRedirection](policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [PromptForPasswordUponConnection](policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RequireSecureRPCCommunication](policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [ClientConnectionEncryptionLevel](policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [DoNotAllowWebAuthnRedirection](policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowwebauthnredirection) +- [DoNotAllowPasswordSaving](policy-csp-remotedesktopservices.md) +- [AllowUsersToConnectRemotely](policy-csp-remotedesktopservices.md) +- [DoNotAllowDriveRedirection](policy-csp-remotedesktopservices.md) +- [PromptForPasswordUponConnection](policy-csp-remotedesktopservices.md) +- [RequireSecureRPCCommunication](policy-csp-remotedesktopservices.md) +- [ClientConnectionEncryptionLevel](policy-csp-remotedesktopservices.md) +- [DoNotAllowWebAuthnRedirection](policy-csp-remotedesktopservices.md) ## RemoteManagement -- [AllowBasicAuthentication_Client](policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [AllowBasicAuthentication_Service](policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [AllowUnencryptedTraffic_Client](policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [AllowUnencryptedTraffic_Service](policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [DisallowDigestAuthentication](policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [DisallowStoringOfRunAsCredentials](policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [AllowCredSSPAuthenticationClient](policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [AllowCredSSPAuthenticationService](policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [DisallowNegotiateAuthenticationClient](policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [DisallowNegotiateAuthenticationService](policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [TrustedHosts](policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [AllowRemoteServerManagement](policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [SpecifyChannelBindingTokenHardeningLevel](policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [TurnOnCompatibilityHTTPListener](policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [TurnOnCompatibilityHTTPSListener](policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [AllowBasicAuthentication_Client](policy-csp-remotemanagement.md) +- [AllowBasicAuthentication_Service](policy-csp-remotemanagement.md) +- [AllowUnencryptedTraffic_Client](policy-csp-remotemanagement.md) +- [AllowUnencryptedTraffic_Service](policy-csp-remotemanagement.md) +- [DisallowDigestAuthentication](policy-csp-remotemanagement.md) +- [DisallowStoringOfRunAsCredentials](policy-csp-remotemanagement.md) +- [AllowCredSSPAuthenticationClient](policy-csp-remotemanagement.md) +- [AllowCredSSPAuthenticationService](policy-csp-remotemanagement.md) +- [DisallowNegotiateAuthenticationClient](policy-csp-remotemanagement.md) +- [DisallowNegotiateAuthenticationService](policy-csp-remotemanagement.md) +- [TrustedHosts](policy-csp-remotemanagement.md) +- [AllowRemoteServerManagement](policy-csp-remotemanagement.md) +- [SpecifyChannelBindingTokenHardeningLevel](policy-csp-remotemanagement.md) +- [TurnOnCompatibilityHTTPListener](policy-csp-remotemanagement.md) +- [TurnOnCompatibilityHTTPSListener](policy-csp-remotemanagement.md) ## RemoteProcedureCall -- [RPCEndpointMapperClientAuthentication](policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RestrictUnauthenticatedRPCClients](policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RPCEndpointMapperClientAuthentication](policy-csp-remoteprocedurecall.md) +- [RestrictUnauthenticatedRPCClients](policy-csp-remoteprocedurecall.md) ## RemoteShell -- [AllowRemoteShellAccess](policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [SpecifyIdleTimeout](policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [MaxConcurrentUsers](policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [SpecifyMaxMemory](policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [SpecifyMaxProcesses](policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [SpecifyMaxRemoteShells](policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [SpecifyShellTimeout](policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [AllowRemoteShellAccess](policy-csp-remoteshell.md) +- [SpecifyIdleTimeout](policy-csp-remoteshell.md) +- [MaxConcurrentUsers](policy-csp-remoteshell.md) +- [SpecifyMaxMemory](policy-csp-remoteshell.md) +- [SpecifyMaxProcesses](policy-csp-remoteshell.md) +- [SpecifyMaxRemoteShells](policy-csp-remoteshell.md) +- [SpecifyShellTimeout](policy-csp-remoteshell.md) ## ServiceControlManager -- [SvchostProcessMitigation](policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [SvchostProcessMitigation](policy-csp-servicecontrolmanager.md) ## SettingsSync -- [DisableAccessibilitySettingSync](policy-csp-settingssync.md#settingssync-disableaccessibilitysettingsync) +- [DisableAccessibilitySettingSync](policy-csp-settingssync.md) ## Storage -- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md#storage-wpddevicesdenyreadaccessperuser) -- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md#storage-wpddevicesdenywriteaccessperuser) -- [EnhancedStorageDevices](policy-csp-storage.md#storage-enhancedstoragedevices) -- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md#storage-wpddevicesdenyreadaccessperdevice) -- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md#storage-wpddevicesdenywriteaccessperdevice) +- [WPDDevicesDenyReadAccessPerUser](policy-csp-storage.md) +- [WPDDevicesDenyWriteAccessPerUser](policy-csp-storage.md) +- [EnhancedStorageDevices](policy-csp-storage.md) +- [WPDDevicesDenyReadAccessPerDevice](policy-csp-storage.md) +- [WPDDevicesDenyWriteAccessPerDevice](policy-csp-storage.md) ## System -- [BootStartDriverInitialization](policy-csp-system.md#system-bootstartdriverinitialization) -- [DisableSystemRestore](policy-csp-system.md#system-disablesystemrestore) +- [BootStartDriverInitialization](policy-csp-system.md) +- [DisableSystemRestore](policy-csp-system.md) ## TenantRestrictions -- [ConfigureTenantRestrictions](policy-csp-tenantrestrictions.md#tenantrestrictions-configuretenantrestrictions) +- [ConfigureTenantRestrictions](policy-csp-tenantrestrictions.md) ## WindowsConnectionManager -- [ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](policy-csp-windowsconnectionmanager.md) ## WindowsLogon -- [DontDisplayNetworkSelectionUI](policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [DisableLockScreenAppNotifications](policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [EnumerateLocalUsersOnDomainJoinedComputers](policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [AllowAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) -- [ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) -- [EnableMPRNotifications](policy-csp-windowslogon.md#windowslogon-enablemprnotifications) +- [DontDisplayNetworkSelectionUI](policy-csp-windowslogon.md) +- [DisableLockScreenAppNotifications](policy-csp-windowslogon.md) +- [EnumerateLocalUsersOnDomainJoinedComputers](policy-csp-windowslogon.md) +- [AllowAutomaticRestartSignOn](policy-csp-windowslogon.md) +- [ConfigAutomaticRestartSignOn](policy-csp-windowslogon.md) +- [EnableMPRNotifications](policy-csp-windowslogon.md) ## WindowsPowerShell -- [TurnOnPowerShellScriptBlockLogging](policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) -- [TurnOnPowerShellScriptBlockLogging](policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +- [TurnOnPowerShellScriptBlockLogging](policy-csp-windowspowershell.md) +- [TurnOnPowerShellScriptBlockLogging](policy-csp-windowspowershell.md) ## Related articles diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md index 94bb7192fa..bcc22cc6cb 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-surface-hub.md @@ -1,7 +1,7 @@ --- title: Policies in Policy CSP supported by Microsoft Surface Hub description: Learn about the policies in Policy CSP supported by Microsoft Surface Hub. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.topic: article @@ -21,32 +21,32 @@ ms.date: 07/22/2020 - [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) - [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) - [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#cryptography-tlsciphersuites) -- [Defender/AllowArchiveScanning](policy-csp-defender.md#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](policy-csp-defender.md#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](policy-csp-defender.md#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](policy-csp-defender.md#defender-allowioavprotection) -- [Defender/AllowOnAccessProtection](policy-csp-defender.md#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](policy-csp-defender.md#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](policy-csp-defender.md#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](policy-csp-defender.md#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](policy-csp-defender.md#defender-excludedextensions) -- [Defender/ExcludedPaths](policy-csp-defender.md#defender-excludedpaths) -- [Defender/ExcludedProcesses](policy-csp-defender.md#defender-excludedprocesses) -- [Defender/PUAProtection](policy-csp-defender.md#defender-puaprotection) -- [Defender/RealTimeScanDirection](policy-csp-defender.md#defender-realtimescandirection) -- [Defender/ScanParameter](policy-csp-defender.md#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](policy-csp-defender.md#defender-schedulescanday) -- [Defender/ScheduleScanTime](policy-csp-defender.md#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](policy-csp-defender.md#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](policy-csp-defender.md#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#defender-threatseveritydefaultaction) +- [Defender/AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) +- [Defender/AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) +- [Defender/AllowEmailScanning](policy-csp-defender.md#allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) +- [Defender/AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) +- [Defender/AllowScriptScanning](policy-csp-defender.md#allowscriptscanning) +- [Defender/AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) +- [Defender/AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) +- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) +- [Defender/ExcludedExtensions](policy-csp-defender.md#excludedextensions) +- [Defender/ExcludedPaths](policy-csp-defender.md#excludedpaths) +- [Defender/ExcludedProcesses](policy-csp-defender.md#excludedprocesses) +- [Defender/PUAProtection](policy-csp-defender.md#puaprotection) +- [Defender/RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) +- [Defender/ScanParameter](policy-csp-defender.md#scanparameter) +- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) +- [Defender/ScheduleScanDay](policy-csp-defender.md#schedulescanday) +- [Defender/ScheduleScanTime](policy-csp-defender.md#schedulescantime) +- [Defender/SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) +- [Defender/SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) - [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) - [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) - [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index e771422d71..ca3b912970 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,9532 +1,1130 @@ --- title: Policy CSP -description: Learn how the Policy configuration service provider (CSP) enables the enterprise to configure policies on Windows 10 and Windows 11. -ms.reviewer: +description: Learn more about the Policy CSP Policy +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage -author: vinaypamnani-msft +ms.date: 11/01/2022 ms.localizationpriority: medium -ms.date: 07/18/2019 -ms.collection: highpri +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article --- + + + # Policy CSP -The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 11. Use this configuration service provider to configure any company policies. + + + -The Policy configuration service provider has the following sub-categories: + +The following example shows the Policy configuration service provider in tree format. -- Policy/Config/*AreaName* – Handles the policy configuration request from the server. -- Policy/Result/*AreaName* – Provides a read-only path to policies enforced on the device. - - - -> [!Important] -> Policy scope is the level at which a policy can be configured. Some policies can only be configured at the device level, meaning the policy will take effect independent of who is logged into the device. Other policies can be configured at the user level, meaning the policy will only take effect for that user. -> -> The allowed scope of a specific policy is represented below its table of supported Windows editions. To configure a policy under a specific scope (user vs. device), please use the following paths: -> -> User scope: -> -> - **./User/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. -> - **./User/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. -> -> Device scope: -> -> - **./Device/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. -> - **./Device/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. -> -> For device wide configuration the **_Device/_** portion may be omitted from the path, deeming the following paths respectively equivalent to the paths provided above: -> -> - **./Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. -> - **./Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. - -The following shows the Policy configuration service provider in tree format as used by both Open Mobile Alliance Device Management (OMA DM) and OMA Client Provisioning. - -```console -./Vendor/MSFT -Policy --------Config -----------AreaName --------------PolicyName --------Result -----------AreaName --------------PolicyName --------ConfigOperations -----------ADMXInstall --------------AppName -----------------Policy -------------------UniqueID -----------------Preference -------------------UniqueID +```text +./Device/Vendor/MSFT/Policy +--- Config +------ {AreaName} +--------- {PolicyName} +--- ConfigOperations +------ ADMXInstall +--------- {AppName} +------------ {SettingsType} +--------------- {AdmxFileId} +------------ Properties +--------------- {SettingsType} +------------------ {AdmxFileId} +--------------------- Version +--- Result +------ {AreaName} +--------- {PolicyName} +./User/Vendor/MSFT/Policy +--- Config +------ {AreaName} +--------- {PolicyName} +--- Result +------ {AreaName} +--------- {PolicyName} ``` + + +## Device/Config -**./Vendor/MSFT/Policy** -The root node for the Policy configuration service provider. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + -Supported operation is Get. + +```Device +./Device/Vendor/MSFT/Policy/Config +``` + -**Policy/Config** -Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value) the configuration source can use the Policy/Result path to retrieve the resulting value. + +Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value,) the configuration source can use the Policy/Result path to retrieve the resulting value. + -Supported operation is Get. + + + -**Policy/Config/_AreaName_** -The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value. + +**Description framework properties**: -Supported operations are Add, Get, and Delete. +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | + -**Policy/Config/_AreaName/PolicyName_** -Specifies the name/value pair used in the policy. + + + -The following list shows some tips to help you when configuring policies: + -- Separate substring values by the Unicode &\#xF000; in the XML file. + +### Device/Config/{AreaName} - > [!NOTE] - > A query from a different caller could provide a different value as each caller could have different values for a named policy. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + -- In SyncML, wrap this policy with the Atomic command so that the policy settings are treated as a single transaction. -- Supported operations are Add, Get, Delete, and Replace. -- Value type is string. + +```Device +./Device/Vendor/MSFT/Policy/Config/{AreaName} +``` + -**Policy/Result** + +The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value. See the individual Area DDFs for Policy CSP for a list of Areas that can be configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +#### Device/Config/{AreaName}/{PolicyName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/{AreaName}/{PolicyName} +``` + + + +Specifies the name/value pair used in the policy. See the individual Area DDFs for more information about the policies available to configure. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | null | +| Access Type | Add, Delete, Get, Replace | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +## Device/ConfigOperations + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations +``` + + + +The root node for grouping different configuration operations. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | + + + + + + + + + +### Device/ConfigOperations/ADMXInstall + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall +``` + + + +Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall. Each ADMX-backed policy or preference that is added is assigned a unique ID. ADMX files that have been installed by using ConfigOperations/ADMXInstall can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | + + + + + + + + + +#### Device/ConfigOperations/ADMXInstall/{AppName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName} +``` + + + +Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | UniqueName: Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file. | + + + + + + + + + +##### Device/ConfigOperations/ADMXInstall/{AppName}/{SettingsType} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/{SettingsType} +``` + + + +Setting Type of Win32 App. Policy Or Preference + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | UniqueName: Setting Type of Win32 App. Policy Or Preference | + + + + + + + + + +###### Device/ConfigOperations/ADMXInstall/{AppName}/{SettingsType}/{AdmxFileId} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/{SettingsType}/{AdmxFileId} +``` + + + +Unique ID of ADMX file + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Dynamic Node Naming | ServerGeneratedUniqueIdentifier | + + + + + + + + + +##### Device/ConfigOperations/ADMXInstall/{AppName}/Properties + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299.1481] and later
:heavy_check_mark: Windows 10, version 1803 [10.0.17134.1099] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.832] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.387] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/Properties +``` + + + +Properties of Win32 App ADMX Ingestion + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | + + + + + + + + + +###### Device/ConfigOperations/ADMXInstall/{AppName}/Properties/{SettingsType} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299.1481] and later
:heavy_check_mark: Windows 10, version 1803 [10.0.17134.1099] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.832] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.387] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/Properties/{SettingsType} +``` + + + +Setting Type of Win32 App. Policy Or Preference + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | UniqueName: Setting Type of Win32 App. Policy Or Preference | + + + + + + + + + +###### Device/ConfigOperations/ADMXInstall/{AppName}/Properties/{SettingsType}/{AdmxFileId} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299.1481] and later
:heavy_check_mark: Windows 10, version 1803 [10.0.17134.1099] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.832] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.387] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/Properties/{SettingsType}/{AdmxFileId} +``` + + + +Unique ID of ADMX file + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | ServerGeneratedUniqueIdentifier | + + + + + + + + + +###### Device/ConfigOperations/ADMXInstall/{AppName}/Properties/{SettingsType}/{AdmxFileId}/Version + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299.1481] and later
:heavy_check_mark: Windows 10, version 1803 [10.0.17134.1099] and later
:heavy_check_mark: Windows 10, version 1809 [10.0.17763.832] and later
:heavy_check_mark: Windows 10, version 1903 [10.0.18362.387] and later
:heavy_check_mark: Windows 10, version 1909 [10.0.18363] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}/Properties/{SettingsType}/{AdmxFileId}/Version +``` + + + +Version of ADMX file. This can be set by the server to keep a record of the versioning of the ADMX file ingested by the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +## Device/Result + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Result +``` + + + Groups the evaluated policies from all providers that can be configured. + -Supported operation is Get. - -**Policy/Result/_AreaName_** -The area group that can be configured by a single technology independent of the providers. - -Supported operation is Get. - -**Policy/Result/_AreaName/PolicyName_** -Specifies the name/value pair used in the policy. - -Supported operation is Get. - -**Policy/ConfigOperations** -Added in Windows 10, version 1703. The root node for grouping different configuration operations. - -Supported operations are Add, Get, and Delete. - -**Policy/ConfigOperations/ADMXInstall** -Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](../win32-and-centennial-app-policy-configuration.md). - -> [!NOTE] -> The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](/previous-versions/office/office-2013-resource-kit/cc179097(v=office.15)). - -ADMX files that have been installed by using **ConfigOperations/ADMXInstall** can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}. - -Supported operations are Add, Get, and Delete. - -**Policy/ConfigOperations/ADMXInstall/_AppName_** -Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file. - -Supported operations are Add, Get, and Delete. - -**Policy/ConfigOperations/ADMXInstall/_AppName_/Policy** -Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported. - -Supported operations are Add, Get, and Delete. - -**Policy/ConfigOperations/ADMXInstall/_AppName_/Policy/_UniqueID_** -Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the policy to import. - -Supported operations are Add and Get. Does not support Delete. - -**Policy/ConfigOperations/ADMXInstall/_AppName_/Preference** -Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported. - -Supported operations are Add, Get, and Delete. - -**Policy/ConfigOperations/ADMXInstall/_AppName_/Preference/_UniqueID_** -Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the preference to import. - -Supported operations are Add and Get. Does not support Delete. - -## Policies - -### AboveLock policies - -
-
- AboveLock/AllowCortanaAboveLock -
-
- AboveLock/AllowToasts -
-
- -### Accounts policies - -
-
- Accounts/AllowAddingNonMicrosoftAccountsManually -
-
- Accounts/AllowMicrosoftAccountConnection -
-
- Accounts/AllowMicrosoftAccountSignInAssistant -
- -
- -### ActiveXControls policies - -
-
- ActiveXControls/ApprovedInstallationSites -
-
- -### ADMX_ActiveXInstallService policies - -
-
- ADMX_ActiveXInstallService/AxISURLZonePolicies -
-
- -### ADMX_AddRemovePrograms policies -
-
- ADMX_AddRemovePrograms/DefaultCategory -
-
- ADMX_AddRemovePrograms/NoAddFromCDorFloppy -
-
- ADMX_AddRemovePrograms/NoAddFromInternet -
-
- ADMX_AddRemovePrograms/NoAddFromNetwork -
-
- ADMX_AddRemovePrograms/NoAddPage -
-
- ADMX_AddRemovePrograms/NoAddRemovePrograms -
-
- ADMX_AddRemovePrograms/NoChooseProgramsPage -
-
- ADMX_AddRemovePrograms/NoRemovePage -
-
- ADMX_AddRemovePrograms/NoServices -
-
- ADMX_AddRemovePrograms/NoSupportInfo -
-
- ADMX_AddRemovePrograms/NoWindowsSetupPage -
-
- -### ADMX_AdmPwd policies - -
-
- ADMX_AdmPwd/POL_AdmPwd_DontAllowPwdExpirationBehindPolicy -
-
- ADMX_AdmPwd/POL_AdmPwd_Enabled -
-
- ADMX_AdmPwd/POL_AdmPwd_AdminName -
-
- ADMX_AdmPwd/POL_AdmPwd -
-
- -### ADMX_AppCompat policies - -
-
- ADMX_AppCompat/AppCompatPrevent16BitMach -
-
- ADMX_AppCompat/AppCompatRemoveProgramCompatPropPage -
-
- ADMX_AppCompat/AppCompatTurnOffApplicationImpactTelemetry -
-
- ADMX_AppCompat/AppCompatTurnOffSwitchBack -
-
- ADMX_AppCompat/AppCompatTurnOffEngine -
-
- ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_1 -
-
- ADMX_AppCompat/AppCompatTurnOffProgramCompatibilityAssistant_2 -
-
- ADMX_AppCompat/AppCompatTurnOffUserActionRecord -
-
- ADMX_AppCompat/AppCompatTurnOffProgramInventory -
-
- -### ADMX_AppxPackageManager policies - -
-
- ADMX_AppxPackageManager/AllowDeploymentInSpecialProfiles -
-
- -### ADMX_AppXRuntime policies - -
-
- ADMX_AppXRuntime/AppxRuntimeApplicationContentUriRules -
-
- ADMX_AppXRuntime/AppxRuntimeBlockFileElevation -
-
- ADMX_AppXRuntime/AppxRuntimeBlockHostedAppAccessWinRT -
-
- ADMX_AppXRuntime/AppxRuntimeBlockProtocolElevation -
-
- -### ADMX_AttachmentManager policies - -
-
- ADMX_AttachmentManager/AM_EstimateFileHandlerRisk -
-
- ADMX_AttachmentManager/AM_SetFileRiskLevel -
-
- ADMX_AttachmentManager/AM_SetHighRiskInclusion -
-
- ADMX_AttachmentManager/AM_SetLowRiskInclusion -
-
- ADMX_AttachmentManager/AM_SetModRiskInclusion -
-
- -### ADMX_AuditSettings policies - -
-
- ADMX_AuditSettings/IncludeCmdLine -
-
- - -### ADMX_Bits policies - -
-
- ADMX_Bits/BITS_DisableBranchCache -
-
- ADMX_Bits/BITS_DisablePeercachingClient -
-
- ADMX_Bits/BITS_DisablePeercachingServer -
-
- ADMX_Bits/BITS_EnablePeercaching -
-
- ADMX_Bits/BITS_MaxBandwidthServedForPeers -
-
- ADMX_Bits/BITS_MaxBandwidthV2_Maintenance -
-
- ADMX_Bits/BITS_MaxBandwidthV2_Work -
-
- ADMX_Bits/BITS_MaxCacheSize -
-
- ADMX_Bits/BITS_MaxContentAge -
-
- ADMX_Bits/BITS_MaxDownloadTime -
-
- ADMX_Bits/BITS_MaxFilesPerJob -
-
- ADMX_Bits/BITS_MaxJobsPerMachine -
-
- ADMX_Bits/BITS_MaxJobsPerUser -
-
- ADMX_Bits/BITS_MaxRangesPerFile -
-
- -### ADMX_CipherSuiteOrder policies - -
-
- ADMX_CipherSuiteOrder/SSLCipherSuiteOrder -
-
- ADMX_CipherSuiteOrder/SSLCurveOrder -
-
- -### ADMX_COM policies - -
-
- ADMX_COM/AppMgmt_COM_SearchForCLSID_1 -
-
- ADMX_COM/AppMgmt_COM_SearchForCLSID_2 -
-
- -### ADMX_ControlPanel policies - -
-
- ADMX_ControlPanel/DisallowCpls -
-
- ADMX_ControlPanel/ForceClassicControlPanel -
-
- ADMX_ControlPanel/NoControlPanel -
-
- ADMX_ControlPanel/RestrictCpls -
-
- -### ADMX_ControlPanelDisplay policies - -
-
- ADMX_ControlPanelDisplay/CPL_Display_Disable -
-
- ADMX_ControlPanelDisplay/CPL_Display_HideSettings -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_DisableColorSchemeChoice -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_DisableThemeChange -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_DisableVisualStyle -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_EnableScreenSaver -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_ForceDefaultLockScreen -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_LockFontSize -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingLockScreen -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoChangingStartMenuBackground -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoColorAppearanceUI -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopBackgroundUI -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoDesktopIconsUI -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoLockScreen -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoMousePointersUI -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoScreenSaverUI -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_NoSoundSchemeUI -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_PersonalColors -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverIsSecure -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_ScreenSaverTimeOut -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_SetScreenSaver -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_SetTheme -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_SetVisualStyle -
-
- ADMX_ControlPanelDisplay/CPL_Personalization_StartBackground -
-
- -### ADMX_Cpls policies - -
-
- ADMX_CtrlAltDel/DisableChangePassword -
-
- ADMX_CtrlAltDel/DisableLockComputer -
-
- ADMX_CtrlAltDel/DisableTaskMgr -
-
- ADMX_CtrlAltDel/NoLogoff -
-
- -### ADMX_CredentialProviders policies - -
-
- ADMX_CredentialProviders/AllowDomainDelayLock -
-
- ADMX_CredentialProviders/DefaultCredentialProvider -
-
- ADMX_CredentialProviders/ExcludedCredentialProviders -
-
- -### ADMX_CredSsp policies - -
-
- ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly -
-
- ADMX_CredSsp/AllowDefaultCredentials -
-
- ADMX_CredSsp/AllowEncryptionOracle -
-
- ADMX_CredSsp/AllowFreshCredentials -
-
- ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly -
-
- ADMX_CredSsp/AllowSavedCredentials -
-
- ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly -
-
- ADMX_CredSsp/DenyDefaultCredentials -
-
- ADMX_CredSsp/DenyFreshCredentials -
-
- ADMX_CredSsp/DenySavedCredentials -
-
- ADMX_CredSsp/RestrictedRemoteAdministration - -### ADMX_CredUI policies - -
-
- ADMX_CredUI/EnableSecureCredentialPrompting -
-
- ADMX_CredUI/NoLocalPasswordResetQuestions -
-
- -### ADMX_CtrlAltDel policies -
-
- ADMX_Cpls/UseDefaultTile -
-
- -### ADMX_DataCollection policies - -
-
- ADMX_DataCollection/CommercialIdPolicy -
-
- -### ADMX_DCOM policies - -
-
- ADMX_DCOM/DCOMActivationSecurityCheckAllowLocalList -
-
- ADMX_DCOM/DCOMActivationSecurityCheckExemptionList -
-
- -### ADMX_Desktop policies - -
-
- ADMX_Desktop/AD_EnableFilter -
-
- ADMX_Desktop/AD_HideDirectoryFolder -
-
- ADMX_Desktop/AD_QueryLimit -
-
- ADMX_Desktop/ForceActiveDesktopOn -
-
- ADMX_Desktop/NoActiveDesktop -
-
- ADMX_Desktop/NoActiveDesktopChanges -
-
- ADMX_Desktop/NoDesktop -
-
- ADMX_Desktop/NoDesktopCleanupWizard -
-
- ADMX_Desktop/NoInternetIcon -
-
- ADMX_Desktop/NoMyComputerIcon -
-
- ADMX_Desktop/NoMyDocumentsIcon -
-
- ADMX_Desktop/NoNetHood -
-
- ADMX_Desktop/NoPropertiesMyComputer -
-
- ADMX_Desktop/NoPropertiesMyDocuments -
-
- ADMX_Desktop/NoRecentDocsNetHood -
-
- ADMX_Desktop/NoRecycleBinIcon -
-
- ADMX_Desktop/NoRecycleBinProperties -
-
- ADMX_Desktop/NoSaveSettings -
-
- ADMX_Desktop/NoWindowMinimizingShortcuts -
-
- ADMX_Desktop/Wallpaper -
-
- ADMX_Desktop/sz_ATC_DisableAdd -
-
- ADMX_Desktop/sz_ATC_DisableClose -
-
- ADMX_Desktop/sz_ATC_DisableDel -
-
- ADMX_Desktop/sz_ATC_DisableEdit -
-
- ADMX_Desktop/sz_ATC_NoComponents -
-
- ADMX_Desktop/sz_AdminComponents_Title -
-
- ADMX_Desktop/sz_DB_DragDropClose -
-
- ADMX_Desktop/sz_DB_Moving -
-
- ADMX_Desktop/sz_DWP_NoHTMLPaper -
-
- -### ADMX_DeviceCompat policies - -
-
- ADMX_DeviceCompat/DeviceFlags -
-
- ADMX_DeviceCompat/DriverShims -
-
- -### ADMX_DeviceGuard policies - -
- ADMX_DeviceGuard/ConfigCIPolicy -
-
- -### ADMX_DeviceInstallation policies - -
-
- ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall -
-
- ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText -
-
- ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText -
-
- ADMX_DeviceInstallation/DeviceInstall_InstallTimeout -
-
- ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime -
-
- ADMX_DeviceInstallation/DeviceInstall_Removable_Deny -
-
- ADMX_DeviceInstallation/DeviceInstall_SystemRestore -
-
- ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser -
-
- -### ADMX_DeviceSetup policies - -
-
- ADMX_DeviceSetup/DeviceInstall_BalloonTips -
-
- ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration -
-
- -### ADMX_DFS policies - -
-
- ADMX_DFS/DFSDiscoverDC -
-
- -### ADMX_DigitalLocker policies - -
-
- ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1 -
-
- ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2 -
-
- -### ADMX_DiskDiagnostic policies - -
-
- ADMX_DiskDiagnostic/DfdAlertPolicy -
-
- ADMX_DiskDiagnostic/WdiScenarioExecutionPolicy -
-
- -### ADMX_DiskNVCache policies - -
-
- ADMX_DiskNVCache/BootResumePolicy -
-
- ADMX_DiskNVCache/FeatureOffPolicy -
-
- ADMX_DiskNVCache/SolidStatePolicy -
-
- -### ADMX_DiskQuota policies - -
-
- ADMX_DiskQuota/DQ_RemovableMedia -
-
- ADMX_DiskQuota/DQ_Enable -
-
- ADMX_DiskQuota/DQ_Enforce -
-
- ADMX_DiskQuota/DQ_LogEventOverLimit -
-
- ADMX_DiskQuota/DQ_LogEventOverThreshold -
-
- ADMX_DiskQuota/DQ_Limit -
-
- -### ADMX_DistributedLinkTracking policies - -
-
- ADMX_DistributedLinkTracking/DLT_AllowDomainMode -
-
- - -### ADMX_DnsClient policies - -
-
- ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries -
-
- ADMX_DnsClient/DNS_AppendToMultiLabelName -
-
- ADMX_DnsClient/DNS_Domain -
-
- ADMX_DnsClient/DNS_DomainNameDevolutionLevel -
-
- ADMX_DnsClient/DNS_IdnEncoding -
-
- ADMX_DnsClient/DNS_IdnMapping -
-
- ADMX_DnsClient/DNS_NameServer -
-
- ADMX_DnsClient/DNS_PreferLocalResponsesOverLowerOrderDns -
-
- ADMX_DnsClient/DNS_PrimaryDnsSuffix -
-
- ADMX_DnsClient/DNS_RegisterAdapterName -
-
- ADMX_DnsClient/DNS_RegisterReverseLookup -
-
- ADMX_DnsClient/DNS_RegistrationEnabled -
-
- ADMX_DnsClient/DNS_RegistrationOverwritesInConflict -
-
- ADMX_DnsClient/DNS_RegistrationRefreshInterval -
-
- ADMX_DnsClient/DNS_RegistrationTtl -
-
- ADMX_DnsClient/DNS_SearchList -
-
- ADMX_DnsClient/DNS_SmartMultiHomedNameResolution -
-
- ADMX_DnsClient/DNS_SmartProtocolReorder -
-
- ADMX_DnsClient/DNS_UpdateSecurityLevel -
-
- ADMX_DnsClient/DNS_UpdateTopLevelDomainZones -
-
- ADMX_DnsClient/DNS_UseDomainNameDevolution -
-
- ADMX_DnsClient/Turn_Off_Multicast -
-
- -### ADMX_DWM policies -
-
- ADMX_DWM/DwmDefaultColorizationColor_1 -
-
- ADMX_DWM/DwmDefaultColorizationColor_2 -
-
- ADMX_DWM/DwmDisallowAnimations_1 -
-
- ADMX_DWM/DwmDisallowAnimations_2 -
-
- ADMX_DWM/DwmDisallowColorizationColorChanges_1 -
-
- ADMX_DWM/DwmDisallowColorizationColorChanges_2 -
-
- -### ADMX_EAIME policies - -
-
- ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList -
-
- ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion -
-
- ADMX_EAIME/L_TurnOffCustomDictionary -
-
- ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput -
-
- ADMX_EAIME/L_TurnOffInternetSearchIntegration -
-
- ADMX_EAIME/L_TurnOffOpenExtendedDictionary -
-
- ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile -
-
- ADMX_EAIME/L_TurnOnCloudCandidate -
-
- ADMX_EAIME/L_TurnOnCloudCandidateCHS -
-
- ADMX_EAIME/L_TurnOnLexiconUpdate -
-
- ADMX_EAIME/L_TurnOnLiveStickers -
-
- ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport -
-
- -### ADMX_EncryptFilesonMove policies -
-
- ADMX_EncryptFilesonMove/NoEncryptOnMove -
-
- -### ADMX_EventLogging policies -
-
- ADMX_EventLogging/EnableProtectedEventLogging -
-
- -### ADMX_EnhancedStorage policies - -
-
- ADMX_EnhancedStorage/ApprovedEnStorDevices -
-
- ADMX_EnhancedStorage/ApprovedSilos -
-
- ADMX_EnhancedStorage/DisablePasswordAuthentication -
-
- ADMX_EnhancedStorage/DisallowLegacyDiskDevices -
-
- ADMX_EnhancedStorage/LockDeviceOnMachineLock -
-
- ADMX_EnhancedStorage/RootHubConnectedEnStorDevices -
-
- -### ADMX_ErrorReporting policies - -
-
- ADMX_ErrorReporting/PCH_AllOrNoneDef -
-
- ADMX_ErrorReporting/PCH_AllOrNoneEx -
-
- ADMX_ErrorReporting/PCH_AllOrNoneInc -
-
- ADMX_ErrorReporting/PCH_ConfigureReport -
-
- ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults -
-
- ADMX_ErrorReporting/WerArchive_1 -
-
- ADMX_ErrorReporting/WerArchive_2 -
-
- ADMX_ErrorReporting/WerAutoApproveOSDumps_1 -
-
- ADMX_ErrorReporting/WerAutoApproveOSDumps_2 -
-
- ADMX_ErrorReporting/WerBypassDataThrottling_1 -
-
- ADMX_ErrorReporting/WerBypassDataThrottling_2 -
-
- ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 -
-
- ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 -
-
- ADMX_ErrorReporting/WerBypassPowerThrottling_1 -
-
- ADMX_ErrorReporting/WerBypassPowerThrottling_2 -
-
- ADMX_ErrorReporting/WerCER -
-
- ADMX_ErrorReporting/WerConsentCustomize_1 -
-
- ADMX_ErrorReporting/WerConsentOverride_1 -
-
- ADMX_ErrorReporting/WerConsentOverride_2 -
-
- ADMX_ErrorReporting/WerDefaultConsent_1 -
-
- ADMX_ErrorReporting/WerDefaultConsent_2 -
-
- ADMX_ErrorReporting/WerDisable_1 -
-
- ADMX_ErrorReporting/WerExlusion_1 -
-
- ADMX_ErrorReporting/WerExlusion_2 -
-
- ADMX_ErrorReporting/WerNoLogging_1 -
-
- ADMX_ErrorReporting/WerNoLogging_2 -
-
- ADMX_ErrorReporting/WerNoSecondLevelData_1 -
-
- ADMX_ErrorReporting/WerQueue_1 -
-
- ADMX_ErrorReporting/WerQueue_2 -
-
- -### ADMX_EventForwarding policies - -
-
- ADMX_EventForwarding/ForwarderResourceUsage -
-
- ADMX_EventForwarding/SubscriptionManager -
-
- -### ADMX_EventLog policies - -
-
- ADMX_EventLog/Channel_LogEnabled -
-
- ADMX_EventLog/Channel_LogFilePath_1 -
-
- ADMX_EventLog/Channel_LogFilePath_2 -
-
- ADMX_EventLog/Channel_LogFilePath_3 -
-
- ADMX_EventLog/Channel_LogFilePath_4 -
-
- ADMX_EventLog/Channel_LogMaxSize_3 -
-
- ADMX_EventLog/Channel_Log_AutoBackup_1 -
-
- ADMX_EventLog/Channel_Log_AutoBackup_2 -
-
- ADMX_EventLog/Channel_Log_AutoBackup_3 -
-
- ADMX_EventLog/Channel_Log_AutoBackup_4 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_1 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_2 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_3 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_4 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_5 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_6 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_7 -
-
- ADMX_EventLog/Channel_Log_FileLogAccess_8 -
-
- ADMX_EventLog/Channel_Log_Retention_2 -
-
- ADMX_EventLog/Channel_Log_Retention_3 -
-
- ADMX_EventLog/Channel_Log_Retention_4 -
-
- -### ADMX_EventViewer policies - -
-
- ADMX_EventViewer/EventViewer_RedirectionProgram -
-
- ADMX_EventViewer/EventViewer_RedirectionProgramCommandLineParameters -
-
- ADMX_EventViewer/EventViewer_RedirectionURL -
- -### ADMX_Explorer policies - -
-
- ADMX_Explorer/AdminInfoUrl -
-
- ADMX_Explorer/AlwaysShowClassicMenu -
-
- ADMX_Explorer/DisableRoamedProfileInit -
-
- ADMX_Explorer/PreventItemCreationInUsersFilesFolder -
-
- ADMX_Explorer/TurnOffSPIAnimations -
-
- -### ADMX_ExternalBoot policies - -
-
- ADMX_ExternalBoot/PortableOperatingSystem_Hibernate -
- ADMX_ExternalBoot/PortableOperatingSystem_Sleep -
- - ADMX_ExternalBoot/PortableOperatingSystem_Launcher - -
- -### ADMX_FileRecovery policies -
-
- ADMX_FileRecovery/WdiScenarioExecutionPolicy -
-
- -### ADMX_FileRevocation policies -
-
- ADMX_FileRevocation/DelegatedPackageFamilyNames -
-
- -### ADMX_FileServerVSSProvider policies -
-
- ADMX_FileServerVSSProvider/Pol_EncryptProtocol -
-
- -### ADMX_FileSys policies -
-
- ADMX_FileSys/DisableCompression -
-
- ADMX_FileSys/DisableDeleteNotification -
-
- ADMX_FileSys/DisableEncryption -
-
- ADMX_FileSys/EnablePagefileEncryption -
-
- ADMX_FileSys/LongPathsEnabled -
-
- ADMX_FileSys/ShortNameCreationSettings -
-
- ADMX_FileSys/SymlinkEvaluation -
-
- ADMX_FileSys/TxfDeprecatedFunctionality -
-
- -### ADMX_FolderRedirection policies -
-
- ADMX_FolderRedirection/DisableFRAdminPin -
-
- ADMX_FolderRedirection/DisableFRAdminPinByFolder -
-
- ADMX_FolderRedirection/FolderRedirectionEnableCacheRename -
-
- ADMX_FolderRedirection/LocalizeXPRelativePaths_1 -
-
- ADMX_FolderRedirection/LocalizeXPRelativePaths_2 -
-
- ADMX_FolderRedirection/PrimaryComputer_FR_1 -
-
- ADMX_FolderRedirection/PrimaryComputer_FR_2 -
-
- -### ADMX_FramePanes policies -
-
- ADMX_FramePanes/NoReadingPane -
-
- ADMX_FramePanes/NoPreviewPane -
-
- -### ADMX_FTHSVC policies -
-
- ADMX_FTHSVC/WdiScenarioExecutionPolicy -
-
- -### ADMX_Help policies -
-
- ADMX_Help/DisableHHDEP -
-
- ADMX_Help/HelpQualifiedRootDir_Comp -
-
- ADMX_Help/RestrictRunFromHelp -
-
- ADMX_Help/RestrictRunFromHelp_Comp -
-
- -### ADMX_HotSpotAuth policies -
-
- ADMX_HotSpotAuth/HotspotAuth_Enable -
-
- -### ADMX_Globalization policies - -
-
- ADMX_Globalization/BlockUserInputMethodsForSignIn -
-
- ADMX_Globalization/CustomLocalesNoSelect_1 -
-
- ADMX_Globalization/CustomLocalesNoSelect_2 -
-
- ADMX_Globalization/HideAdminOptions -
-
- ADMX_Globalization/HideCurrentLocation -
-
- ADMX_Globalization/HideLanguageSelection -
-
- ADMX_Globalization/HideLocaleSelectAndCustomize -
-
- ADMX_Globalization/ImplicitDataCollectionOff_1 -
-
- ADMX_Globalization/ImplicitDataCollectionOff_2 -
-
- ADMX_Globalization/LocaleSystemRestrict -
-
- ADMX_Globalization/LocaleUserRestrict_1 -
-
- ADMX_Globalization/LocaleUserRestrict_2 -
-
- ADMX_Globalization/LockMachineUILanguage -
-
- ADMX_Globalization/LockUserUILanguage -
-
- ADMX_Globalization/PreventGeoIdChange_1 -
-
- ADMX_Globalization/PreventGeoIdChange_2 -
-
- ADMX_Globalization/PreventUserOverrides_1 -
-
- ADMX_Globalization/PreventUserOverrides_2 -
-
- ADMX_Globalization/RestrictUILangSelect -
-
- ADMX_Globalization/TurnOffAutocorrectMisspelledWords -
-
- ADMX_Globalization/TurnOffHighlightMisspelledWords -
-
- ADMX_Globalization/TurnOffInsertSpace -
-
- ADMX_Globalization/TurnOffOfferTextPredictions -
-
- ADMX_Globalization/Y2K -
-
- -### ADMX_GroupPolicy policies - -
-
- ADMX_GroupPolicy/AllowX-ForestPolicy-and-RUP -
-
- ADMX_GroupPolicy/CSE_AppMgmt -
-
- ADMX_GroupPolicy/CSE_DiskQuota -
-
- ADMX_GroupPolicy/CSE_EFSRecovery -
-
- ADMX_GroupPolicy/CSE_FolderRedirection -
-
- ADMX_GroupPolicy/CSE_IEM -
-
- ADMX_GroupPolicy/CSE_IPSecurity -
-
- ADMX_GroupPolicy/CSE_Registry -
-
- ADMX_GroupPolicy/CSE_Scripts -
-
- ADMX_GroupPolicy/CSE_Security -
-
- ADMX_GroupPolicy/CSE_Wired -
-
- ADMX_GroupPolicy/CSE_Wireless -
-
- ADMX_GroupPolicy/CorpConnSyncWaitTime -
-
- ADMX_GroupPolicy/DenyRsopToInteractiveUser_1 -
-
- ADMX_GroupPolicy/DenyRsopToInteractiveUser_2 -
-
- ADMX_GroupPolicy/DisableAOACProcessing -
-
- ADMX_GroupPolicy/DisableAutoADMUpdate -
-
- ADMX_GroupPolicy/DisableBackgroundPolicy -
-
- ADMX_GroupPolicy/DisableLGPOProcessing -
-
- ADMX_GroupPolicy/DisableUsersFromMachGP -
-
- ADMX_GroupPolicy/EnableCDP -
-
- ADMX_GroupPolicy/EnableLogonOptimization -
-
- ADMX_GroupPolicy/EnableLogonOptimizationOnServerSKU -
-
- ADMX_GroupPolicy/EnableMMX -
-
- ADMX_GroupPolicy/EnforcePoliciesOnly -
-
- ADMX_GroupPolicy/FontMitigation -
-
- ADMX_GroupPolicy/GPDCOptions -
-
- ADMX_GroupPolicy/GPTransferRate_1 -
-
- ADMX_GroupPolicy/GPTransferRate_2 -
-
- ADMX_GroupPolicy/GroupPolicyRefreshRate -
-
- ADMX_GroupPolicy/GroupPolicyRefreshRateDC -
-
- ADMX_GroupPolicy/GroupPolicyRefreshRateUser -
-
- ADMX_GroupPolicy/LogonScriptDelay -
-
- ADMX_GroupPolicy/NewGPODisplayName -
-
- ADMX_GroupPolicy/NewGPOLinksDisabled -
-
- ADMX_GroupPolicy/OnlyUseLocalAdminFiles -
-
- ADMX_GroupPolicy/ProcessMitigationOptions -
-
- ADMX_GroupPolicy/RSoPLogging -
-
- ADMX_GroupPolicy/ResetDfsClientInfoDuringRefreshPolicy -
-
- ADMX_GroupPolicy/SlowLinkDefaultForDirectAccess -
-
- ADMX_GroupPolicy/SlowlinkDefaultToAsync -
-
- ADMX_GroupPolicy/SyncWaitTime -
-
- ADMX_GroupPolicy/UserPolicyMode -
-
- -### ADMX_HelpAndSupport policies -
-
- ADMX_HelpAndSupport/ActiveHelp -
-
- ADMX_HelpAndSupport/HPExplicitFeedback -
-
- ADMX_HelpAndSupport/HPImplicitFeedback -
-
- ADMX_HelpAndSupport/HPOnlineAssistance -
-
- - -## ADMX_ICM policies - -
-
- ADMX_ICM/CEIPEnable -
-
- ADMX_ICM/CertMgr_DisableAutoRootUpdates -
-
- ADMX_ICM/DisableHTTPPrinting_1 -
-
- ADMX_ICM/DisableWebPnPDownload_1 -
-
- ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate -
-
- ADMX_ICM/EventViewer_DisableLinks -
-
- ADMX_ICM/HSS_HeadlinesPolicy -
-
- ADMX_ICM/HSS_KBSearchPolicy -
-
- ADMX_ICM/InternetManagement_RestrictCommunication_1 -
-
- ADMX_ICM/InternetManagement_RestrictCommunication_2 -
-
- ADMX_ICM/NC_ExitOnISP -
-
- ADMX_ICM/NC_NoRegistration -
-
- ADMX_ICM/PCH_DoNotReport -
-
- ADMX_ICM/RemoveWindowsUpdate_ICM -
-
- ADMX_ICM/SearchCompanion_DisableFileUpdates -
-
- ADMX_ICM/ShellNoUseInternetOpenWith_1 -
-
- ADMX_ICM/ShellNoUseInternetOpenWith_2 -
-
- ADMX_ICM/ShellNoUseStoreOpenWith_1 -
-
- ADMX_ICM/ShellNoUseStoreOpenWith_2 -
-
- ADMX_ICM/ShellPreventWPWDownload_1 -
-
- ADMX_ICM/ShellRemoveOrderPrints_1 -
-
- ADMX_ICM/ShellRemoveOrderPrints_2 -
-
- ADMX_ICM/ShellRemovePublishToWeb_1 -
-
- ADMX_ICM/ShellRemovePublishToWeb_2 -
-
- ADMX_ICM/WinMSG_NoInstrumentation_1 -
-
- ADMX_ICM/WinMSG_NoInstrumentation_2 -
-
- -### ADMX_IIS policies -
-
- ADMX_IIS/PreventIISInstall -
-
- -### ADMX_iSCSI policies - -
-
- ADMX_iSCSI/iSCSIGeneral_RestrictAdditionalLogins -
-
- ADMX_iSCSI/iSCSIGeneral_ChangeIQNName -
-
- ADMX_iSCSI/iSCSISecurity_ChangeCHAPSecret -
-
- -### ADMX_kdc policies -
-
- ADMX_kdc/CbacAndArmor -
-
- ADMX_kdc/ForestSearch -
-
- ADMX_kdc/PKINITFreshness -
-
- ADMX_kdc/RequestCompoundId -
-
- ADMX_kdc/TicketSizeThreshold -
-
- ADMX_kdc/emitlili -
-
- -### ADMX_Kerberos policies - -
-
- ADMX_Kerberos/AlwaysSendCompoundId -
-
- ADMX_Kerberos/DevicePKInitEnabled -
-
- ADMX_Kerberos/HostToRealm -
-
- ADMX_Kerberos/KdcProxyDisableServerRevocationCheck -
-
- ADMX_Kerberos/KdcProxyServer -
-
- ADMX_Kerberos/MitRealms -
-
- ADMX_Kerberos/ServerAcceptsCompound -
-
- ADMX_Kerberos/StrictTarget -
-
- -### ADMX_LanmanServer policies -
-
- ADMX_LanmanServer/Pol_CipherSuiteOrder -
-
- ADMX_LanmanServer/Pol_HashPublication -
-
- ADMX_LanmanServer/Pol_HashSupportVersion -
-
- ADMX_LanmanServer/Pol_HonorCipherSuiteOrder -
-
- -### ADMX_LanmanWorkstation policies - -
-
- ADMX_LanmanWorkstation/Pol_CipherSuiteOrder -
-
- ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles -
-
- ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares -
-
- -### ADMX_LeakDiagnostic policies -
-
- ADMX_LeakDiagnostic/WdiScenarioExecutionPolicy -
-
- -### ADMX_LinkLayerTopologyDiscovery policies -
-
- ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO -
-
- ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr -
-
- -### ADMX_LocationProviderAdm policies - -
-
- ADMX_LocationProviderAdm/BlockUserFromShowingAccountDetailsOnSignin -
-
- -### ADMX_Logon policies - -
-
- ADMX_Logon/BlockUserFromShowingAccountDetailsOnSignin -
-
- ADMX_Logon/DisableAcrylicBackgroundOnLogon -
-
- ADMX_Logon/DisableExplorerRunLegacy_1 -
-
- ADMX_Logon/DisableExplorerRunLegacy_2 -
-
- ADMX_Logon/DisableExplorerRunOnceLegacy_1 -
-
- ADMX_Logon/DisableExplorerRunOnceLegacy_2 -
-
- ADMX_Logon/DisableStatusMessages -
-
- ADMX_Logon/DontEnumerateConnectedUsers -
-
- ADMX_Logon/NoWelcomeTips_1 -
-
- ADMX_Logon/NoWelcomeTips_2 -
-
- ADMX_Logon/Run_1 -
-
- ADMX_Logon/Run_2 -
-
- ADMX_Logon/SyncForegroundPolicy -
-
- ADMX_Logon/UseOEMBackground -
-
- ADMX_Logon/VerboseStatus -
-
- -### ADMX_MicrosoftDefenderAntivirus policies - -
-
- ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup -
-
- ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender -
-
- ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions -
-
- ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen -
-
- ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge -
-
- ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring -
-
- ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction -
-
- ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions -
-
- ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths -
-
- ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes -
-
- ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions -
-
- ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules -
-
- ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications -
-
- ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders -
-
- ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation -
-
- ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement -
-
- ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid -
-
- ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition -
-
- ADMX_MicrosoftDefenderAntivirus/ProxyBypass -
-
- ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl -
-
- ADMX_MicrosoftDefenderAntivirus/ProxyServer -
-
- ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay -
-
- ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay -
-
- ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring -
-
- ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection -
-
- ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime -
-
- ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay -
-
- ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_Disablegenericreports -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents -
-
- ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay -
-
- ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime -
-
- ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval -
-
- ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup -
-
- ADMX_MicrosoftDefenderAntivirus/SpynetReporting -
-
- ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting -
-
- ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction -
-
- ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString -
-
- ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress -
-
- ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification -
-
- ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown -
-
- -### ADMX_MMC policies -
-
- ADMX_MMC/MMC_ActiveXControl -
-
- ADMX_MMC/MMC_ExtendView -
-
- ADMX_MMC/MMC_LinkToWeb -
-
- ADMX_MMC/MMC_Restrict_Author -
-
- ADMX_MMC/MMC_Restrict_To_Permitted_Snapins -
-
- -### ADMX_MMCSnapins policies - -
-
- ADMX_MMCSnapins/MMC_ADMComputers_1 -
-
- ADMX_MMCSnapins/MMC_ADMComputers_2 -
-
- ADMX_MMCSnapins/MMC_ADMUsers_1 -
-
- ADMX_MMCSnapins/MMC_ADMUsers_2 -
-
- ADMX_MMCSnapins/MMC_ADSI -
-
- ADMX_MMCSnapins/MMC_ActiveDirDomTrusts -
-
- ADMX_MMCSnapins/MMC_ActiveDirSitesServices -
-
- ADMX_MMCSnapins/MMC_ActiveDirUsersComp -
-
- ADMX_MMCSnapins/MMC_AppleTalkRouting -
-
- ADMX_MMCSnapins/MMC_AuthMan -
-
- ADMX_MMCSnapins/MMC_CertAuth -
-
- ADMX_MMCSnapins/MMC_CertAuthPolSet -
-
- ADMX_MMCSnapins/MMC_Certs -
-
- ADMX_MMCSnapins/MMC_CertsTemplate -
-
- ADMX_MMCSnapins/MMC_ComponentServices -
-
- ADMX_MMCSnapins/MMC_ComputerManagement -
-
- ADMX_MMCSnapins/MMC_ConnectionSharingNAT -
-
- ADMX_MMCSnapins/MMC_DCOMCFG -
-
- ADMX_MMCSnapins/MMC_DFS -
-
- ADMX_MMCSnapins/MMC_DHCPRelayMgmt -
-
- ADMX_MMCSnapins/MMC_DeviceManager_1 -
-
- ADMX_MMCSnapins/MMC_DeviceManager_2 -
-
- ADMX_MMCSnapins/MMC_DiskDefrag -
-
- ADMX_MMCSnapins/MMC_DiskMgmt -
-
- ADMX_MMCSnapins/MMC_EnterprisePKI -
-
- ADMX_MMCSnapins/MMC_EventViewer_1 -
-
- ADMX_MMCSnapins/MMC_EventViewer_2 -
-
- ADMX_MMCSnapins/MMC_EventViewer_3 -
-
- ADMX_MMCSnapins/MMC_EventViewer_4 -
-
- ADMX_MMCSnapins/MMC_FAXService -
-
- ADMX_MMCSnapins/MMC_FailoverClusters -
-
- ADMX_MMCSnapins/MMC_FolderRedirection_1 -
-
- ADMX_MMCSnapins/MMC_FolderRedirection_2 -
-
- ADMX_MMCSnapins/MMC_FrontPageExt -
-
- ADMX_MMCSnapins/MMC_GroupPolicyManagementSnapIn -
-
- ADMX_MMCSnapins/MMC_GroupPolicySnapIn -
-
- ADMX_MMCSnapins/MMC_GroupPolicyTab -
-
- ADMX_MMCSnapins/MMC_HRA -
-
- ADMX_MMCSnapins/MMC_IAS -
-
- ADMX_MMCSnapins/MMC_IASLogging -
-
- ADMX_MMCSnapins/MMC_IEMaintenance_1 -
-
- ADMX_MMCSnapins/MMC_IEMaintenance_2 -
-
- ADMX_MMCSnapins/MMC_IGMPRouting -
-
- ADMX_MMCSnapins/MMC_IIS -
-
- ADMX_MMCSnapins/MMC_IPRouting -
-
- ADMX_MMCSnapins/MMC_IPSecManage_GP -
-
- ADMX_MMCSnapins/MMC_IPXRIPRouting -
-
- ADMX_MMCSnapins/MMC_IPXRouting -
-
- ADMX_MMCSnapins/MMC_IPXSAPRouting -
-
- ADMX_MMCSnapins/MMC_IndexingService -
-
- ADMX_MMCSnapins/MMC_IpSecManage -
-
- ADMX_MMCSnapins/MMC_IpSecMonitor -
-
- ADMX_MMCSnapins/MMC_LocalUsersGroups -
-
- ADMX_MMCSnapins/MMC_LogicalMappedDrives -
-
- ADMX_MMCSnapins/MMC_NPSUI -
-
- ADMX_MMCSnapins/MMC_NapSnap -
-
- ADMX_MMCSnapins/MMC_NapSnap_GP -
-
- ADMX_MMCSnapins/MMC_Net_Framework -
-
- ADMX_MMCSnapins/MMC_OCSP -
-
- ADMX_MMCSnapins/MMC_OSPFRouting -
-
- ADMX_MMCSnapins/MMC_PerfLogsAlerts -
-
- ADMX_MMCSnapins/MMC_PublicKey -
-
- ADMX_MMCSnapins/MMC_QoSAdmission -
-
- ADMX_MMCSnapins/MMC_RAS_DialinUser -
-
- ADMX_MMCSnapins/MMC_RIPRouting -
-
- ADMX_MMCSnapins/MMC_RIS -
-
- ADMX_MMCSnapins/MMC_RRA -
-
- ADMX_MMCSnapins/MMC_RSM -
-
- ADMX_MMCSnapins/MMC_RemStore -
-
- ADMX_MMCSnapins/MMC_RemoteAccess -
-
- ADMX_MMCSnapins/MMC_RemoteDesktop -
-
- ADMX_MMCSnapins/MMC_ResultantSetOfPolicySnapIn -
-
- ADMX_MMCSnapins/MMC_Routing -
-
- ADMX_MMCSnapins/MMC_SCA -
-
- ADMX_MMCSnapins/MMC_SMTPProtocol -
-
- ADMX_MMCSnapins/MMC_SNMP -
-
- ADMX_MMCSnapins/MMC_ScriptsMachine_1 -
-
- ADMX_MMCSnapins/MMC_ScriptsMachine_2 -
-
- ADMX_MMCSnapins/MMC_ScriptsUser_1 -
-
- ADMX_MMCSnapins/MMC_ScriptsUser_2 -
-
- ADMX_MMCSnapins/MMC_SecuritySettings_1 -
-
- ADMX_MMCSnapins/MMC_SecuritySettings_2 -
-
- ADMX_MMCSnapins/MMC_SecurityTemplates -
-
- ADMX_MMCSnapins/MMC_SendConsoleMessage -
-
- ADMX_MMCSnapins/MMC_ServerManager -
-
- ADMX_MMCSnapins/MMC_ServiceDependencies -
-
- ADMX_MMCSnapins/MMC_Services -
-
- ADMX_MMCSnapins/MMC_SharedFolders -
-
- ADMX_MMCSnapins/MMC_SharedFolders_Ext -
-
- ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_1 -
-
- ADMX_MMCSnapins/MMC_SoftwareInstalationComputers_2 -
-
- ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_1 -
-
- ADMX_MMCSnapins/MMC_SoftwareInstallationUsers_2 -
-
- ADMX_MMCSnapins/MMC_SysInfo -
-
- ADMX_MMCSnapins/MMC_SysProp -
-
- ADMX_MMCSnapins/MMC_TPMManagement -
-
- ADMX_MMCSnapins/MMC_Telephony -
-
- ADMX_MMCSnapins/MMC_TerminalServices -
-
- ADMX_MMCSnapins/MMC_WMI -
-
- ADMX_MMCSnapins/MMC_WindowsFirewall -
-
- ADMX_MMCSnapins/MMC_WindowsFirewall_GP -
-
- ADMX_MMCSnapins/MMC_WiredNetworkPolicy -
-
- ADMX_MMCSnapins/MMC_WirelessMon -
-
- ADMX_MMCSnapins/MMC_WirelessNetworkPolicy -
-
- -### ADMX_MobilePCMobilityCenter policies -
-
- ADMX_MobilePCMobilityCenter/MobilityCenterEnable_1 -
-
- ADMX_MobilePCMobilityCenter/MobilityCenterEnable_2 -
-
- -### ADMX_MobilePCPresentationSettings policies -
-
- ADMX_MobilePCPresentationSettings/PresentationSettingsEnable_1 -
-
- ADMX_MobilePCPresentationSettings/PresentationSettingsEnable_2 -
-
- -### ADMX_MSAPolicy policies -
-
- ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine -
-
- -### ADMX_msched policies - -
-
- ADMX_msched/ActivationBoundaryPolicy -
-
- ADMX_msched/RandomDelayPolicy -
-
- -### ADMX_MSDT policies - -
-
- ADMX_MSDT/MsdtSupportProvider -
-
- ADMX_MSDT/MsdtToolDownloadPolicy -
-
- ADMX_MSDT/WdiScenarioExecutionPolicy -
-
- -### ADMX_MSI policies - -
-
- ADMX_MSI/AllowLockdownBrowse -
-
- ADMX_MSI/AllowLockdownMedia -
-
- ADMX_MSI/AllowLockdownPatch -
-
- ADMX_MSI/DisableAutomaticApplicationShutdown -
-
- ADMX_MSI/DisableBrowse -
-
- ADMX_MSI/DisableFlyweightPatching -
-
- ADMX_MSI/DisableLoggingFromPackage -
-
- ADMX_MSI/DisableMSI -
-
- ADMX_MSI/DisableMedia -
-
- ADMX_MSI/DisablePatch -
-
- ADMX_MSI/DisableRollback_1 -
-
- ADMX_MSI/DisableRollback_2 -
-
- ADMX_MSI/DisableSharedComponent -
-
- ADMX_MSI/MSILogging -
-
- ADMX_MSI/MSI_DisableLUAPatching -
-
- ADMX_MSI/MSI_DisablePatchUninstall -
-
- ADMX_MSI/MSI_DisableSRCheckPoints -
-
- ADMX_MSI/MSI_DisableUserInstalls -
-
- ADMX_MSI/MSI_EnforceUpgradeComponentRules -
-
- ADMX_MSI/MSI_MaxPatchCacheSize -
-
- ADMX_MSI/MsiDisableEmbeddedUI -
-
- ADMX_MSI/SafeForScripting -
-
- ADMX_MSI/SearchOrder -
-
- ADMX_MSI/TransformsSecure -
-
- -### ADMX_MsiFileRecovery policies -
-
- ADMX_MsiFileRecovery/WdiScenarioExecutionPolicy -
-
- -### ADMX_nca policies -
-
- ADMX_nca/CorporateResources -
-
- ADMX_nca/CustomCommands -
-
- ADMX_nca/DTEs -
-
- ADMX_nca/FriendlyName -
-
- ADMX_nca/LocalNamesOn -
-
- ADMX_nca/PassiveMode -
-
- ADMX_nca/ShowUI -
-
- ADMX_nca/SupportEmail -
-
- -### ADMX_NCSI policies -
-
- ADMX_NCSI/NCSI_CorpDnsProbeContent -
-
- ADMX_NCSI/NCSI_CorpDnsProbeHost -
-
- ADMX_NCSI/NCSI_CorpSitePrefixes -
-
- ADMX_NCSI/NCSI_CorpWebProbeUrl -
-
- ADMX_NCSI/NCSI_DomainLocationDeterminationUrl -
-
- ADMX_NCSI/NCSI_GlobalDns -
-
- ADMX_NCSI/NCSI_PassivePolling -
-
- -### ADMX_Netlogon policies - -
-
- ADMX_Netlogon/Netlogon_AddressLookupOnPingBehavior -
-
- ADMX_Netlogon/Netlogon_AddressTypeReturned -
-
- ADMX_Netlogon/Netlogon_AllowDnsSuffixSearch -
-
- ADMX_Netlogon/Netlogon_AllowNT4Crypto -
-
- ADMX_Netlogon/Netlogon_AllowSingleLabelDnsDomain -
-
- ADMX_Netlogon/Netlogon_AutoSiteCoverage -
-
- ADMX_Netlogon/Netlogon_AvoidFallbackNetbiosDiscovery -
-
- ADMX_Netlogon/Netlogon_AvoidPdcOnWan -
-
- ADMX_Netlogon/Netlogon_BackgroundRetryInitialPeriod -
-
- ADMX_Netlogon/Netlogon_BackgroundRetryMaximumPeriod -
-
- ADMX_Netlogon/Netlogon_BackgroundRetryQuitTime -
-
- ADMX_Netlogon/Netlogon_BackgroundSuccessfulRefreshPeriod -
-
- ADMX_Netlogon/Netlogon_DebugFlag -
-
- ADMX_Netlogon/Netlogon_DnsAvoidRegisterRecords -
-
- ADMX_Netlogon/Netlogon_DnsRefreshInterval -
-
- ADMX_Netlogon/Netlogon_DnsSrvRecordUseLowerCaseHostNames -
-
- ADMX_Netlogon/Netlogon_DnsTtl -
-
- ADMX_Netlogon/Netlogon_ExpectedDialupDelay -
-
- ADMX_Netlogon/Netlogon_ForceRediscoveryInterval -
-
- ADMX_Netlogon/Netlogon_GcSiteCoverage -
-
- ADMX_Netlogon/Netlogon_IgnoreIncomingMailslotMessages -
-
- ADMX_Netlogon/Netlogon_LdapSrvPriority -
-
- ADMX_Netlogon/Netlogon_LdapSrvWeight -
-
- ADMX_Netlogon/Netlogon_MaximumLogFileSize -
-
- ADMX_Netlogon/Netlogon_NdncSiteCoverage -
-
- ADMX_Netlogon/Netlogon_NegativeCachePeriod -
-
- ADMX_Netlogon/Netlogon_NetlogonShareCompatibilityMode -
-
- ADMX_Netlogon/Netlogon_NonBackgroundSuccessfulRefreshPeriod -
-
- ADMX_Netlogon/Netlogon_PingUrgencyMode -
-
- ADMX_Netlogon/Netlogon_ScavengeInterval -
-
- ADMX_Netlogon/Netlogon_SiteCoverage -
-
- ADMX_Netlogon/Netlogon_SiteName -
-
- ADMX_Netlogon/Netlogon_SysvolShareCompatibilityMode -
-
- ADMX_Netlogon/Netlogon_TryNextClosestSite -
-
- ADMX_Netlogon/Netlogon_UseDynamicDns -
-
- -### ADMX_NetworkConnections policies - -
-
- ADMX_NetworkConnections/NC_AddRemoveComponents -
-
- ADMX_NetworkConnections/NC_AdvancedSettings -
-
- ADMX_NetworkConnections/NC_AllowAdvancedTCPIPConfig -
-
- ADMX_NetworkConnections/NC_ChangeBindState -
-
- ADMX_NetworkConnections/NC_DeleteAllUserConnection -
-
- ADMX_NetworkConnections/NC_DeleteConnection -
-
- ADMX_NetworkConnections/NC_DialupPrefs -
-
- ADMX_NetworkConnections/NC_DoNotShowLocalOnlyIcon -
-
- ADMX_NetworkConnections/NC_EnableAdminProhibits -
-
- ADMX_NetworkConnections/NC_ForceTunneling -
-
- ADMX_NetworkConnections/NC_IpStateChecking -
-
- ADMX_NetworkConnections/NC_LanChangeProperties -
-
- ADMX_NetworkConnections/NC_LanConnect -
-
- ADMX_NetworkConnections/NC_LanProperties -
-
- ADMX_NetworkConnections/NC_NewConnectionWizard -
-
- ADMX_NetworkConnections/NC_PersonalFirewallConfig -
-
- ADMX_NetworkConnections/NC_RasAllUserProperties -
-
- ADMX_NetworkConnections/NC_RasChangeProperties -
-
- ADMX_NetworkConnections/NC_RasConnect -
-
- ADMX_NetworkConnections/NC_RasMyProperties -
-
- ADMX_NetworkConnections/NC_RenameAllUserRasConnection -
-
- ADMX_NetworkConnections/NC_RenameConnection -
-
- ADMX_NetworkConnections/NC_RenameLanConnection -
-
- ADMX_NetworkConnections/NC_RenameMyRasConnection -
-
- ADMX_NetworkConnections/NC_ShowSharedAccessUI -
-
- ADMX_NetworkConnections/NC_Statistics -
-
- ADMX_NetworkConnections/NC_StdDomainUserSetLocation -
-
- -### ADMX_OfflineFiles policies - -
- ADMX_OfflineFiles/Pol_AlwaysPinSubFolders -
-
- ADMX_OfflineFiles/Pol_AssignedOfflineFiles_1 -
-
- ADMX_OfflineFiles/Pol_AssignedOfflineFiles_2 -
-
- ADMX_OfflineFiles/Pol_BackgroundSyncSettings -
-
- ADMX_OfflineFiles/Pol_CacheSize -
-
- ADMX_OfflineFiles/Pol_CustomGoOfflineActions_1 -
-
- ADMX_OfflineFiles/Pol_CustomGoOfflineActions_2 -
-
- ADMX_OfflineFiles/Pol_DefCacheSize -
-
- ADMX_OfflineFiles/Pol_Enabled -
-
- ADMX_OfflineFiles/Pol_EncryptOfflineFiles -
-
- ADMX_OfflineFiles/Pol_EventLoggingLevel_1 -
-
- ADMX_OfflineFiles/Pol_EventLoggingLevel_2 -
-
- ADMX_OfflineFiles/Pol_ExclusionListSettings -
-
- ADMX_OfflineFiles/Pol_ExtExclusionList -
-
- ADMX_OfflineFiles/Pol_GoOfflineAction_1 -
-
- ADMX_OfflineFiles/Pol_GoOfflineAction_2 -
-
- ADMX_OfflineFiles/Pol_NoCacheViewer_1 -
-
- ADMX_OfflineFiles/Pol_NoCacheViewer_2 -
-
- ADMX_OfflineFiles/Pol_NoConfigCache_1 -
-
- ADMX_OfflineFiles/Pol_NoConfigCache_2 -
-
- ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_1 -
-
- ADMX_OfflineFiles/Pol_NoMakeAvailableOffline_2 -
-
- ADMX_OfflineFiles/Pol_NoPinFiles_1 -
-
- ADMX_OfflineFiles/Pol_NoPinFiles_2 -
-
- ADMX_OfflineFiles/Pol_NoReminders_1 -
-
- ADMX_OfflineFiles/Pol_NoReminders_2 -
-
- ADMX_OfflineFiles/Pol_OnlineCachingSettings -
-
- ADMX_OfflineFiles/Pol_PurgeAtLogoff -
-
- ADMX_OfflineFiles/Pol_QuickAdimPin -
-
- ADMX_OfflineFiles/Pol_ReminderFreq_1 -
-
- ADMX_OfflineFiles/Pol_ReminderFreq_2 -
-
- ADMX_OfflineFiles/Pol_ReminderInitTimeout_1 -
-
- ADMX_OfflineFiles/Pol_ReminderInitTimeout_2 -
-
- ADMX_OfflineFiles/Pol_ReminderTimeout_1 -
-
- ADMX_OfflineFiles/Pol_ReminderTimeout_2 -
-
- ADMX_OfflineFiles/Pol_SlowLinkSettings -
-
- ADMX_OfflineFiles/Pol_SlowLinkSpeed -
-
- ADMX_OfflineFiles/Pol_SyncAtLogoff_1 -
-
- ADMX_OfflineFiles/Pol_SyncAtLogoff_2 -
-
- ADMX_OfflineFiles/Pol_SyncAtLogon_1 -
-
- ADMX_OfflineFiles/Pol_SyncAtLogon_2 -
-
- ADMX_OfflineFiles/Pol_SyncAtSuspend_1 -
-
- ADMX_OfflineFiles/Pol_SyncAtSuspend_2 -
-
- ADMX_OfflineFiles/Pol_SyncOnCostedNetwork -
-
- ADMX_OfflineFiles/Pol_WorkOfflineDisabled_1 -
-
- ADMX_OfflineFiles/Pol_WorkOfflineDisabled_2 -
-
- -### ADMX_pca policies - -
-
- ADMX_pca/DetectDeprecatedCOMComponentFailuresPolicy -
-
- ADMX_pca/DetectDeprecatedComponentFailuresPolicy -
-
- ADMX_pca/DetectInstallFailuresPolicy -
-
- ADMX_pca/DetectUndetectedInstallersPolicy -
-
- ADMX_pca/DetectUpdateFailuresPolicy -
-
- ADMX_pca/DisablePcaUIPolicy -
-
- ADMX_pca/DetectBlockedDriversPolicy -
-
- -### ADMX_PeerToPeerCaching policies - -
-
- ADMX_PeerToPeerCaching/EnableWindowsBranchCache -
-
- ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Distributed -
-
- ADMX_PeerToPeerCaching/EnableWindowsBranchCache_Hosted -
-
- ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedCacheDiscovery -
-
- ADMX_PeerToPeerCaching/EnableWindowsBranchCache_HostedMultipleServers -
-
- ADMX_PeerToPeerCaching/EnableWindowsBranchCache_SMB -
-
- ADMX_PeerToPeerCaching/SetCachePercent -
-
- ADMX_PeerToPeerCaching/SetDataCacheEntryMaxAge -
-
- ADMX_PeerToPeerCaching/SetDowngrading -
-
- -### ADMX_PenTraining policies - -
-
- ADMX_PenTraining/PenTrainingOff_1 -
-
- ADMX_PenTraining/PenTrainingOff_2 -
-
- -### ADMX_PerformanceDiagnostics policies - -
-
- ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_1 -
-
- ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_2 -
-
- ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_3 -
-
- ADMX_PerformanceDiagnostics/WdiScenarioExecutionPolicy_4 -
-
- -### ADMX_Power policies - -
-
- ADMX_Power/ACConnectivityInStandby_2 -
-
- ADMX_Power/ACCriticalSleepTransitionsDisable_2 -
-
- ADMX_Power/ACStartMenuButtonAction_2 -
-
- ADMX_Power/AllowSystemPowerRequestAC -
-
- ADMX_Power/AllowSystemPowerRequestDC -
-
- ADMX_Power/AllowSystemSleepWithRemoteFilesOpenAC -
-
- ADMX_Power/AllowSystemSleepWithRemoteFilesOpenDC -
-
- ADMX_Power/CustomActiveSchemeOverride_2 -
-
- ADMX_Power/DCBatteryDischargeAction0_2 -
-
- ADMX_Power/DCBatteryDischargeAction1_2 -
-
- ADMX_Power/DCBatteryDischargeLevel0_2 -
-
- ADMX_Power/DCBatteryDischargeLevel1UINotification_2 -
-
- ADMX_Power/DCBatteryDischargeLevel1_2 -
-
- ADMX_Power/DCConnectivityInStandby_2 -
-
- ADMX_Power/DCCriticalSleepTransitionsDisable_2 -
-
- ADMX_Power/DCStartMenuButtonAction_2 -
-
- ADMX_Power/DiskACPowerDownTimeOut_2 -
-
- ADMX_Power/DiskDCPowerDownTimeOut_2 -
-
- ADMX_Power/Dont_PowerOff_AfterShutdown -
-
- ADMX_Power/EnableDesktopSlideShowAC -
-
- ADMX_Power/EnableDesktopSlideShowDC -
-
- ADMX_Power/InboxActiveSchemeOverride_2 -
-
- ADMX_Power/PW_PromptPasswordOnResume -
-
- ADMX_Power/PowerThrottlingTurnOff -
-
- ADMX_Power/ReserveBatteryNotificationLevel -
-
- -### ADMX_PowerShellExecutionPolicy policies - -
-
- ADMX_PowerShellExecutionPolicy/EnableModuleLogging -
-
- ADMX_PowerShellExecutionPolicy/EnableScripts -
-
- ADMX_PowerShellExecutionPolicy/EnableTranscripting -
-
- ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath -
-
- -### ADMX_PreviousVersions policies - -
-
- ADMX_PreviousVersions/DisableLocalPage_1 -
-
- ADMX_PreviousVersions/DisableLocalPage_2 -
-
- ADMX_PreviousVersions/DisableRemotePage_1 -
-
- ADMX_PreviousVersions/DisableRemotePage_2 -
-
- ADMX_PreviousVersions/HideBackupEntries_1 -
-
- ADMX_PreviousVersions/HideBackupEntries_2 -
-
- ADMX_PreviousVersions/DisableLocalRestore_1 -
-
- ADMX_PreviousVersions/DisableLocalRestore_2 -
-
- -### ADMX_Printing policies - -
-
- ADMX_Printing/AllowWebPrinting -
-
- ADMX_Printing/ApplicationDriverIsolation -
-
- ADMX_Printing/CustomizedSupportUrl -
-
- ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate -
-
- ADMX_Printing/DomainPrinters -
-
- ADMX_Printing/DownlevelBrowse -
-
- ADMX_Printing/EMFDespooling -
-
- ADMX_Printing/ForceSoftwareRasterization -
-
- ADMX_Printing/IntranetPrintersUrl -
-
- ADMX_Printing/KMPrintersAreBlocked -
-
- ADMX_Printing/LegacyDefaultPrinterMode -
-
- ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS -
-
- ADMX_Printing/NoDeletePrinter -
-
- ADMX_Printing/NonDomainPrinters -
-
- ADMX_Printing/PackagePointAndPrintOnly -
-
- ADMX_Printing/PackagePointAndPrintOnly_Win7 -
-
- ADMX_Printing/PackagePointAndPrintServerList -
-
- ADMX_Printing/PackagePointAndPrintServerList_Win7 -
-
- ADMX_Printing/PhysicalLocation -
-
- ADMX_Printing/PhysicalLocationSupport -
-
- ADMX_Printing/PrintDriverIsolationExecutionPolicy -
-
- ADMX_Printing/PrintDriverIsolationOverrideCompat -
-
- ADMX_Printing/PrinterDirectorySearchScope -
-
- ADMX_Printing/PrinterServerThread -
-
- ADMX_Printing/ShowJobTitleInEventLogs -
-
- ADMX_Printing/V4DriverDisallowPrinterExtension -
-
- -### ADMX_Printing2 policies - -
-
- ADMX_Printing2/AutoPublishing -
-
- ADMX_Printing2/ImmortalPrintQueue -
-
- ADMX_Printing2/PruneDownlevel -
-
- ADMX_Printing2/PruningInterval -
-
- ADMX_Printing2/PruningPriority -
-
- ADMX_Printing2/PruningRetries -
-
- ADMX_Printing2/PruningRetryLog -
-
- ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint -
-
- ADMX_Printing2/VerifyPublishedState -
-
- -### ADMX_Programs policies - -
-
- ADMX_Programs/NoDefaultPrograms -
-
- ADMX_Programs/NoGetPrograms -
-
- ADMX_Programs/NoInstalledUpdates -
-
- ADMX_Programs/NoProgramsAndFeatures -
-
- ADMX_Programs/NoProgramsCPL -
-
- ADMX_Programs/NoWindowsFeatures -
-
- ADMX_Programs/NoWindowsMarketplace -
-
- -### ADMX_Reliability policies - -
-
- ADMX_Reliability/EE_EnablePersistentTimeStamp -
-
- ADMX_Reliability/PCH_ReportShutdownEvents -
-
- ADMX_Reliability/ShutdownEventTrackerStateFile -
-
- ADMX_Reliability/ShutdownReason -
-
- -### ADMX_RemoteAssistance policies - -
-
- ADMX_RemoteAssistance/RA_EncryptedTicketOnly -
-
- ADMX_RemoteAssistance/RA_Optimize_Bandwidth -
-
- -### ADMX_RemovableStorage policies - -
-
- ADMX_RemovableStorage/AccessRights_RebootTime_1 -
-
- ADMX_RemovableStorage/AccessRights_RebootTime_2 -
-
- ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2 -
-
- ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1 -
-
- ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2 -
-
- ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1 -
-
- ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2 -
-
- ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1 -
-
- ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2 -
-
- ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1 -
-
- ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2 -
-
- ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2 -
-
- ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1 -
-
- ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2 -
-
- ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1 -
-
- ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2 -
-
- ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2 -
-
- ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1 -
-
- ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2 -
-
- ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1 -
-
- ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1 -
-
- ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2 -
-
- ADMX_RemovableStorage/Removable_Remote_Allow_Access -
-
- ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2 -
-
- ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1 -
-
- ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2 -
-
- ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1 -
-
- ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2 -
-
- ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1 -
-
- ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2 -
-
- ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1 -
-
- ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2 -
-
- -### ADMX_RPC policies - -
-
- ADMX_RPC/RpcExtendedErrorInformation -
-
- ADMX_RPC/RpcIgnoreDelegationFailure -
-
- ADMX_RPC/RpcMinimumHttpConnectionTimeout -
-
- ADMX_RPC/RpcStateInformation -
-
- -### ADMX_Scripts policies - -
-
- ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled -
-
- ADMX_Scripts/MaxGPOScriptWaitPolicy -
-
- ADMX_Scripts/Run_Computer_PS_Scripts_First -
-
- ADMX_Scripts/Run_Legacy_Logon_Script_Hidden -
-
- ADMX_Scripts/Run_Logoff_Script_Visible -
-
- ADMX_Scripts/Run_Logon_Script_Sync_1 -
-
- ADMX_Scripts/Run_Logon_Script_Sync_2 -
-
- ADMX_Scripts/Run_Logon_Script_Visible -
-
- ADMX_Scripts/Run_Shutdown_Script_Visible -
-
- ADMX_Scripts/Run_Startup_Script_Sync -
-
- ADMX_Scripts/Run_Startup_Script_Visible -
-
- ADMX_Scripts/Run_User_PS_Scripts_First -
-
- -### ADMX_sdiagschd policies - -
-
- ADMX_sdiagschd/ScheduledDiagnosticsExecutionPolicy -
-
- -### ADMX_sdiageng policies - -
-
- ADMX_sdiageng/BetterWhenConnected -
-
- ADMX_sdiageng/ScriptedDiagnosticsExecutionPolicy -
-
- ADMX_sdiageng/ScriptedDiagnosticsSecurityPolicy -
-
- -### ADMX_Securitycenter policies - -
-
- ADMX_Securitycenter/SecurityCenter_SecurityCenterInDomain -
-
- -### ADMX_Sensors policies - -
-
- ADMX_Sensors/DisableLocationScripting_1 -
-
- ADMX_Sensors/DisableLocationScripting_2 -
-
- ADMX_Sensors/DisableLocation_1 -
-
- ADMX_Sensors/DisableSensors_1 -
-
- ADMX_Sensors/DisableSensors_2 -
-
- -### ADMX_ServerManager policies - -
-
- ADMX_ServerManager/Do_not_display_Manage_Your_Server_page -
-
- ADMX_ServerManager/ServerManagerAutoRefreshRate -
-
- ADMX_ServerManager/DoNotLaunchInitialConfigurationTasks -
-
- ADMX_ServerManager/DoNotLaunchServerManager -
-
- -### ADMX_Servicing policies - -
-
- ADMX_Servicing/Servicing -
-
- -### ADMX_SettingSync policies - -
-
- ADMX_SettingSync/DisableAppSyncSettingSync -
-
- ADMX_SettingSync/DisableApplicationSettingSync -
-
- ADMX_SettingSync/DisableCredentialsSettingSync -
-
- ADMX_SettingSync/DisableDesktopThemeSettingSync -
-
- ADMX_SettingSync/DisablePersonalizationSettingSync -
-
- ADMX_SettingSync/DisableSettingSync -
-
- ADMX_SettingSync/DisableStartLayoutSettingSync -
-
- ADMX_SettingSync/DisableSyncOnPaidNetwork -
-
- ADMX_SettingSync/DisableWindowsSettingSync -
-
- -### ADMX_SharedFolders policies - -
-
- ADMX_SharedFolders/PublishDfsRoots -
-
- ADMX_SharedFolders/PublishSharedFolders -
-
- -### ADMX_Sharing policies - -
-
- ADMX_Sharing/NoInplaceSharing -
-
- -### ADMX_ShellCommandPromptRegEditTools policies - -
-
- ADMX_ShellCommandPromptRegEditTools/DisallowApps -
-
- ADMX_ShellCommandPromptRegEditTools/DisableRegedit -
-
- ADMX_ShellCommandPromptRegEditTools/DisableCMD -
-
- ADMX_ShellCommandPromptRegEditTools/RestrictApps -
-
- -### ADMX_Smartcard policies - -
-
- ADMX_Smartcard/AllowCertificatesWithNoEKU -
-
- ADMX_Smartcard/AllowIntegratedUnblock -
-
- ADMX_Smartcard/AllowSignatureOnlyKeys -
-
- ADMX_Smartcard/AllowTimeInvalidCertificates -
-
- ADMX_Smartcard/CertPropEnabledString -
-
- ADMX_Smartcard/CertPropRootCleanupString -
-
- ADMX_Smartcard/CertPropRootEnabledString -
-
- ADMX_Smartcard/DisallowPlaintextPin -
-
- ADMX_Smartcard/EnumerateECCCerts -
-
- ADMX_Smartcard/FilterDuplicateCerts -
-
- ADMX_Smartcard/ForceReadingAllCertificates -
-
- ADMX_Smartcard/IntegratedUnblockPromptString -
-
- ADMX_Smartcard/ReverseSubject -
-
- ADMX_Smartcard/SCPnPEnabled -
-
- ADMX_Smartcard/SCPnPNotification -
-
- ADMX_Smartcard/X509HintsNeeded -
-
- -### ADMX_Snmp policies - -
-
- ADMX_Snmp/SNMP_Communities -
-
- ADMX_Snmp/SNMP_PermittedManagers -
-
- ADMX_Snmp/SNMP_Traps_Public -
-
-
-
- -### ADMX_StartMenu policies - -
-
- ADMX_StartMenu/AddSearchInternetLinkInStartMenu -
-
- ADMX_StartMenu/ClearRecentDocsOnExit -
-
- ADMX_StartMenu/ClearRecentProgForNewUserInStartMenu -
-
- ADMX_StartMenu/ClearTilesOnExit -
-
- ADMX_StartMenu/DesktopAppsFirstInAppsView -
-
- ADMX_StartMenu/DisableGlobalSearchOnAppsView -
-
- ADMX_StartMenu/ForceStartMenuLogOff -
-
- ADMX_StartMenu/GoToDesktopOnSignIn -
-
- ADMX_StartMenu/GreyMSIAds -
-
- ADMX_StartMenu/HidePowerOptions -
-
- ADMX_StartMenu/Intellimenus -
-
- ADMX_StartMenu/LockTaskbar -
-
- ADMX_StartMenu/MemCheckBoxInRunDlg -
-
- ADMX_StartMenu/NoAutoTrayNotify -
-
- ADMX_StartMenu/NoBalloonTip -
-
- ADMX_StartMenu/NoChangeStartMenu -
-
- ADMX_StartMenu/NoClose -
-
- ADMX_StartMenu/NoCommonGroups -
-
- ADMX_StartMenu/NoFavoritesMenu -
-
- ADMX_StartMenu/NoFind -
-
- ADMX_StartMenu/NoGamesFolderOnStartMenu -
-
- ADMX_StartMenu/NoHelp -
-
- ADMX_StartMenu/NoInstrumentation -
-
- ADMX_StartMenu/NoMoreProgramsList -
-
- ADMX_StartMenu/NoNetAndDialupConnect -
-
- ADMX_StartMenu/NoPinnedPrograms -
-
- ADMX_StartMenu/NoRecentDocsMenu -
-
- ADMX_StartMenu/NoResolveSearch -
-
- ADMX_StartMenu/NoResolveTrack -
-
- ADMX_StartMenu/NoRun -
-
- ADMX_StartMenu/NoSMConfigurePrograms -
-
- ADMX_StartMenu/NoSMMyDocuments -
-
- ADMX_StartMenu/NoSMMyMusic -
-
- ADMX_StartMenu/NoSMMyNetworkPlaces -
-
- ADMX_StartMenu/NoSMMyPictures -
-
- ADMX_StartMenu/NoSearchCommInStartMenu -
-
- ADMX_StartMenu/NoSearchComputerLinkInStartMenu -
-
- ADMX_StartMenu/NoSearchEverywhereLinkInStartMenu -
-
- ADMX_StartMenu/NoSearchFilesInStartMenu -
-
- ADMX_StartMenu/NoSearchInternetInStartMenu -
-
- ADMX_StartMenu/NoSearchProgramsInStartMenu -
-
- ADMX_StartMenu/NoSetFolders -
-
- ADMX_StartMenu/NoSetTaskbar -
-
- ADMX_StartMenu/NoStartMenuDownload -
-
- ADMX_StartMenu/NoStartMenuHomegroup -
-
- ADMX_StartMenu/NoStartMenuRecordedTV -
-
- ADMX_StartMenu/NoStartMenuSubFolders -
-
- ADMX_StartMenu/NoStartMenuVideos -
-
- ADMX_StartMenu/NoStartPage -
-
- ADMX_StartMenu/NoTaskBarClock -
-
- ADMX_StartMenu/NoTaskGrouping -
-
- ADMX_StartMenu/NoToolbarsOnTaskbar -
-
- ADMX_StartMenu/NoTrayContextMenu -
-
- ADMX_StartMenu/NoTrayItemsDisplay -
-
- ADMX_StartMenu/NoUninstallFromStart -
-
- ADMX_StartMenu/NoUserFolderOnStartMenu -
-
- ADMX_StartMenu/NoUserNameOnStartMenu -
-
- ADMX_StartMenu/NoWindowsUpdate -
-
- ADMX_StartMenu/PowerButtonAction -
-
- ADMX_StartMenu/QuickLaunchEnabled -
-
- ADMX_StartMenu/RemoveUnDockPCButton -
-
- ADMX_StartMenu/ShowAppsViewOnStart -
-
- ADMX_StartMenu/ShowRunAsDifferentUserInStart -
-
- ADMX_StartMenu/ShowRunInStartMenu -
-
- ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey -
-
- ADMX_StartMenu/StartMenuLogOff -
-
- ADMX_StartMenu/StartPinAppsWhenInstalled -
-
- -### ADMX_SystemRestore policies - -
-
- ADMX_SystemRestore/SR_DisableConfig -
-
- -### ADMX_TabletShell policies - -
-
- ADMX_TabletShell/DisableInkball_1 -
-
- ADMX_TabletShell/DisableNoteWriterPrinting_1 -
-
- -### ADMX_Taskbar policies - -
-
- ADMX_Taskbar/DisableNotificationCenter -
-
- ADMX_Taskbar/EnableLegacyBalloonNotifications -
-
- ADMX_Taskbar/HideSCAHealth -
-
- ADMX_Taskbar/HideSCANetwork -
-
- ADMX_Taskbar/HideSCAPower -
-
- ADMX_Taskbar/HideSCAVolume -
-
- ADMX_Taskbar/NoBalloonFeatureAdvertisements -
-
- ADMX_Taskbar/NoPinningStoreToTaskbar -
-
- ADMX_Taskbar/NoPinningToDestinations -
-
- ADMX_Taskbar/NoPinningToTaskbar -
-
- ADMX_Taskbar/NoRemoteDestinations -
-
- ADMX_Taskbar/NoSystraySystemPromotion -
-
- ADMX_Taskbar/ShowWindowsStoreAppsOnTaskbar -
-
- ADMX_Taskbar/TaskbarLockAll -
-
- ADMX_Taskbar/TaskbarNoAddRemoveToolbar -
-
- ADMX_Taskbar/TaskbarNoDragToolbar -
-
- ADMX_Taskbar/TaskbarNoMultimon -
-
- ADMX_Taskbar/TaskbarNoNotification -
-
- ADMX_Taskbar/TaskbarNoPinnedList -
-
- ADMX_Taskbar/TaskbarNoRedock -
-
- ADMX_Taskbar/TaskbarNoResize -
-
- ADMX_Taskbar/TaskbarNoThumbnail -
-
- -### ADMX_tcpip policies - -
-
- ADMX_tcpip/6to4_Router_Name -
-
- ADMX_tcpip/6to4_Router_Name_Resolution_Interval -
-
- ADMX_tcpip/6to4_State -
-
- ADMX_tcpip/IPHTTPS_ClientState -
-
- ADMX_tcpip/IP_Stateless_Autoconfiguration_Limits_State -
-
- ADMX_tcpip/ISATAP_Router_Name -
-
- ADMX_tcpip/ISATAP_State -
-
- ADMX_tcpip/Teredo_Client_Port -
-
- ADMX_tcpip/Teredo_Default_Qualified -
-
- ADMX_tcpip/Teredo_Refresh_Rate -
-
- ADMX_tcpip/Teredo_Server_Name -
-
- ADMX_tcpip/Teredo_State -
-
- ADMX_tcpip/Windows_Scaling_Heuristics_State -
-
- -### ADMX_TerminalServer policies - -
-
- ADMX_TerminalServer/TS_AUTO_RECONNECT -
-
- ADMX_TerminalServer/TS_CAMERA_REDIRECTION -
-
- ADMX_TerminalServer/TS_CERTIFICATE_TEMPLATE_POLICY -
-
- ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_1 -
-
- ADMX_TerminalServer/TS_CLIENT_ALLOW_SIGNED_FILES_2 -
-
- ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_1 -
-
- ADMX_TerminalServer/TS_CLIENT_ALLOW_UNSIGNED_FILES_2 -
-
- ADMX_TerminalServer/TS_CLIENT_AUDIO -
-
- ADMX_TerminalServer/TS_CLIENT_AUDIO_CAPTURE -
-
- ADMX_TerminalServer/TS_CLIENT_AUDIO_QUALITY -
-
- ADMX_TerminalServer/TS_CLIENT_CLIPBOARD -
-
- ADMX_TerminalServer/TS_CLIENT_COM -
-
- ADMX_TerminalServer/TS_CLIENT_DEFAULT_M -
-
- ADMX_TerminalServer/TS_CLIENT_DISABLE_HARDWARE_MODE -
-
- ADMX_TerminalServer/TS_CLIENT_DISABLE_PASSWORD_SAVING_1 -
-
- ADMX_TerminalServer/TS_CLIENT_LPT -
-
- ADMX_TerminalServer/TS_CLIENT_PNP -
-
- ADMX_TerminalServer/TS_CLIENT_PRINTER -
-
- ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_1 -
-
- ADMX_TerminalServer/TS_CLIENT_TRUSTED_CERTIFICATE_THUMBPRINTS_2 -
-
- ADMX_TerminalServer/TS_CLIENT_TURN_OFF_UDP -
-
- ADMX_TerminalServer/TS_COLORDEPTH -
-
- ADMX_TerminalServer/TS_DELETE_ROAMING_USER_PROFILES -
-
- ADMX_TerminalServer/TS_DISABLE_REMOTE_DESKTOP_WALLPAPER -
-
- ADMX_TerminalServer/TS_DX_USE_FULL_HWGPU -
-
- ADMX_TerminalServer/TS_EASY_PRINT -
-
- ADMX_TerminalServer/TS_EASY_PRINT_User -
-
- ADMX_TerminalServer/TS_EnableVirtualGraphics -
-
- ADMX_TerminalServer/TS_FALLBACKPRINTDRIVERTYPE -
-
- ADMX_TerminalServer/TS_FORCIBLE_LOGOFF -
-
- ADMX_TerminalServer/TS_GATEWAY_POLICY_ENABLE -
-
- ADMX_TerminalServer/TS_GATEWAY_POLICY_AUTH_METHOD -
-
- ADMX_TerminalServer/TS_GATEWAY_POLICY_SERVER -
-
- ADMX_TerminalServer/TS_JOIN_SESSION_DIRECTORY -
-
- ADMX_TerminalServer/TS_KEEP_ALIVE -
-
- ADMX_TerminalServer/TS_LICENSE_SECGROUP -
-
- ADMX_TerminalServer/TS_LICENSE_SERVERS -
-
- ADMX_TerminalServer/TS_LICENSE_TOOLTIP -
-
- ADMX_TerminalServer/TS_LICENSING_MODE -
-
- ADMX_TerminalServer/TS_MAX_CON_POLICY -
-
- ADMX_TerminalServer/TS_MAXDISPLAYRES -
-
- ADMX_TerminalServer/TS_MAXMONITOR -
-
- ADMX_TerminalServer/TS_NoDisconnectMenu -
-
- ADMX_TerminalServer/TS_NoSecurityMenu -
-
- ADMX_TerminalServer/TS_PreventLicenseUpgrade -
-
- ADMX_TerminalServer/TS_PROMT_CREDS_CLIENT_COMP -
-
- ADMX_TerminalServer/TS_RADC_DefaultConnection -
-
- ADMX_TerminalServer/TS_RDSAppX_WaitForRegistration -
-
- ADMX_TerminalServer/TS_RemoteControl_1 -
-
- ADMX_TerminalServer/TS_RemoteControl_2 -
-
- ADMX_TerminalServer/TS_RemoteDesktopVirtualGraphics -
-
- ADMX_TerminalServer/TS_SD_ClustName -
-
- ADMX_TerminalServer/TS_SD_EXPOSE_ADDRESS -
-
- ADMX_TerminalServer/TS_SD_Loc -
-
- ADMX_TerminalServer/TS_SECURITY_LAYER_POLICY -
-
- ADMX_TerminalServer/TS_SELECT_NETWORK_DETECT -
-
- ADMX_TerminalServer/TS_SELECT_TRANSPORT -
-
- ADMX_TerminalServer/TS_SERVER_ADVANCED_REMOTEFX_REMOTEAPP -
-
- ADMX_TerminalServer/TS_SERVER_AUTH -
-
- ADMX_TerminalServer/TS_SERVER_AVC_HW_ENCODE_PREFERRED -
-
- ADMX_TerminalServer/TS_SERVER_AVC444_MODE_PREFERRED -
-
- ADMX_TerminalServer/TS_SERVER_COMPRESSOR -
-
- ADMX_TerminalServer/TS_SERVER_IMAGE_QUALITY -
-
- ADMX_TerminalServer/TS_SERVER_LEGACY_RFX -
-
- ADMX_TerminalServer/TS_SERVER_PROFILE -
-
- ADMX_TerminalServer/TS_SERVER_VISEXP -
-
- ADMX_TerminalServer/TS_SERVER_WDDM_GRAPHICS_DRIVER -
-
- ADMX_TerminalServer/TS_Session_End_On_Limit_1 -
-
- ADMX_TerminalServer/TS_Session_End_On_Limit_2 -
-
- ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_1 -
-
- ADMX_TerminalServer/TS_SESSIONS_Disconnected_Timeout_2 -
- ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_1 - -
- ADMX_TerminalServer/TS_SESSIONS_Idle_Limit_2 -
-
- ADMX_TerminalServer/TS_SINGLE_SESSION -
-
- ADMX_TerminalServer/TS_SMART_CARD -
-
- ADMX_TerminalServer/TS_START_PROGRAM_1 -
-
- ADMX_TerminalServer/TS_START_PROGRAM_2 -
-
- ADMX_TerminalServer/TS_TEMP_DELETE -
-
- ADMX_TerminalServer/TS_TEMP_PER_SESSION -
-
- ADMX_TerminalServer/TS_TIME_ZONE -
-
- ADMX_TerminalServer/TS_TSCC_PERMISSIONS_POLICY -
-
- ADMX_TerminalServer/TS_TURNOFF_SINGLEAPP -
-
- ADMX_TerminalServer/TS_UIA -
-
- ADMX_TerminalServer/TS_USB_REDIRECTION_DISABLE -
-
- ADMX_TerminalServer/TS_USER_AUTHENTICATION_POLICY -
-
- ADMX_TerminalServer/TS_USER_HOME -
-
- ADMX_TerminalServer/TS_USER_MANDATORY_PROFILES -
-
- ADMX_TerminalServer/TS_USER_PROFILES -
-
- -### ADMX_Thumbnails policies - -
-
- ADMX_Thumbnails/DisableThumbnails -
-
- ADMX_Thumbnails/DisableThumbnailsOnNetworkFolders -
-
- ADMX_Thumbnails/DisableThumbsDBOnNetworkFolders -
-
- -### ADMX_TouchInput policies - -
-
- ADMX_TouchInput/TouchInputOff_1 -
-
- ADMX_TouchInput/TouchInputOff_2 -
-
- ADMX_TouchInput/PanningEverywhereOff_1 -
-
- ADMX_TouchInput/PanningEverywhereOff_2 -
-
- -### ADMX_TPM policies - -
-
- ADMX_TPM/BlockedCommandsList_Name -
-
- ADMX_TPM/ClearTPMIfNotReady_Name -
-
- ADMX_TPM/IgnoreDefaultList_Name -
-
- ADMX_TPM/IgnoreLocalList_Name -
-
- ADMX_TPM/OSManagedAuth_Name -
-
- ADMX_TPM/OptIntoDSHA_Name -
-
- ADMX_TPM/StandardUserAuthorizationFailureDuration_Name -
-
- ADMX_TPM/StandardUserAuthorizationFailureIndividualThreshold_Name -
-
- ADMX_TPM/StandardUserAuthorizationFailureTotalThreshold_Name -
-
- ADMX_TPM/UseLegacyDAP_Name -
-
- -### ADMX_UserExperienceVirtualization policies - -
-
- ADMX_UserExperienceVirtualization/Calculator -
-
- ADMX_UserExperienceVirtualization/ConfigureSyncMethod -
-
- ADMX_UserExperienceVirtualization/ConfigureVdi -
-
- ADMX_UserExperienceVirtualization/ContactITDescription -
-
- ADMX_UserExperienceVirtualization/ContactITUrl -
-
- ADMX_UserExperienceVirtualization/DisableWin8Sync -
-
- ADMX_UserExperienceVirtualization/DisableWindowsOSSettings -
-
- ADMX_UserExperienceVirtualization/EnableUEV -
-
- ADMX_UserExperienceVirtualization/Finance -
-
- ADMX_UserExperienceVirtualization/FirstUseNotificationEnabled -
-
- ADMX_UserExperienceVirtualization/Games -
-
- ADMX_UserExperienceVirtualization/InternetExplorer8 -
-
- ADMX_UserExperienceVirtualization/InternetExplorer9 -
-
- ADMX_UserExperienceVirtualization/InternetExplorer10 -
-
- ADMX_UserExperienceVirtualization/InternetExplorer11 -
-
- ADMX_UserExperienceVirtualization/InternetExplorerCommon -
-
- ADMX_UserExperienceVirtualization/Maps -
-
- ADMX_UserExperienceVirtualization/MaxPackageSizeInBytes -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Access -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Common -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Excel -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010InfoPath -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Lync -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010OneNote -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Outlook -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010PowerPoint -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Project -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Publisher -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointDesigner -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010SharePointWorkspace -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Visio -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2010Word -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Access -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013AccessBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Common -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013CommonBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Excel -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013ExcelBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPath -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013InfoPathBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Lync -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013LyncBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneDriveForBusiness -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNote -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013OneNoteBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Outlook -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013OutlookBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPoint -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013PowerPointBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Project -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013ProjectBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Publisher -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013PublisherBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesigner -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013SharePointDesignerBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013UploadCenter -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Visio -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013VisioBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013Word -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2013WordBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Access -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016AccessBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Common -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016CommonBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Excel -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016ExcelBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Lync -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016LyncBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneDriveForBusiness -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNote -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016OneNoteBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Outlook -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016OutlookBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPoint -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016PowerPointBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Project -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016ProjectBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Publisher -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016PublisherBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016UploadCenter -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Visio -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016VisioBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016Word -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice2016WordBackup -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Access2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Common2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Excel2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365InfoPath2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Lync2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365OneNote2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Outlook2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365PowerPoint2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Project2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Publisher2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365SharePointDesigner2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Visio2016 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2013 -
-
- ADMX_UserExperienceVirtualization/MicrosoftOffice365Word2016 -
-
- ADMX_UserExperienceVirtualization/Music -
-
- ADMX_UserExperienceVirtualization/News -
-
- ADMX_UserExperienceVirtualization/Notepad -
-
- ADMX_UserExperienceVirtualization/Reader -
-
- ADMX_UserExperienceVirtualization/RepositoryTimeout -
-
- ADMX_UserExperienceVirtualization/SettingsStoragePath -
-
- ADMX_UserExperienceVirtualization/SettingsTemplateCatalogPath -
-
- ADMX_UserExperienceVirtualization/Sports -
-
- ADMX_UserExperienceVirtualization/SyncEnabled -
-
- ADMX_UserExperienceVirtualization/SyncOverMeteredNetwork -
-
- ADMX_UserExperienceVirtualization/SyncOverMeteredNetworkWhenRoaming -
-
- ADMX_UserExperienceVirtualization/SyncProviderPingEnabled -
-
- ADMX_UserExperienceVirtualization/SyncUnlistedWindows8Apps -
-
- ADMX_UserExperienceVirtualization/Travel -
-
- ADMX_UserExperienceVirtualization/TrayIconEnabled -
-
- ADMX_UserExperienceVirtualization/Video -
-
- ADMX_UserExperienceVirtualization/Weather -
-
- ADMX_UserExperienceVirtualization/Wordpad -
-
- -### ADMX_UserProfiles policies - -
-
- ADMX_UserProfiles/CleanupProfiles -
-
- ADMX_UserProfiles/DontForceUnloadHive -
-
- ADMX_UserProfiles/LeaveAppMgmtData -
-
- ADMX_UserProfiles/LimitSize -
-
- ADMX_UserProfiles/ProfileErrorAction -
-
- ADMX_UserProfiles/SlowLinkTimeOut -
-
- ADMX_UserProfiles/USER_HOME -
-
- ADMX_UserProfiles/UserInfoAccessAction -
-
- -### ADMX_W32Time policies - -
-
- ADMX_W32Time/W32TIME_POLICY_CONFIG -
-
- ADMX_W32Time/W32TIME_POLICY_CONFIGURE_NTPCLIENT -
-
- ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPCLIENT -
-
- ADMX_W32Time/W32TIME_POLICY_ENABLE_NTPSERVER -
-
- -### ADMX_WCM policies - -
-
- ADMX_WCM/WCM_DisablePowerManagement -
-
- ADMX_WCM/WCM_EnableSoftDisconnect -
-
- ADMX_WCM/WCM_MinimizeConnections -
-
- -### ADMX_WDI Policies - -
-
- ADMX_WDI/WdiDpsScenarioExecutionPolicy -
-
- ADMX_WDI/WdiDpsScenarioDataSizeLimitPolicy -
-
- -### ADMX_WinCal policies - -
-
- ADMX_WinCal/TurnOffWinCal_1 -
-
- ADMX_WinCal/TurnOffWinCal_2 -
-
- -### ADMX_WindowsConnectNow policies - -
-
- ADMX_WindowsConnectNow/WCN_DisableWcnUi_1 -
-
- ADMX_WindowsConnectNow/WCN_DisableWcnUi_2 -
-
- ADMX_WindowsConnectNow/WCN_EnableRegistrar -
-
- - -### ADMX_WindowsExplorer policies - -
-
- ADMX_WindowsExplorer/CheckSameSourceAndTargetForFRAndDFS -
-
- ADMX_WindowsExplorer/ClassicShell -
-
- ADMX_WindowsExplorer/ConfirmFileDelete -
-
- ADMX_WindowsExplorer/DefaultLibrariesLocation -
-
- ADMX_WindowsExplorer/DisableBindDirectlyToPropertySetStorage -
-
- ADMX_WindowsExplorer/DisableIndexedLibraryExperience -
-
- ADMX_WindowsExplorer/DisableKnownFolders -
-
- ADMX_WindowsExplorer/DisableSearchBoxSuggestions -
-
- ADMX_WindowsExplorer/EnableShellShortcutIconRemotePath -
-
- ADMX_WindowsExplorer/EnableSmartScreen -
-
- ADMX_WindowsExplorer/EnforceShellExtensionSecurity -
-
- ADMX_WindowsExplorer/ExplorerRibbonStartsMinimized -
-
- ADMX_WindowsExplorer/HideContentViewModeSnippets -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Internet -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_InternetLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Intranet -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_IntranetLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachine -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_LocalMachineLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Restricted -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_RestrictedLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_Trusted -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchPreview_TrustedLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Internet -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_InternetLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Intranet -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_IntranetLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachine -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_LocalMachineLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Restricted -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_RestrictedLockdown -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_Trusted -
-
- ADMX_WindowsExplorer/IZ_Policy_OpenSearchQuery_TrustedLockdown -
-
- ADMX_WindowsExplorer/LinkResolveIgnoreLinkInfo -
-
- ADMX_WindowsExplorer/MaxRecentDocs -
-
- ADMX_WindowsExplorer/NoBackButton -
-
- ADMX_WindowsExplorer/NoCDBurning -
-
- ADMX_WindowsExplorer/NoCacheThumbNailPictures -
-
- ADMX_WindowsExplorer/NoChangeAnimation -
-
- ADMX_WindowsExplorer/NoChangeKeyboardNavigationIndicators -
-
- ADMX_WindowsExplorer/NoDFSTab -
-
- ADMX_WindowsExplorer/NoDrives -
-
- ADMX_WindowsExplorer/NoEntireNetwork -
-
- ADMX_WindowsExplorer/NoFileMRU -
-
- ADMX_WindowsExplorer/NoFileMenu -
-
- ADMX_WindowsExplorer/NoFolderOptions -
-
- ADMX_WindowsExplorer/NoHardwareTab -
-
- ADMX_WindowsExplorer/NoManageMyComputerVerb -
-
- ADMX_WindowsExplorer/NoMyComputerSharedDocuments -
-
- ADMX_WindowsExplorer/NoNetConnectDisconnect -
-
- ADMX_WindowsExplorer/NoNewAppAlert -
-
- ADMX_WindowsExplorer/NoPlacesBar -
-
- ADMX_WindowsExplorer/NoRecycleFiles -
-
- ADMX_WindowsExplorer/NoRunAsInstallPrompt -
-
- ADMX_WindowsExplorer/NoSearchInternetTryHarderButton -
-
- ADMX_WindowsExplorer/NoSecurityTab -
-
- ADMX_WindowsExplorer/NoShellSearchButton -
-
- ADMX_WindowsExplorer/NoStrCmpLogical -
-
- ADMX_WindowsExplorer/NoViewContextMenu -
-
- ADMX_WindowsExplorer/NoViewOnDrive -
-
- ADMX_WindowsExplorer/NoWindowsHotKeys -
-
- ADMX_WindowsExplorer/NoWorkgroupContents -
-
- ADMX_WindowsExplorer/PlacesBar -
-
- ADMX_WindowsExplorer/PromptRunasInstallNetPath -
-
- ADMX_WindowsExplorer/RecycleBinSize -
-
- ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_1 -
-
- ADMX_WindowsExplorer/ShellProtocolProtectedModeTitle_2 -
-
- ADMX_WindowsExplorer/ShowHibernateOption -
-
- ADMX_WindowsExplorer/ShowSleepOption -
-
- ADMX_WindowsExplorer/TryHarderPinnedLibrary -
-
- ADMX_WindowsExplorer/TryHarderPinnedOpenSearch -
-
- -### ADMX_WindowsMediaDRM policies - -
-
- ADMX_WindowsMediaDRM/DisableOnline -
-
- -### ADMX_WindowsMediaPlayer policies - -
-
- ADMX_WindowsMediaPlayer/ConfigureHTTPProxySettings -
-
- ADMX_WindowsMediaPlayer/ConfigureMMSProxySettings -
-
- ADMX_WindowsMediaPlayer/ConfigureRTSPProxySettings -
-
- ADMX_WindowsMediaPlayer/DisableAutoUpdate -
-
- ADMX_WindowsMediaPlayer/DisableNetworkSettings -
-
- ADMX_WindowsMediaPlayer/DisableSetupFirstUseConfiguration -
-
- ADMX_WindowsMediaPlayer/DoNotShowAnchor -
-
- ADMX_WindowsMediaPlayer/DontUseFrameInterpolation -
-
- ADMX_WindowsMediaPlayer/EnableScreenSaver -
-
- ADMX_WindowsMediaPlayer/HidePrivacyTab -
-
- ADMX_WindowsMediaPlayer/HideSecurityTab -
-
- ADMX_WindowsMediaPlayer/NetworkBuffering -
-
- ADMX_WindowsMediaPlayer/PolicyCodecUpdate -
-
- ADMX_WindowsMediaPlayer/PreventCDDVDMetadataRetrieval -
-
- ADMX_WindowsMediaPlayer/PreventLibrarySharing -
-
- ADMX_WindowsMediaPlayer/PreventMusicFileMetadataRetrieval -
-
- ADMX_WindowsMediaPlayer/PreventQuickLaunchShortcut -
-
- ADMX_WindowsMediaPlayer/PreventRadioPresetsRetrieval -
-
- ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut -
-
- ADMX_WindowsMediaPlayer/SkinLockDown -
-
- ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols -
-
- - -### ADMX_WindowsRemoteManagement policies - -
-
- ADMX_WindowsRemoteManagement/DisallowKerberos_1 -
-
- ADMX_WindowsRemoteManagement/DisallowKerberos_2 -
-
- -### ADMX_WindowsStore policies - -
-
- ADMX_WindowsStore/DisableAutoDownloadWin8 -
-
- ADMX_WindowsStore/DisableOSUpgrade_1 -
-
- ADMX_WindowsStore/DisableOSUpgrade_2 -
-
- ADMX_WindowsStore/RemoveWindowsStore_1 -
-
- ADMX_WindowsStore/RemoveWindowsStore_2 -
-
- -### ADMX_WinInit policies - -
-
- ADMX_WinInit/DisableNamedPipeShutdownPolicyDescription -
-
- ADMX_WinInit/Hiberboot -
-
- ADMX_WinInit/ShutdownTimeoutHungSessionsDescription -
-
- -### ADMX_WinLogon policies - -
-
- ADMX_WinLogon/CustomShell -
-
- ADMX_WinLogon/DisplayLastLogonInfoDescription -
-
- ADMX_WinLogon/LogonHoursNotificationPolicyDescription -
-
- ADMX_WinLogon/LogonHoursPolicyDescription -
-
- ADMX_WinLogon/ReportCachedLogonPolicyDescription -
-
- ADMX_WinLogon/SoftwareSASGeneration -
-
- -### ADMX_Winsrv policies - -
-
- ADMX_Winsrv/AllowBlockingAppsAtShutdown -
-
- -### ADMX_wlansvc policies - -
-
- ADMX_wlansvc/SetCost -
-
- ADMX_wlansvc/SetPINEnforced -
-
- ADMX_wlansvc/SetPINPreferred -
-
- -### ADMX_WordWheel policies - -
-
- ADMX_WordWheel/CustomSearch -
-
- -### ADMX_WorkFoldersClient policies - -
-
- ADMX_WorkFoldersClient/Pol_UserEnableTokenBroker -
-
- ADMX_WorkFoldersClient/Pol_UserEnableWorkFolders -
-
- ADMX_WorkFoldersClient/Pol_MachineEnableWorkFolders -
-
- -### ADMX_WPN policies - -
-
- ADMX_WPN/NoCallsDuringQuietHours -
-
- ADMX_WPN/NoLockScreenToastNotification -
-
- ADMX_WPN/NoQuietHours -
-
- ADMX_WPN/NoToastNotification -
-
- ADMX_WPN/QuietHoursDailyBeginMinute -
-
- ADMX_WPN/QuietHoursDailyEndMinute -
-
- -### ApplicationDefaults policies - -
-
- ApplicationDefaults/DefaultAssociationsConfiguration -
-
- ApplicationDefaults/EnableAppUriHandlers -
-
- -### ApplicationManagement policies - -
-
- ApplicationManagement/AllowAllTrustedApps -
-
- ApplicationManagement/AllowAppStoreAutoUpdate -
-
- ApplicationManagement/AllowDeveloperUnlock -
-
- ApplicationManagement/AllowGameDVR -
-
- ApplicationManagement/AllowSharedUserAppData -
-
- ApplicationManagement/BlockNonAdminUserInstall -
-
- ApplicationManagement/DisableStoreOriginatedApps -
-
- ApplicationManagement/LaunchAppAfterLogOn -
-
- ApplicationManagement/MSIAllowUserControlOverInstall -
-
- ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges -
-
- ApplicationManagement/RequirePrivateStoreOnly -
-
- ApplicationManagement/RestrictAppDataToSystemVolume -
-
- ApplicationManagement/RestrictAppToSystemVolume -
-
- ApplicationManagement/ScheduleForceRestartForUpdateFailures -
-
- -### AppRuntime policies - -
-
- AppRuntime/AllowMicrosoftAccountsToBeOptional -
-
- -### AppVirtualization policies - -
-
- AppVirtualization/AllowAppVClient -
-
- AppVirtualization/AllowDynamicVirtualization -
-
- AppVirtualization/AllowPackageCleanup -
-
- AppVirtualization/AllowPackageScripts -
-
- AppVirtualization/AllowPublishingRefreshUX -
-
- AppVirtualization/AllowReportingServer -
-
- AppVirtualization/AllowRoamingFileExclusions -
-
- AppVirtualization/AllowRoamingRegistryExclusions -
-
- AppVirtualization/AllowStreamingAutoload -
-
- AppVirtualization/ClientCoexistenceAllowMigrationmode -
-
- AppVirtualization/IntegrationAllowRootGlobal -
-
- AppVirtualization/IntegrationAllowRootUser -
-
- AppVirtualization/PublishingAllowServer1 -
-
- AppVirtualization/PublishingAllowServer2 -
-
- AppVirtualization/PublishingAllowServer3 -
-
- AppVirtualization/PublishingAllowServer4 -
-
- AppVirtualization/PublishingAllowServer5 -
-
- AppVirtualization/StreamingAllowCertificateFilterForClient_SSL -
-
- AppVirtualization/StreamingAllowHighCostLaunch -
-
- AppVirtualization/StreamingAllowLocationProvider -
-
- AppVirtualization/StreamingAllowPackageInstallationRoot -
-
- AppVirtualization/StreamingAllowPackageSourceRoot -
-
- AppVirtualization/StreamingAllowReestablishmentInterval -
-
- AppVirtualization/StreamingAllowReestablishmentRetries -
-
- AppVirtualization/StreamingSharedContentStoreMode -
-
- AppVirtualization/StreamingSupportBranchCache -
-
- AppVirtualization/StreamingVerifyCertificateRevocationList -
-
- AppVirtualization/VirtualComponentsAllowList -
-
- -### AttachmentManager policies - -
-
- AttachmentManager/DoNotPreserveZoneInformation -
-
- AttachmentManager/HideZoneInfoMechanism -
-
- AttachmentManager/NotifyAntivirusPrograms -
-
- -### Audit policies - -
-
- Audit/AccountLogonLogoff_AuditAccountLockout -
-
- Audit/AccountLogonLogoff_AuditGroupMembership -
-
- Audit/AccountLogonLogoff_AuditIPsecExtendedMode -
-
- Audit/AccountLogonLogoff_AuditIPsecMainMode -
-
- Audit/AccountLogonLogoff_AuditIPsecQuickMode -
-
- Audit/AccountLogonLogoff_AuditLogoff -
-
- Audit/AccountLogonLogoff_AuditLogon -
-
- Audit/AccountLogonLogoff_AuditNetworkPolicyServer -
-
- Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents -
-
- Audit/AccountLogonLogoff_AuditSpecialLogon -
-
- Audit/AccountLogonLogoff_AuditUserDeviceClaims -
-
- Audit/AccountLogon_AuditCredentialValidation -
-
- Audit/AccountLogon_AuditKerberosAuthenticationService -
-
- Audit/AccountLogon_AuditKerberosServiceTicketOperations -
-
- Audit/AccountLogon_AuditOtherAccountLogonEvents -
-
- Audit/AccountManagement_AuditApplicationGroupManagement -
-
- Audit/AccountManagement_AuditComputerAccountManagement -
-
- Audit/AccountManagement_AuditDistributionGroupManagement -
-
- Audit/AccountManagement_AuditOtherAccountManagementEvents -
-
- Audit/AccountManagement_AuditSecurityGroupManagement -
-
- Audit/AccountManagement_AuditUserAccountManagement -
-
- Audit/DSAccess_AuditDetailedDirectoryServiceReplication -
-
- Audit/DSAccess_AuditDirectoryServiceAccess -
-
- Audit/DSAccess_AuditDirectoryServiceChanges -
-
- Audit/DSAccess_AuditDirectoryServiceReplication -
-
- Audit/DetailedTracking_AuditDPAPIActivity -
-
- Audit/DetailedTracking_AuditPNPActivity -
-
- Audit/DetailedTracking_AuditProcessCreation -
-
- Audit/DetailedTracking_AuditProcessTermination -
-
- Audit/DetailedTracking_AuditRPCEvents -
-
- Audit/DetailedTracking_AuditTokenRightAdjusted -
-
- Audit/ObjectAccess_AuditApplicationGenerated -
-
- Audit/ObjectAccess_AuditCentralAccessPolicyStaging -
-
- Audit/ObjectAccess_AuditCertificationServices -
-
- Audit/ObjectAccess_AuditDetailedFileShare -
-
- Audit/ObjectAccess_AuditFileShare -
-
- Audit/ObjectAccess_AuditFileSystem -
-
- Audit/ObjectAccess_AuditFilteringPlatformConnection -
-
- Audit/ObjectAccess_AuditFilteringPlatformPacketDrop -
-
- Audit/ObjectAccess_AuditHandleManipulation -
-
- Audit/ObjectAccess_AuditKernelObject -
-
- Audit/ObjectAccess_AuditOtherObjectAccessEvents -
-
- Audit/ObjectAccess_AuditRegistry -
-
- Audit/ObjectAccess_AuditRemovableStorage -
-
- Audit/ObjectAccess_AuditSAM -
-
- Audit/PolicyChange_AuditAuthenticationPolicyChange -
-
- Audit/PolicyChange_AuditAuthorizationPolicyChange -
-
- Audit/PolicyChange_AuditFilteringPlatformPolicyChange -
-
- Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange -
-
- Audit/PolicyChange_AuditOtherPolicyChangeEvents -
-
- Audit/PolicyChange_AuditPolicyChange -
-
- Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse -
-
- Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents -
-
- Audit/PrivilegeUse_AuditSensitivePrivilegeUse -
-
- Audit/System_AuditIPsecDriver -
-
- Audit/System_AuditOtherSystemEvents -
-
- Audit/System_AuditSecurityStateChange -
-
- Audit/System_AuditSecuritySystemExtension -
-
- Audit/System_AuditSystemIntegrity -
-
- -### Authentication policies - -
-
- Authentication/AllowAadPasswordReset -
-
- Authentication/AllowEAPCertSSO -
-
- Authentication/AllowFastReconnect -
-
- Authentication/AllowFidoDeviceSignon -
-
- Authentication/AllowSecondaryAuthenticationDevice -
-
- Authentication/EnableFastFirstSignIn (Preview mode only) -
-
- Authentication/EnableWebSignIn (Preview mode only) -
-
- Authentication/PreferredAadTenantDomainName -
-
- -### Autoplay policies - -
-
- Autoplay/DisallowAutoplayForNonVolumeDevices -
-
- Autoplay/SetDefaultAutoRunBehavior -
-
- Autoplay/TurnOffAutoPlay -
-
- -### BitLocker policies - -
-
- BitLocker/EncryptionMethod -
-
- -### BITS policies - -
-
- BITS/BandwidthThrottlingEndTime -
-
- BITS/BandwidthThrottlingStartTime -
-
- BITS/BandwidthThrottlingTransferRate -
-
- BITS/CostedNetworkBehaviorBackgroundPriority -
-
- BITS/CostedNetworkBehaviorForegroundPriority -
-
- BITS/JobInactivityTimeout -
-
- -### Bluetooth policies - -
-
- Bluetooth/AllowAdvertising -
-
- Bluetooth/AllowDiscoverableMode -
-
- Bluetooth/AllowPrepairing -
-
- Bluetooth/AllowPromptedProximalConnections -
-
- Bluetooth/LocalDeviceName -
-
- Bluetooth/ServicesAllowedList -
-
- Bluetooth/SetMinimumEncryptionKeySize -
-
- -### Browser policies - -
-
- Browser/AllowAddressBarDropdown -
-
- Browser/AllowAutofill -
-
- Browser/AllowConfigurationUpdateForBooksLibrary -
-
- Browser/AllowCookies -
-
- Browser/AllowDeveloperTools -
-
- Browser/AllowDoNotTrack -
-
- Browser/AllowExtensions -
-
- Browser/AllowFlash -
-
- Browser/AllowFlashClickToRun -
-
- Browser/AllowFullScreenMode -
-
- Browser/AllowInPrivate -
-
- Browser/AllowMicrosoftCompatibilityList -
-
- Browser/AllowPasswordManager -
-
- Browser/AllowPopups -
-
- Browser/AllowPrelaunch -
-
- Browser/AllowPrinting -
-
- Browser/AllowSavingHistory -
-
- Browser/AllowSearchEngineCustomization -
-
- Browser/AllowSearchSuggestionsinAddressBar -
-
- Browser/AllowSideloadingOfExtensions -
-
- Browser/AllowSmartScreen -
-
- Browser/AllowTabPreloading -
-
- Browser/AllowWebContentOnNewTabPage -
-
- Browser/AlwaysEnableBooksLibrary -
-
- Browser/ClearBrowsingDataOnExit -
-
- Browser/ConfigureAdditionalSearchEngines -
-
- Browser/ConfigureFavoritesBar -
-
- Browser/ConfigureHomeButton -
-
- Browser/ConfigureKioskMode -
-
- Browser/ConfigureKioskResetAfterIdleTimeout -
-
- Browser/ConfigureOpenMicrosoftEdgeWith -
-
- Browser/ConfigureTelemetryForMicrosoft365Analytics -
-
- Browser/DisableLockdownOfStartPages -
-
- Browser/EnableExtendedBooksTelemetry -
-
- Browser/EnterpriseModeSiteList -
-
- Browser/EnterpriseSiteListServiceUrl -
-
- Browser/HomePages -
-
- Browser/LockdownFavorites -
-
- Browser/PreventAccessToAboutFlagsInMicrosoftEdge -
-
- Browser/PreventCertErrorOverrides -
-
- Browser/PreventFirstRunPage -
-
- Browser/PreventLiveTileDataCollection -
-
- Browser/PreventSmartScreenPromptOverride -
-
- Browser/PreventSmartScreenPromptOverrideForFiles -
-
- Browser/PreventUsingLocalHostIPAddressForWebRTC -
-
- Browser/ProvisionFavorites -
-
- Browser/SendIntranetTraffictoInternetExplorer -
-
- Browser/SetDefaultSearchEngine -
-
- Browser/SetHomeButtonURL -
-
- Browser/SetNewTabPageURL -
-
- Browser/ShowMessageWhenOpeningSitesInInternetExplorer -
-
- Browser/SyncFavoritesBetweenIEAndMicrosoftEdge -
-
- Browser/UnlockHomeButton -
-
- Browser/UseSharedFolderForBooks -
-
- -### Camera policies - -
-
- Camera/AllowCamera -
-
- -### Cellular policies - -
-
- Cellular/LetAppsAccessCellularData -
-
- Cellular/LetAppsAccessCellularData_ForceAllowTheseApps -
-
- Cellular/LetAppsAccessCellularData_ForceDenyTheseApps -
-
- Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps -
-
- Cellular/ShowAppCellularAccessUI -
-
- -### Connectivity policies - -
-
- Connectivity/AllowBluetooth -
-
- Connectivity/AllowCellularData -
-
- Connectivity/AllowCellularDataRoaming -
-
- Connectivity/AllowConnectedDevices -
-
- Connectivity/AllowPhonePCLinking -
-
- Connectivity/AllowUSBConnection -
-
- Connectivity/AllowVPNOverCellular -
-
- Connectivity/AllowVPNRoamingOverCellular -
-
- Connectivity/DiablePrintingOverHTTP -
-
- Connectivity/DisableDownloadingOfPrintDriversOverHTTP -
-
- Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards -
-
- Connectivity/DisallowNetworkConnectivityActiveTests -
-
- Connectivity/HardenedUNCPaths -
-
- Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge -
-
- -### ControlPolicyConflict policies - -
-
- ControlPolicyConflict/MDMWinsOverGP -
-
- -### CredentialProviders policies - -
-
- CredentialProviders/AllowPINLogon -
-
- CredentialProviders/BlockPicturePassword -
-
- CredentialProviders/DisableAutomaticReDeploymentCredentials -
-
- -### CredentialsDelegation policies - -
-
- CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials -
-
- -### CredentialsUI policies - -
-
- CredentialsUI/DisablePasswordReveal -
-
- CredentialsUI/EnumerateAdministrators -
-
- -### Cryptography policies - -
-
- Cryptography/AllowFipsAlgorithmPolicy -
-
- Cryptography/TLSCipherSuites -
-
- -### DataProtection policies - -
-
- DataProtection/AllowDirectMemoryAccess -
-
- DataProtection/LegacySelectiveWipeID -
-
- -### DataUsage policies - -
-
- DataUsage/SetCost3G -
-
- DataUsage/SetCost4G -
-
- -### Defender policies - -
-
- Defender/AllowArchiveScanning -
-
- Defender/AllowBehaviorMonitoring -
-
- Defender/AllowCloudProtection -
-
- Defender/AllowEmailScanning -
-
- Defender/AllowFullScanOnMappedNetworkDrives -
-
- Defender/AllowFullScanRemovableDriveScanning -
-
- Defender/AllowIOAVProtection -
-
- Defender/AllowOnAccessProtection -
-
- Defender/AllowRealtimeMonitoring -
-
- Defender/AllowScanningNetworkFiles -
-
- Defender/AllowScriptScanning -
-
- Defender/AllowUserUIAccess -
-
- Defender/AttackSurfaceReductionOnlyExclusions -
-
- Defender/AttackSurfaceReductionRules -
-
- Defender/AvgCPULoadFactor -
-
- Defender/CheckForSignaturesBeforeRunningScan -
-
- Defender/CloudBlockLevel -
-
- Defender/CloudExtendedTimeout -
-
- Defender/ControlledFolderAccessAllowedApplications -
-
- Defender/ControlledFolderAccessProtectedFolders -
-
- Defender/DaysToRetainCleanedMalware -
-
- Defender/DisableCatchupFullScan -
-
- Defender/DisableCatchupQuickScan -
-
- Defender/EnableControlledFolderAccess -
-
- Defender/EnableLowCPUPriority -
-
- Defender/EnableNetworkProtection -
-
- Defender/ExcludedExtensions -
-
- Defender/ExcludedPaths -
-
- Defender/ExcludedProcesses -
-
- Defender/PUAProtection -
-
- Defender/RealTimeScanDirection -
-
- Defender/ScanParameter -
-
- Defender/ScheduleQuickScanTime -
-
- Defender/ScheduleScanDay -
-
- Defender/ScheduleScanTime -
-
- Defender/SignatureUpdateFallbackOrder -
-
- Defender/SignatureUpdateFileSharesSources -
-
- Defender/SignatureUpdateInterval -
-
- Defender/SubmitSamplesConsent -
-
- Defender/ThreatSeverityDefaultAction -
-
- -### DeliveryOptimization policies - -
-
- DeliveryOptimization/DOAbsoluteMaxCacheSize -
-
- DeliveryOptimization/DOAllowVPNPeerCaching -
-
- DeliveryOptimization/DOCacheHost -
-
- DeliveryOptimization/DOCacheHostSource -
-
- DeliveryOptimization/DODelayBackgroundDownloadFromHttp -
-
- DeliveryOptimization/DODelayForegroundDownloadFromHttp -
-
- DeliveryOptimization/DODelayCacheServerFallbackBackground -
-
- DeliveryOptimization/DODelayCacheServerFallbackForeground -
-
- DeliveryOptimization/DODownloadMode -
-
- DeliveryOptimization/DOGroupId -
-
- DeliveryOptimization/DOGroupIdSource -
-
- DeliveryOptimization/DOMaxBackgroundDownloadBandwidth -
-
- DeliveryOptimization/DOMaxCacheAge -
-
- DeliveryOptimization/DOMaxCacheSize -
-
- DeliveryOptimization/DOMaxDownloadBandwidth (deprecated) -
-
- DeliveryOptimization/DOMaxForegroundDownloadBandwidth -
-
- DeliveryOptimization/DOMaxUploadBandwidth (deprecated) -
-
- DeliveryOptimization/DOMinBackgroundQos -
-
- DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload -
-
- DeliveryOptimization/DOMinDiskSizeAllowedToPeer -
-
- DeliveryOptimization/DOMinFileSizeToCache -
-
- DeliveryOptimization/DOMinRAMAllowedToPeer -
-
- DeliveryOptimization/DOModifyCacheDrive -
-
- DeliveryOptimization/DOMonthlyUploadDataCap -
-
- DeliveryOptimization/DOPercentageMaxBackgroundBandwidth -
-
- DeliveryOptimization/DOPercentageMaxDownloadBandwidth (deprecated) -
-
- DeliveryOptimization/DOPercentageMaxForegroundBandwidth -
-
- DeliveryOptimization/DORestrictPeerSelectionBy -
-
- DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth -
-
- DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth -
-
- -### Desktop policies - -
-
- Desktop/PreventUserRedirectionOfProfileFolders -
-
- -### DesktopAppInstaller policies -
-
- DesktopAppInstaller/EnableAdditionalSources -
-
- DesktopAppInstaller/EnableAppInstaller -
-
- DesktopAppInstaller/EnableDefaultSource -
-
- DesktopAppInstaller/EnableLocalManifestFiles -
-
- DesktopAppInstaller/EnableHashOverride -
-
- DesktopAppInstaller/EnableMicrosoftStoreSource -
-
- DesktopAppInstaller/EnableMSAppInstallerProtocol -
-
- DesktopAppInstaller/EnableSettings -
-
- DesktopAppInstaller/EnableAllowedSources -
-
- DesktopAppInstaller/EnableExperimentalFeatures -
-
- DesktopAppInstaller/SourceAutoUpdateInterval -
-
- -### DeviceGuard policies - -
-
- DeviceGuard/ConfigureSystemGuardLaunch -
-
- DeviceGuard/EnableVirtualizationBasedSecurity -
-
- DeviceGuard/LsaCfgFlags -
-
- DeviceGuard/RequirePlatformSecurityFeatures -
-
- -### DeviceHealthMonitoring policies - -
-
- DeviceHealthMonitoring/AllowDeviceHealthMonitoring -
-
- DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope -
-
- DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination -
-
- -### DeviceInstallation policies - -
-
- DeviceInstallation/AllowInstallationOfMatchingDeviceIDs -
-
- DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses -
-
- DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs -
-
- DeviceInstallation/PreventDeviceMetadataFromNetwork -
-
- DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings -
-
- DeviceInstallation/PreventInstallationOfMatchingDeviceIDs -
-
- DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs -
-
- DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses -
-
- -### DeviceLock policies - -
-
- DeviceLock/AllowIdleReturnWithoutPassword -
-
- DeviceLock/AllowSimpleDevicePassword -
-
- DeviceLock/AlphanumericDevicePasswordRequired -
-
- DeviceLock/DevicePasswordEnabled -
-
- DeviceLock/DevicePasswordExpiration -
-
- DeviceLock/DevicePasswordHistory -
-
- DeviceLock/EnforceLockScreenAndLogonImage -
-
- DeviceLock/MaxDevicePasswordFailedAttempts -
-
- DeviceLock/MaxInactivityTimeDeviceLock -
-
- DeviceLock/MinDevicePasswordComplexCharacters -
-
- DeviceLock/MinDevicePasswordLength -
-
- DeviceLock/MinimumPasswordAge -
-
- DeviceLock/PreventEnablingLockScreenCamera -
-
- DeviceLock/PreventLockScreenSlideShow -
-
- -### Display policies - -
-
- Display/DisablePerProcessDpiForApps -
-
- Display/EnablePerProcessDpi -
-
- Display/EnablePerProcessDpiForApps -
-
- Display/TurnOffGdiDPIScalingForApps -
-
- Display/TurnOnGdiDPIScalingForApps -
-
- -### DmaGuard policies - -
-
- DmaGuard/DeviceEnumerationPolicy -
-
- -### EAP policies - -
-
- EAP/AllowTLS1_3 -
-
- -### Education policies - -
-
- Education/AllowGraphingCalculator -
-
- Education/DefaultPrinterName -
-
- Education/PreventAddingNewPrinters -
-
- Education/PrinterNames -
-
- -### EnterpriseCloudPrint policies - -
-
- EnterpriseCloudPrint/CloudPrintOAuthAuthority -
-
- EnterpriseCloudPrint/CloudPrintOAuthClientId -
-
- EnterpriseCloudPrint/CloudPrintResourceId -
-
- EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint -
-
- EnterpriseCloudPrint/DiscoveryMaxPrinterLimit -
-
- EnterpriseCloudPrint/MopriaDiscoveryResourceId -
-
- -### ErrorReporting policies - -
-
- ErrorReporting/CustomizeConsentSettings -
-
- ErrorReporting/DisableWindowsErrorReporting -
-
- ErrorReporting/DisplayErrorNotification -
-
- ErrorReporting/DoNotSendAdditionalData -
-
- ErrorReporting/PreventCriticalErrorDisplay -
-
- -### EventLogService policies - -
-
- EventLogService/ControlEventLogBehavior -
-
- EventLogService/SpecifyMaximumFileSizeApplicationLog -
-
- EventLogService/SpecifyMaximumFileSizeSecurityLog -
-
- EventLogService/SpecifyMaximumFileSizeSystemLog -
-
- -### Experience policies - -
-
- Experience/AllowClipboardHistory -
-
- Experience/AllowCortana -
-
- Experience/AllowDeviceDiscovery -
-
- Experience/AllowFindMyDevice -
-
- Experience/AllowManualMDMUnenrollment -
-
- Experience/AllowSaveAsOfOfficeFiles -
-
- Experience/AllowSharingOfOfficeFiles -
-
- Experience/AllowSyncMySettings -
-
- Experience/AllowSpotlightCollection -
-
- Experience/AllowTailoredExperiencesWithDiagnosticData -
-
- Experience/AllowThirdPartySuggestionsInWindowsSpotlight -
-
- Experience/AllowWindowsConsumerFeatures -
-
- Experience/AllowWindowsSpotlight -
-
- Experience/AllowWindowsSpotlightOnActionCenter -
-
- Experience/AllowWindowsSpotlightOnSettings -
-
- Experience/AllowWindowsSpotlightWindowsWelcomeExperience -
-
- Experience/AllowWindowsTips -
-
- Experience/ConfigureWindowsSpotlightOnLockScreen -
-
- Experience/DisableCloudOptimizedContent -
-
- Experience/DoNotShowFeedbackNotifications -
-
- Experience/DoNotSyncBrowserSettings -
-
- Experience/PreventUsersFromTurningOnBrowserSyncing -
-
- Experience/ShowLockOnUserTile -
-
- -### ExploitGuard policies - -
-
- ExploitGuard/ExploitProtectionSettings -
-
- -### FederatedAuthentication policies - -
-
- FederatedAuthentication/EnableWebSignInForPrimaryUser -
-
- -### Feeds policies -
-
- Feeds/FeedsEnabled -
-
- -### FileExplorer policies - -
-
- FileExplorer/TurnOffDataExecutionPreventionForExplorer -
-
- FileExplorer/TurnOffHeapTerminationOnCorruption -
-
- -### Games policies - -
-
- Games/AllowAdvancedGamingServices -
-
- -### Handwriting policies - -
-
- Handwriting/PanelDefaultModeDocked -
-
- -### HumanPresence policies - -
-
- HumanPresence/ForceInstantLock -
-
- HumanPresence/ForceInstantWake -
-
- HumanPresence/ForceLockTimeout -
-
- -### InternetExplorer policies - -
-
- InternetExplorer/AddSearchProvider -
-
- InternetExplorer/AllowActiveXFiltering -
-
- InternetExplorer/AllowAddOnList -
-
- InternetExplorer/AllowAutoComplete -
-
- InternetExplorer/AllowCertificateAddressMismatchWarning -
-
- InternetExplorer/AllowDeletingBrowsingHistoryOnExit -
-
- InternetExplorer/AllowEnhancedProtectedMode -
-
- InternetExplorer/AllowEnhancedSuggestionsInAddressBar -
-
- InternetExplorer/AllowEnterpriseModeFromToolsMenu -
-
- InternetExplorer/AllowEnterpriseModeSiteList -
-
- InternetExplorer/AllowFallbackToSSL3 -
-
- InternetExplorer/AllowInternetExplorer7PolicyList -
-
- InternetExplorer/AllowInternetExplorerStandardsMode -
-
- InternetExplorer/AllowInternetZoneTemplate -
-
- InternetExplorer/AllowIntranetZoneTemplate -
-
- InternetExplorer/AllowLocalMachineZoneTemplate -
-
- InternetExplorer/AllowLockedDownInternetZoneTemplate -
-
- InternetExplorer/AllowLockedDownIntranetZoneTemplate -
-
- InternetExplorer/AllowLockedDownLocalMachineZoneTemplate -
-
- InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate -
-
- InternetExplorer/AllowOneWordEntry -
-
- InternetExplorer/AllowSiteToZoneAssignmentList -
-
- InternetExplorer/AllowSoftwareWhenSignatureIsInvalid -
-
- InternetExplorer/AllowSuggestedSites -
-
- InternetExplorer/AllowTrustedSitesZoneTemplate -
-
- InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate -
-
- InternetExplorer/AllowsRestrictedSitesZoneTemplate -
-
- InternetExplorer/CheckServerCertificateRevocation -
-
- InternetExplorer/CheckSignaturesOnDownloadedPrograms -
-
- InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses -
-
- InternetExplorer/DisableActiveXVersionListAutoDownload -

- InternetExplorer/DisableAdobeFlash -
-
- InternetExplorer/DisableBypassOfSmartScreenWarnings -
-
- InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles -
-
- InternetExplorer/DisableCompatView -
-
- InternetExplorer/DisableConfiguringHistory -
-
- InternetExplorer/DisableCrashDetection -
-
- InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation -
-
- InternetExplorer/DisableDeletingUserVisitedWebsites -
-
- InternetExplorer/DisableEnclosureDownloading -
-
- InternetExplorer/DisableEncryptionSupport -
-
- InternetExplorer/DisableFeedsBackgroundSync -
-
- InternetExplorer/DisableFirstRunWizard -
-
- InternetExplorer/DisableFlipAheadFeature -
-
- InternetExplorer/DisableGeolocation -
-
- InternetExplorer/DisableHomePageChange -
-
- InternetExplorer/DisableIgnoringCertificateErrors -
-
- InternetExplorer/DisableInPrivateBrowsing -
-
- InternetExplorer/DisableProcessesInEnhancedProtectedMode -
-
- InternetExplorer/DisableProxyChange -
-
- InternetExplorer/DisableSearchProviderChange -
-
- InternetExplorer/DisableSecondaryHomePageChange -
-
- InternetExplorer/DisableSecuritySettingsCheck -
-
- InternetExplorer/DisableUpdateCheck -
-
- InternetExplorer/DisableWebAddressAutoComplete -
-
- InternetExplorer/DoNotAllowActiveXControlsInProtectedMode -
-
- InternetExplorer/DoNotAllowUsersToAddSites -
-
- InternetExplorer/DoNotAllowUsersToChangePolicies -
-
- InternetExplorer/DoNotBlockOutdatedActiveXControls -
-
- InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains -
-
- InternetExplorer/IncludeAllLocalSites -
-
- InternetExplorer/IncludeAllNetworkPaths -
-
- InternetExplorer/InternetZoneAllowAccessToDataSources -
-
- InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/InternetZoneAllowCopyPasteViaScript -
-
- InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles -
-
- InternetExplorer/InternetZoneAllowFontDownloads -
-
- InternetExplorer/InternetZoneAllowLessPrivilegedSites -
-
- InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles -
-
- InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls -
-
- InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl -
-
- InternetExplorer/InternetZoneAllowScriptInitiatedWindows -
-
- InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls -
-
- InternetExplorer/InternetZoneAllowScriptlets -
-
- InternetExplorer/InternetZoneAllowSmartScreenIE -
-
- InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript -
-
- InternetExplorer/InternetZoneAllowUserDataPersistence -
-
- InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer -
-
- InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls -
-
- InternetExplorer/InternetZoneDownloadSignedActiveXControls -
-
- InternetExplorer/InternetZoneDownloadUnsignedActiveXControls -
-
- InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter -
-
- InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows -
-
- InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows -
-
- InternetExplorer/InternetZoneEnableMIMESniffing -
-
- InternetExplorer/InternetZoneEnableProtectedMode -
-
- InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer -
-
- InternetExplorer/InternetZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe -
-
- InternetExplorer/InternetZoneJavaPermissions -
-
- InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME -
-
- InternetExplorer/InternetZoneLogonOptions -
-
- InternetExplorer/InternetZoneNavigateWindowsAndFrames -
-
- InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode -
-
- InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles -
-
- InternetExplorer/InternetZoneUsePopupBlocker -
-
- InternetExplorer/IntranetZoneAllowAccessToDataSources -
-
- InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/IntranetZoneAllowFontDownloads -
-
- InternetExplorer/IntranetZoneAllowLessPrivilegedSites -
-
- InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/IntranetZoneAllowScriptlets -
-
- InternetExplorer/IntranetZoneAllowSmartScreenIE -
-
- InternetExplorer/IntranetZoneAllowUserDataPersistence -
-
- InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls -
-
- InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/IntranetZoneJavaPermissions -
-
- InternetExplorer/IntranetZoneNavigateWindowsAndFrames -
-
- InternetExplorer/LocalMachineZoneAllowAccessToDataSources -
-
- InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/LocalMachineZoneAllowFontDownloads -
-
- InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites -
-
- InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/LocalMachineZoneAllowScriptlets -
-
- InternetExplorer/LocalMachineZoneAllowSmartScreenIE -
-
- InternetExplorer/LocalMachineZoneAllowUserDataPersistence -
-
- InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls -
-
- InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/LocalMachineZoneJavaPermissions -
-
- InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames -
-
- InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources -
-
- InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/LockedDownInternetZoneAllowFontDownloads -
-
- InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites -
-
- InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/LockedDownInternetZoneAllowScriptlets -
-
- InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE -
-
- InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence -
-
- InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/LockedDownInternetZoneJavaPermissions -
-
- InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames -
-
- InternetExplorer/LockedDownIntranetJavaPermissions -
-
- InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources -
-
- InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/LockedDownIntranetZoneAllowFontDownloads -
-
- InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites -
-
- InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/LockedDownIntranetZoneAllowScriptlets -
-
- InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE -
-
- InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence -
-
- InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE -
-
- InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence -
-
- InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/LockedDownLocalMachineZoneJavaPermissions -
-
- InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE -
-
- InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence -
-
- InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions -
-
- InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE -
-
- InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence -
-
- InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions -
-
- InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames -
-
- InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses -
-
- InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses -
-
- InternetExplorer/NewTabDefaultPage -
-
- InternetExplorer/NotificationBarInternetExplorerProcesses -
-
- InternetExplorer/PreventManagingSmartScreenFilter -
-
- InternetExplorer/PreventPerUserInstallationOfActiveXControls -
-
- InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses -
-
- InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls -
-
- InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses -
-
- InternetExplorer/RestrictFileDownloadInternetExplorerProcesses -
-
- InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources -
-
- InternetExplorer/RestrictedSitesZoneAllowActiveScripting -
-
- InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors -
-
- InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript -
-
- InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles -
-
- InternetExplorer/RestrictedSitesZoneAllowFileDownloads -
-
- InternetExplorer/RestrictedSitesZoneAllowFontDownloads -
-
- InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites -
-
- InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles -
-
- InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH -
-
- InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls -
-
- InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl -
-
- InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows -
-
- InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls -
-
- InternetExplorer/RestrictedSitesZoneAllowScriptlets -
-
- InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE -
-
- InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript -
-
- InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence -
-
- InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer -
-
- InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls -
-
- InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls -
-
- InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls -
-
- InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter -
-
- InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows -
-
- InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows -
-
- InternetExplorer/RestrictedSitesZoneEnableMIMESniffing -
-
- InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer -
-
- InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/RestrictedSitesZoneJavaPermissions -
-
- InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME -
-
- InternetExplorer/RestrictedSitesZoneLogonOptions -
-
- InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames -
-
- InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins -
-
- InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode -
-
- InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting -
-
- InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets -
-
- InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles -
-
- InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode -
-
- InternetExplorer/RestrictedSitesZoneUsePopupBlocker -
-
- InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses -
-
- InternetExplorer/SearchProviderList -
-
- InternetExplorer/SecurityZonesUseOnlyMachineSettings -
-
- InternetExplorer/SpecifyUseOfActiveXInstallerService -
-
- InternetExplorer/TrustedSitesZoneAllowAccessToDataSources -
-
- InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls -
-
- InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads -
-
- InternetExplorer/TrustedSitesZoneAllowFontDownloads -
-
- InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites -
-
- InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents -
-
- InternetExplorer/TrustedSitesZoneAllowScriptlets -
-
- InternetExplorer/TrustedSitesZoneAllowSmartScreenIE -
-
- InternetExplorer/TrustedSitesZoneAllowUserDataPersistence -
-
- InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls -
-
- InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls -
-
- InternetExplorer/TrustedSitesZoneJavaPermissions -
-
- InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames -
-
- -### Kerberos policies - -
-
- Kerberos/AllowForestSearchOrder -
-
- Kerberos/KerberosClientSupportsClaimsCompoundArmor -
-
- Kerberos/RequireKerberosArmoring -
-
- Kerberos/RequireStrictKDCValidation -
-
- Kerberos/SetMaximumContextTokenSize -
-
- Kerberos/UPNNameHints -
-
- -### KioskBrowser policies - -
-
- KioskBrowser/BlockedUrlExceptions -
-
- KioskBrowser/BlockedUrls -
-
- KioskBrowser/DefaultURL -
-
- KioskBrowser/EnableEndSessionButton -
-
- KioskBrowser/EnableHomeButton -
-
- KioskBrowser/EnableNavigationButtons -
-
- KioskBrowser/RestartOnIdleTime -
-
- -### LanmanWorkstation policies - -
-
- LanmanWorkstation/EnableInsecureGuestLogons -
-
- -### Language Pack Management CSP policies - -
-
- LanmanWorkstation/EnableInsecureGuestLogons -
-
- -### Licensing policies - -
-
- Licensing/AllowWindowsEntitlementReactivation -
-
- Licensing/DisallowKMSClientOnlineAVSValidation -
-
- -### LocalPoliciesSecurityOptions policies - -
-
- LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts -
-
- LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly -
-
- LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount -
-
- LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount -
-
- LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon -
-
- LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia -
-
- LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters -
-
- LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn -
-
- LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior -
-
- LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees -
-
- LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers -
-
- LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways -
-
- LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees -
-
- LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts -
-
- LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares -
-
- LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares -
-
- LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic -
-
- LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers -
-
- LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn -
-
- LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile -
-
- LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation -
-
- LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators -
-
- LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers -
-
- LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation -
-
- LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated -
-
- LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations -
-
- LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode -
-
- LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation -
-
- LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode -
-
- LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations -
-
- -### LocalUsersAndGroups policies - -
-
- LocalUsersAndGroups/Configure -
-
- -### LockDown policies - -
-
- LockDown/AllowEdgeSwipe -
-
- -### Maps policies - -
-
- Maps/AllowOfflineMapsDownloadOverMeteredConnection -
-
- Maps/EnableOfflineMapsAutoUpdate -
-
- -### MemoryDump policies - -
-
- MemoryDump/AllowCrashDump -
-
- MemoryDump/AllowLiveDump -
-
- -### Messaging policies - -
-
- Messaging/AllowMessageSync -
-
- -### MixedReality policies - -
-
- MixedReality/AADGroupMembershipCacheValidityInDays -
-
- MixedReality/BrightnessButtonDisabled -
-
- MixedReality/FallbackDiagnostics -
-
- MixedReality/MicrophoneDisabled -
-
- MixedReality/VolumeButtonDisabled -
-
- -### MSSecurityGuide policies - -
-
- MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon -
-
- MSSecurityGuide/ConfigureSMBV1ClientDriver -
-
- MSSecurityGuide/ConfigureSMBV1Server -
-
- MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection -
-
- MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications -
-
- MSSecurityGuide/WDigestAuthentication -
-
- -### MSSLegacy policies - -
-
- MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes -
-
- MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers -
-
- MSSLegacy/IPSourceRoutingProtectionLevel -
-
- MSSLegacy/IPv6SourceRoutingProtectionLevel -
-
- -### Multitasking policies - -
-
- Multitasking/BrowserAltTabBlowout -
-
- -### NetworkIsolation policies - -
-
- NetworkIsolation/EnterpriseCloudResources -
-
- NetworkIsolation/EnterpriseIPRange -
-
- NetworkIsolation/EnterpriseIPRangesAreAuthoritative -
-
- NetworkIsolation/EnterpriseInternalProxyServers -
-
- NetworkIsolation/EnterpriseNetworkDomainNames -
-
- NetworkIsolation/EnterpriseProxyServers -
-
- NetworkIsolation/EnterpriseProxyServersAreAuthoritative -
-
- NetworkIsolation/NeutralResources -
-
- -### NetworkListManager policies - -
-
- NetworkListManager/AllowedTlsAuthenticationEndpoints -
-
- NetworkListManager/ConfiguredTLSAuthenticationNetworkName -
-
-
- -### NewsAndInterests policies - -
-
- NewsAndInterests/AllowNewsAndInterests -
-
- -### Notifications policies - -
-
- Notifications/DisallowCloudNotification -
-
- Notifications/DisallowNotificationMirroring -
-
- Notifications/DisallowTileNotification -
-
- -### Power policies - -
-
- Power/AllowStandbyStatesWhenSleepingOnBattery -
-
- Power/AllowStandbyWhenSleepingPluggedIn -
-
- Power/DisplayOffTimeoutOnBattery -
-
- Power/DisplayOffTimeoutPluggedIn -
-
- Power/EnergySaverBatteryThresholdOnBattery -
-
- Power/EnergySaverBatteryThresholdPluggedIn -
-
- Power/HibernateTimeoutOnBattery -
-
- Power/HibernateTimeoutPluggedIn -
-
- Power/RequirePasswordWhenComputerWakesOnBattery -
-
- Power/RequirePasswordWhenComputerWakesPluggedIn -
-
- Power/SelectLidCloseActionOnBattery -
-
- Power/SelectLidCloseActionPluggedIn -
-
- Power/SelectPowerButtonActionOnBattery -
-
- Power/SelectPowerButtonActionPluggedIn -
-
- Power/SelectSleepButtonActionOnBattery -
-
- Power/SelectSleepButtonActionPluggedIn -
-
- Power/StandbyTimeoutOnBattery -
-
- Power/StandbyTimeoutPluggedIn -
-
- Power/TurnOffHybridSleepOnBattery -
-
- Power/TurnOffHybridSleepPluggedIn -
-
- Power/UnattendedSleepTimeoutOnBattery -
-
- Power/UnattendedSleepTimeoutPluggedIn -
-
- -### Printers policies - -
-
- Printers/ApprovedUsbPrintDevices -
-
- Printers/ApprovedUsbPrintDevicesUser -
-
- Printers/ConfigureCopyFilesPolicy -
-
- Printers/ConfigureDriverValidationLevel -
-
- Printers/ConfigureIppPageCountsPolicy -
-
- Printers/ConfigureRedirectionGuardPolicy -
-
- Printers/ConfigureRpcConnectionPolicy -
-
- Printers/ConfigureRpcListenerPolicy -
-
- Printers/ConfigureRpcTcpPort -
-
- Printers/EnableDeviceControl -
-
- Printers/EnableDeviceControlUser -
-
- Printers/ManageDriverExclusionList -
-
- Printers/PointAndPrintRestrictions -
-
- Printers/PointAndPrintRestrictions_User -
-
- Printers/PublishPrinters -
-
- Printers/RestrictDriverInstallationToAdministrators -
-
- -### Privacy policies - -
-
- Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts -
-
- Privacy/AllowCrossDeviceClipboard -
-
- Privacy/AllowInputPersonalization -
-
- Privacy/DisableAdvertisingId -
-
- Privacy/DisablePrivacyExperience -
-
- Privacy/EnableActivityFeed -
-
- Privacy/LetAppsAccessAccountInfo -
-
- Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessBackgroundSpatialPerception -
-
- Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessCalendar -
-
- Privacy/LetAppsAccessCalendar_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessCalendar_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessCallHistory -
-
- Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessCamera -
-
- Privacy/LetAppsAccessCamera_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessCamera_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessCamera_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessContacts -
-
- Privacy/LetAppsAccessContacts_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessContacts_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessContacts_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessEmail -
-
- Privacy/LetAppsAccessEmail_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessEmail_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessEmail_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessGazeInput -
-
- Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessLocation -
-
- Privacy/LetAppsAccessLocation_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessLocation_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessLocation_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessMessaging -
-
- Privacy/LetAppsAccessMessaging_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessMessaging_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessMicrophone -
-
- Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessMotion -
-
- Privacy/LetAppsAccessMotion_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessMotion_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessMotion_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessNotifications -
-
- Privacy/LetAppsAccessNotifications_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessNotifications_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessPhone -
-
- Privacy/LetAppsAccessPhone_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessPhone_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessPhone_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessRadios -
-
- Privacy/LetAppsAccessRadios_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessRadios_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessRadios_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessTasks -
-
- Privacy/LetAppsAccessTasks_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessTasks_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessTasks_UserInControlOfTheseApps -
-
- Privacy/LetAppsAccessTrustedDevices -
-
- Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps -
-
- Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps -
-
- Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps -
-
- Privacy/LetAppsActivateWithVoice -
-
- Privacy/LetAppsActivateWithVoiceAboveLock -
-
- Privacy/LetAppsGetDiagnosticInfo -
-
- Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps -
-
- Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps -
-
- Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps -
-
- Privacy/LetAppsRunInBackground -
-
- Privacy/LetAppsRunInBackground_ForceAllowTheseApps -
-
- Privacy/LetAppsRunInBackground_ForceDenyTheseApps -
-
- Privacy/LetAppsRunInBackground_UserInControlOfTheseApps -
-
- Privacy/LetAppsSyncWithDevices -
-
- Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps -
-
- Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps -
-
- Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps -
-
- Privacy/PublishUserActivities -
-
- Privacy/UploadUserActivities -
-
- -### RemoteAssistance policies - -
-
- RemoteAssistance/CustomizeWarningMessages -
-
- RemoteAssistance/SessionLogging -
-
- RemoteAssistance/SolicitedRemoteAssistance -
-
- RemoteAssistance/UnsolicitedRemoteAssistance -
-
- -### RemoteDesktop policies - -
-
- RemoteDesktop/AutoSubscription -
-
- RemoteDesktop/LoadAadCredKeyFromProfile -
-
- -### RemoteDesktopServices policies - -
-
- RemoteDesktopServices/AllowUsersToConnectRemotely -
-
- RemoteDesktopServices/ClientConnectionEncryptionLevel -
-
- RemoteDesktopServices/DoNotAllowDriveRedirection -
-
- RemoteDesktopServices/DoNotAllowPasswordSaving -
-
- RemoteDesktopServices/PromptForPasswordUponConnection -
-
- RemoteDesktopServices/RequireSecureRPCCommunication -
-
- -### RemoteManagement policies - -
-
- RemoteManagement/AllowBasicAuthentication_Client -
-
- RemoteManagement/AllowBasicAuthentication_Service -
-
- RemoteManagement/AllowCredSSPAuthenticationClient -
-
- RemoteManagement/AllowCredSSPAuthenticationService -
-
- RemoteManagement/AllowRemoteServerManagement -
-
- RemoteManagement/AllowUnencryptedTraffic_Client -
-
- RemoteManagement/AllowUnencryptedTraffic_Service -
-
- RemoteManagement/DisallowDigestAuthentication -
-
- RemoteManagement/DisallowNegotiateAuthenticationClient -
-
- RemoteManagement/DisallowNegotiateAuthenticationService -
-
- RemoteManagement/DisallowStoringOfRunAsCredentials -
-
- RemoteManagement/SpecifyChannelBindingTokenHardeningLevel -
-
- RemoteManagement/TrustedHosts -
-
- RemoteManagement/TurnOnCompatibilityHTTPListener -
-
- RemoteManagement/TurnOnCompatibilityHTTPSListener -
-
- -### RemoteProcedureCall policies - -
-
- RemoteProcedureCall/RPCEndpointMapperClientAuthentication -
-
- RemoteProcedureCall/RestrictUnauthenticatedRPCClients -
-
- -### RemoteShell policies - -
-
- RemoteShell/AllowRemoteShellAccess -
-
- RemoteShell/MaxConcurrentUsers -
-
- RemoteShell/SpecifyIdleTimeout -
-
- RemoteShell/SpecifyMaxMemory -
-
- RemoteShell/SpecifyMaxProcesses -
-
- RemoteShell/SpecifyMaxRemoteShells -
-
- RemoteShell/SpecifyShellTimeout -
-
- -### RestrictedGroups policies - -
-
- RestrictedGroups/ConfigureGroupMembership -
-
- -### Search policies - -
-
- Search/AllowCloudSearch -
-
- Search/AllowFindMyFiles -
-
- Search/AllowIndexingEncryptedStoresOrItems -
-
- Search/AllowSearchToUseLocation -
-
- Search/AllowStoringImagesFromVisionSearch -
-
- Search/AllowUsingDiacritics -
-
- Search/AllowWindowsIndexer -
-
- Search/AlwaysUseAutoLangDetection -
-
- Search/DisableBackoff -
-
- Search/DisableRemovableDriveIndexing -
-
- Search/DisableSearch -
-
- Search/DoNotUseWebResults -
-
- Search/PreventIndexingLowDiskSpaceMB -
-
- Search/PreventRemoteQueries -
-
- -### Security policies - -
-
- Security/AllowAddProvisioningPackage -
-
- Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices -
-
- Security/AllowRemoveProvisioningPackage -
-
- Security/ClearTPMIfNotReady -
-
- Security/ConfigureWindowsPasswords -
-
- Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices -
-
- Security/RecoveryEnvironmentAuthentication -
-
- Security/RequireDeviceEncryption -
-
- Security/RequireProvisioningPackageSignature -
-
- Security/RequireRetrieveHealthCertificateOnBoot -
-
- -### ServiceControlManager policies -
-
- ServiceControlManager/SvchostProcessMitigation -
-
- -### Settings policies - -
-
- Settings/AllowAutoPlay -
-
- Settings/AllowDataSense -
-
- Settings/AllowDateTime -
-
- Settings/AllowLanguage -
-
- Settings/AllowOnlineTips -
-
- Settings/AllowPowerSleep -
-
- Settings/AllowRegion -
-
- Settings/AllowSignInOptions -
-
- Settings/AllowVPN -
-
- Settings/AllowWorkplace -
-
- Settings/AllowYourAccount -
-
- Settings/ConfigureTaskbarCalendar -
-
- Settings/PageVisibilityList -
-
- -### Windows Defender SmartScreen policies - -
-
- SmartScreen/EnableAppInstallControl -
-
- SmartScreen/EnableSmartScreenInShell -
-
- SmartScreen/PreventOverrideForFilesInShell -
-
- -### Speech policies - -
-
- Speech/AllowSpeechModelUpdate -
-
- -### Start policies - -
-
- Start/AllowPinnedFolderDocuments -
-
- Start/AllowPinnedFolderDownloads -
-
- Start/AllowPinnedFolderFileExplorer -
-
- Start/AllowPinnedFolderHomeGroup -
-
- Start/AllowPinnedFolderMusic -
-
- Start/AllowPinnedFolderNetwork -
-
- Start/AllowPinnedFolderPersonalFolder -
-
- Start/AllowPinnedFolderPictures -
-
- Start/AllowPinnedFolderSettings -
-
- Start/AllowPinnedFolderVideos -
-
- Start/DisableContextMenus -
-
- Start/DisableControlCenter -
-
- Start/DisableEditingQuickSettings -
-
- Start/ForceStartSize -
-
- Start/HideAppList -
-
- Start/HideChangeAccountSettings -
-
- Start/HideFrequentlyUsedApps -
-
- Start/HideHibernate -
-
- Start/HideLock -
-
- Start/HidePeopleBar -
-
- Start/HidePowerButton -
-
- Start/HideRecentJumplists -
-
- Start/HideRecentlyAddedApps -
-
- Start/HideRecommendedSection -
-
- Start/HideRestart -
-
- Start/HideShutDown -
-
- Start/HideSignOut -
-
- Start/HideSleep -
-
- Start/HideSwitchAccount -
-
- Start/HideTaskViewButton -
-
- Start/HideUserTile -
-
- Start/ImportEdgeAssets -
-
- Start/NoPinningToTaskbar -
-
- Start/SimplifyQuickSettings -
-
- Start/StartLayout -
-
- -### Storage policies - -
-
- Storage/AllowDiskHealthModelUpdates -
-
- Storage/AllowStorageSenseGlobal -
-
- Storage/AllowStorageSenseTemporaryFilesCleanup -
-
- Storage/ConfigStorageSenseCloudContentDehydrationThreshold -
-
- Storage/ConfigStorageSenseDownloadsCleanupThreshold -
-
- Storage/ConfigStorageSenseGlobalCadence -
-
- Storage/ConfigStorageSenseRecycleBinCleanupThreshold -
- Storage/EnhancedStorageDevices -
-
- Storage/RemovableDiskDenyWriteAccess -
-
- Storage/WPDDevicesDenyReadAccessPerDevice -
-
- Storage/WPDDevicesDenyReadAccessPerUser -
-
- Storage/WPDDevicesDenyWriteAccessPerDevice -
-
- Storage/WPDDevicesDenyWriteAccessPerUser -
-
- -### System policies - -
-
- System/AllowBuildPreview -
-
- System/AllowCommercialDataPipeline -
-
- System/AllowDeviceNameInDiagnosticData -
-
- System/AllowEmbeddedMode -
-
- System/AllowExperimentation -
-
- System/AllowFontProviders -
-
- System/AllowLocation -
-
- System/AllowStorageCard -
-
- System/AllowTelemetry -
-
- System/AllowUserToResetPhone -
-
- System/BootStartDriverInitialization -
-
- System/ConfigureMicrosoft365UploadEndpoint -
-
- System/ConfigureTelemetryOptInChangeNotification -
-
- System/ConfigureTelemetryOptInSettingsUx -
-
- System/DisableDeviceDelete -
-
- System/DisableDiagnosticDataViewer -
-
- System/DisableEnterpriseAuthProxy -
-
- System/DisableOneDriveFileSync -
-
- System/DisableSystemRestore -
-
- System/FeedbackHubAlwaysSaveDiagnosticsLocally -
-
- System/LimitDiagnosticLogCollection -
-
- System/LimitDumpCollection -
-
- System/LimitEnhancedDiagnosticDataWindowsAnalytics -
-
- System/TelemetryProxy -
-
- System/TurnOffFileHistory -
-
- -### SystemServices policies - -
-
- SystemServices/ConfigureHomeGroupListenerServiceStartupMode -
-
- SystemServices/ConfigureHomeGroupProviderServiceStartupMode -
-
- SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode -
-
- SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode -
-
- SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode -
-
- SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode -
-
- -### TaskManager policies - -
-
- TaskManager/AllowEndTask -
-
- -### TaskScheduler policies - -
-
- TaskScheduler/EnableXboxGameSaveTask -
-
- -### TextInput policies - -
-
- TextInput/AllowHardwareKeyboardTextSuggestions -
-
- TextInput/AllowIMELogging -
-
- TextInput/AllowIMENetworkAccess -
-
- TextInput/AllowInputPanel -
-
- TextInput/AllowJapaneseIMESurrogatePairCharacters -
-
- TextInput/AllowJapaneseIVSCharacters -
-
- TextInput/AllowJapaneseNonPublishingStandardGlyph -
-
- TextInput/AllowJapaneseUserDictionary -
-
- TextInput/AllowKeyboardTextSuggestions -
-
- TextInput/AllowKoreanExtendedHanja -
-
- TextInput/AllowLanguageFeaturesUninstall -
-
- TextInput/AllowLinguisticDataCollection -
-
- TextInput/AllowTextInputSuggestionUpdate -
-
- TextInput/ConfigureJapaneseIMEVersion -
-
- TextInput/ConfigureSimplifiedChineseIMEVersion -
-
- TextInput/ConfigureTraditionalChineseIMEVersion -
-
- TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode -
-
- TextInput/ExcludeJapaneseIMEExceptJIS0208 -
-
- TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC -
-
- TextInput/ExcludeJapaneseIMEExceptShiftJIS -
-
- TextInput/ForceTouchKeyboardDockedState -
-
- TextInput/TouchKeyboardDictationButtonAvailability -
-
- TextInput/TouchKeyboardEmojiButtonAvailability -
-
- TextInput/TouchKeyboardFullModeAvailability -
-
- TextInput/TouchKeyboardHandwritingModeAvailability -
-
- TextInput/TouchKeyboardNarrowModeAvailability -
-
- TextInput/TouchKeyboardSplitModeAvailability -
-
- TextInput/TouchKeyboardWideModeAvailability -
-
- -### TimeLanguageSettings policies - -
-
- TimeLanguageSettings/BlockCleanupOfUnusedPreinstalledLangPacks -
-
- TimeLanguageSettings/ConfigureTimeZone -
-
- TimeLanguageSettings/MachineUILanguageOverwrite -
-
- TimeLanguageSettings/RestrictLanguagePacksAndFeaturesInstall -
-
- -### Troubleshooting policies - -
-
- Troubleshooting/AllowRecommendations -
-
- -### Update policies - -
-
- Update/ActiveHoursEnd -
-
- Update/ActiveHoursMaxRange -
-
- Update/ActiveHoursStart -
-
- Update/AllowAutoUpdate -
-
- Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork -
-
- Update/AllowMUUpdateService -
-
- Update/AllowNonMicrosoftSignedUpdate -
-
- Update/AllowUpdateService -
-
- Update/AutoRestartDeadlinePeriodInDays -
-
- Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates -
-
- Update/AutoRestartNotificationSchedule -
-
- Update/AutoRestartRequiredNotificationDismissal -
-
- Update/AutomaticMaintenanceWakeUp -
-
- Update/BranchReadinessLevel -
-
- Update/ConfigureDeadlineForFeatureUpdates -
-
- Update/ConfigureDeadlineForQualityUpdates -
-
- Update/ConfigureDeadlineGracePeriod -
-
- Update/ConfigureDeadlineGracePeriodForFeatureUpdates -
-
- Update/ConfigureDeadlineNoAutoReboot -
-
- Update/ConfigureFeatureUpdateUninstallPeriod -
-
- Update/DeferFeatureUpdatesPeriodInDays -
-
- Update/DeferQualityUpdatesPeriodInDays -
-
- Update/DeferUpdatePeriod -
-
- Update/DeferUpgradePeriod -
-
- Update/DetectionFrequency -
-
- Update/DisableDualScan -
-
- Update/DisableWUfBSafeguards -
-
- Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection -
-
- Update/EngagedRestartDeadline -
-
- Update/EngagedRestartDeadlineForFeatureUpdates -
-
- Update/EngagedRestartSnoozeSchedule -
-
- Update/EngagedRestartSnoozeScheduleForFeatureUpdates -
-
- Update/EngagedRestartTransitionSchedule -
-
- Update/EngagedRestartTransitionScheduleForFeatureUpdates -
-
- Update/ExcludeWUDriversInQualityUpdate -
-
- Update/FillEmptyContentUrls -
-
- Update/IgnoreMOAppDownloadLimit -
-
- Update/IgnoreMOUpdateDownloadLimit -
-
- Update/ManagePreviewBuilds -
-
- Update/PauseDeferrals -
-
- Update/PauseFeatureUpdates -
-
- Update/PauseFeatureUpdatesStartTime -
-
- Update/PauseQualityUpdates -
-
- Update/PauseQualityUpdatesStartTime -
-
- Update/PhoneUpdateRestrictions -
-
- Update/RequireDeferUpgrade -
-
- Update/RequireUpdateApproval -
-
- Update/ScheduleImminentRestartWarning -
-
- Update/ScheduleRestartWarning -
-
- Update/ScheduledInstallDay -
-
- Update/ScheduledInstallEveryWeek -
-
- Update/ScheduledInstallFirstWeek -
-
- Update/ScheduledInstallFourthWeek -
-
- Update/ScheduledInstallSecondWeek -
-
- Update/ScheduledInstallThirdWeek -
-
- Update/ScheduledInstallTime -
-
- Update/SetAutoRestartNotificationDisable -
-
- Update/SetDisablePauseUXAccess -
-
- Update/SetDisableUXWUAccess -
-
- Update/SetEDURestart -
-
- Update/SetPolicyDrivenUpdateSourceForDriverUpdates -
-
- Update/SetPolicyDrivenUpdateSourceForFeatureUpdates -
-
- Update/SetPolicyDrivenUpdateSourceForOtherUpdates -
-
- Update/SetPolicyDrivenUpdateSourceForQualityUpdates -
-
- Update/SetProxyBehaviorForUpdateDetection -
-
- Update/TargetReleaseVersion -
-
-
- Update/UpdateNotificationLevel -
-
- Update/UpdateServiceUrl -
-
- Update/UpdateServiceUrlAlternate -
-
- -### UserRights policies - -
-
- UserRights/AccessCredentialManagerAsTrustedCaller -
-
- UserRights/AccessFromNetwork -
-
- UserRights/ActAsPartOfTheOperatingSystem -
-
- UserRights/AllowLocalLogOn -
-
- UserRights/BackupFilesAndDirectories -
-
- UserRights/ChangeSystemTime -
-
- UserRights/CreateGlobalObjects -
-
- UserRights/CreatePageFile -
-
- UserRights/CreatePermanentSharedObjects -
-
- UserRights/CreateSymbolicLinks -
-
- UserRights/CreateToken -
-
- UserRights/DebugPrograms -
-
- UserRights/DenyAccessFromNetwork -
-
- UserRights/DenyLocalLogOn -
-
- UserRights/DenyRemoteDesktopServicesLogOn -
-
- UserRights/EnableDelegation -
-
- UserRights/GenerateSecurityAudits -
-
- UserRights/ImpersonateClient -
-
- UserRights/IncreaseSchedulingPriority -
-
- UserRights/LoadUnloadDeviceDrivers -
-
- UserRights/LockMemory -
-
- UserRights/ManageAuditingAndSecurityLog -
-
- UserRights/ManageVolume -
-
- UserRights/ModifyFirmwareEnvironment -
-
- UserRights/ModifyObjectLabel -
-
- UserRights/ProfileSingleProcess -
-
- UserRights/RemoteShutdown -
-
- UserRights/RestoreFilesAndDirectories -
-
- UserRights/TakeOwnership -
-
- -### VirtualizationBasedTechnology policies - -
-
- VirtualizationBasedTechnology/HypervisorEnforcedCodeIntegrity -
-
- VirtualizationBasedTechnology/RequireUEFIMemoryAttributesTable -
-
- -### WebThreatDefense policies - -
-
- WebThreatDefense/EnableService -
-
- WebThreatDefense/NotifyMalicious -
-
- WebThreatDefense/NotifyPasswordReuse -
-
- WebThreatDefense/NotifyUnsafeApp -
-
- -### Wifi policies - -
-
- WiFi/AllowWiFiHotSpotReporting -
-
- Wifi/AllowAutoConnectToWiFiSenseHotspots -
-
- Wifi/AllowInternetSharing -
-
- Wifi/AllowManualWiFiConfiguration -
-
- Wifi/AllowWiFi -
-
- Wifi/AllowWiFiDirect -
-
- Wifi/WLANScanMode -
-
- -### WindowsAutoPilot policies - -
-
- WindowsAutoPilot/EnableAgilityPostEnrollment -
-
- -### WindowsConnectionManager policies - -
-
- WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork -
-
- -### WindowsDefenderSecurityCenter policies - -
-
- WindowsDefenderSecurityCenter/CompanyName -
-
- WindowsDefenderSecurityCenter/DisableAccountProtectionUI -
-
- WindowsDefenderSecurityCenter/DisableAppBrowserUI -
-
- WindowsDefenderSecurityCenter/DisableClearTpmButton -
-
- WindowsDefenderSecurityCenter/DisableDeviceSecurityUI -
-
- WindowsDefenderSecurityCenter/DisableEnhancedNotifications -
-
- WindowsDefenderSecurityCenter/DisableFamilyUI -
-
- WindowsDefenderSecurityCenter/DisableHealthUI -
-
- WindowsDefenderSecurityCenter/DisableNetworkUI -
-
- WindowsDefenderSecurityCenter/DisableNotifications -
-
- WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning -
-
- WindowsDefenderSecurityCenter/DisableVirusUI -
-
- WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride -
-
- WindowsDefenderSecurityCenter/Email -
-
- WindowsDefenderSecurityCenter/EnableCustomizedToasts -
-
- WindowsDefenderSecurityCenter/EnableInAppCustomization -
-
- WindowsDefenderSecurityCenter/HideRansomwareDataRecovery -
-
- WindowsDefenderSecurityCenter/HideSecureBoot -
-
- WindowsDefenderSecurityCenter/HideTPMTroubleshooting -
-
- WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl -
-
- WindowsDefenderSecurityCenter/Phone -
-
- WindowsDefenderSecurityCenter/URL -
-
- -### WindowsInkWorkspace policies - -
-
- WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace -
-
- WindowsInkWorkspace/AllowWindowsInkWorkspace -
-
- -### WindowsLogon policies - -
-
- WindowsLogon/AllowAutomaticRestartSignOn -
-
- WindowsLogon/ConfigAutomaticRestartSignOn -
-
- WindowsLogon/DisableLockScreenAppNotifications -
-
- WindowsLogon/DontDisplayNetworkSelectionUI -
-
- WindowsLogon/EnableFirstLogonAnimation -
-
- WindowsLogon/EnableMPRNotifications -
-
- WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers -
-
- WindowsLogon/HideFastUserSwitching -
-
- -### WindowsPowerShell policies - -
-
- WindowsPowerShell/TurnOnPowerShellScriptBlockLogging -
-
- -### WindowsSandbox policies - -
-
- WindowsSandbox/AllowAudioInput -
-
- WindowsSandbox/AllowClipboardRedirection -
-
- WindowsSandbox/AllowNetworking -
-
- WindowsSandbox/AllowPrinterRedirection -
-
- WindowsSandbox/AllowVGPU -
-
- WindowsSandbox/AllowVideoInput -
-
- -### WirelessDisplay policies - -
-
- WirelessDisplay/AllowMdnsAdvertisement -
-
- WirelessDisplay/AllowMdnsDiscovery -
-
- WirelessDisplay/AllowMovementDetectionOnInfrastructure -
-
- WirelessDisplay/AllowProjectionFromPC -
-
- WirelessDisplay/AllowProjectionFromPCOverInfrastructure -
-
- WirelessDisplay/AllowProjectionToPC -
-
- WirelessDisplay/AllowProjectionToPCOverInfrastructure -
-
- WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver -
-
- WirelessDisplay/RequirePinForPairing -
-
- - -## Policies in Policy CSP supported by Group Policy and ADMX-backed policies in Policy CSP -- [Policies in Policy CSP supported by Group Policy](./policies-in-policy-csp-supported-by-group-policy.md) -- [ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) - -> [!NOTE] -> Not all Policies in Policy CSP supported by Group Policy are ADMX-backed. For more details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). - -## Policies in Policy CSP supported by HoloLens devices -- [Policies in Policy CSP supported by HoloLens 2](./policies-in-policy-csp-supported-by-hololens2.md) -- [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](./policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md) -- [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](./policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md) - -## Policies in Policy CSP supported by Windows 10 IoT -- [Policies in Policy CSP supported by Windows 10 IoT Core](./policies-in-policy-csp-supported-by-iot-core.md) - -## Policies in Policy CSP supported by Microsoft Surface Hub -- [Policies in Policy CSP supported by Microsoft Surface Hub](./policies-in-policy-csp-supported-by-surface-hub.md) - -## Policies in Policy CSP that can be set using Exchange ActiveSync (EAS) -- [Policies in Policy CSP that can be set using Exchange ActiveSync (EAS)](./policies-in-policy-csp-that-can-be-set-using-eas.md) - -## Related topics - -[Configuration service provider reference](index.yml) + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### Device/Result/{AreaName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Result/{AreaName} +``` + + + +The area group that can be configured by a single technology independent of the providers. See the individual Area DDFs for Policy CSP for a list of Areas that can be configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +#### Device/Result/{AreaName}/{PolicyName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1507 [10.0.10240] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Result/{AreaName}/{PolicyName} +``` + + + +Specifies the name/value pair used in the policy. See the individual Area DDFs for more information about the policies available to configure. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | null | +| Access Type | Get | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +## User/Config + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Config +``` + + + +Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value,) the configuration source can use the Policy/Result path to retrieve the resulting value. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | + + + + + + + + + +### User/Config/{AreaName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Config/{AreaName} +``` + + + +The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value. See the individual Area DDFs for Policy CSP for a list of Areas that can be configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +#### User/Config/{AreaName}/{PolicyName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Config/{AreaName}/{PolicyName} +``` + + + +Specifies the name/value pair used in the policy. See the individual Area DDFs for more information about the policies available to configure. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | null | +| Access Type | Add, Delete, Get, Replace | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +## User/Result + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Result +``` + + + +Groups the evaluated policies from all providers that can be configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### User/Result/{AreaName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Result/{AreaName} +``` + + + +The area group that can be configured by a single technology independent of the providers. See the individual Area DDFs for Policy CSP for a list of Areas that can be configured. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | +| Dynamic Node Naming | ClientInventory | + + + + + + + + + +#### User/Result/{AreaName}/{PolicyName} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:heavy_check_mark: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | | + + + +```User +./User/Vendor/MSFT/Policy/Result/{AreaName}/{PolicyName} +``` + + + +Specifies the name/value pair used in the policy. See the individual Area DDFs for more information about the policies available to configure. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | null | +| Access Type | Get | +| Dynamic Node Naming | ServerGeneratedUniqueIdentifier | + + + + + + + + +## Policy CSPs + +- [AboveLock](policy-csp-abovelock.md) +- [Accounts](policy-csp-accounts.md) +- [ActiveXControls](policy-csp-activexcontrols.md) +- [ADMX_ActiveXInstallService](policy-csp-admx-activexinstallservice.md) +- [ADMX_AddRemovePrograms](policy-csp-admx-addremoveprograms.md) +- [ADMX_AdmPwd](policy-csp-admx-admpwd.md) +- [ADMX_AppCompat](policy-csp-admx-appcompat.md) +- [ADMX_AppxPackageManager](policy-csp-admx-appxpackagemanager.md) +- [ADMX_AppXRuntime](policy-csp-admx-appxruntime.md) +- [ADMX_AttachmentManager](policy-csp-admx-attachmentmanager.md) +- [ADMX_AuditSettings](policy-csp-admx-auditsettings.md) +- [ADMX_Bits](policy-csp-admx-bits.md) +- [ADMX_CipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md) +- [ADMX_COM](policy-csp-admx-com.md) +- [ADMX_ControlPanel](policy-csp-admx-controlpanel.md) +- [ADMX_ControlPanelDisplay](policy-csp-admx-controlpaneldisplay.md) +- [ADMX_Cpls](policy-csp-admx-cpls.md) +- [ADMX_CredentialProviders](policy-csp-admx-credentialproviders.md) +- [ADMX_CredSsp](policy-csp-admx-credssp.md) +- [ADMX_CredUI](policy-csp-admx-credui.md) +- [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) +- [ADMX_DataCollection](policy-csp-admx-datacollection.md) +- [ADMX_DCOM](policy-csp-admx-dcom.md) +- [ADMX_Desktop](policy-csp-admx-desktop.md) +- [ADMX_DeviceCompat](policy-csp-admx-devicecompat.md) +- [ADMX_DeviceGuard](policy-csp-admx-deviceguard.md) +- [ADMX_DeviceInstallation](policy-csp-admx-deviceinstallation.md) +- [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) +- [ADMX_DFS](policy-csp-admx-dfs.md) +- [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) +- [ADMX_DiskDiagnostic](policy-csp-admx-diskdiagnostic.md) +- [ADMX_DiskNVCache](policy-csp-admx-disknvcache.md) +- [ADMX_DiskQuota](policy-csp-admx-diskquota.md) +- [ADMX_DistributedLinkTracking](policy-csp-admx-distributedlinktracking.md) +- [ADMX_DnsClient](policy-csp-admx-dnsclient.md) +- [ADMX_DWM](policy-csp-admx-dwm.md) +- [ADMX_EAIME](policy-csp-admx-eaime.md) +- [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) +- [ADMX_EnhancedStorage](policy-csp-admx-enhancedstorage.md) +- [ADMX_ErrorReporting](policy-csp-admx-errorreporting.md) +- [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) +- [ADMX_EventLog](policy-csp-admx-eventlog.md) +- [ADMX_EventLogging](policy-csp-admx-eventlogging.md) +- [ADMX_EventViewer](policy-csp-admx-eventviewer.md) +- [ADMX_Explorer](policy-csp-admx-explorer.md) +- [ADMX_ExternalBoot](policy-csp-admx-externalboot.md) +- [ADMX_FileRecovery](policy-csp-admx-filerecovery.md) +- [ADMX_FileRevocation](policy-csp-admx-filerevocation.md) +- [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) +- [ADMX_FileSys](policy-csp-admx-filesys.md) +- [ADMX_FolderRedirection](policy-csp-admx-folderredirection.md) +- [ADMX_FramePanes](policy-csp-admx-framepanes.md) +- [ADMX_fthsvc](policy-csp-admx-fthsvc.md) +- [ADMX_Globalization](policy-csp-admx-globalization.md) +- [ADMX_GroupPolicy](policy-csp-admx-grouppolicy.md) +- [ADMX_Help](policy-csp-admx-help.md) +- [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) +- [ADMX_hotspotauth](policy-csp-admx-hotspotauth.md) +- [ADMX_ICM](policy-csp-admx-icm.md) +- [ADMX_IIS](policy-csp-admx-iis.md) +- [ADMX_iSCSI](policy-csp-admx-iscsi.md) +- [ADMX_kdc](policy-csp-admx-kdc.md) +- [ADMX_Kerberos](policy-csp-admx-kerberos.md) +- [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) +- [ADMX_LanmanWorkstation](policy-csp-admx-lanmanworkstation.md) +- [ADMX_LeakDiagnostic](policy-csp-admx-leakdiagnostic.md) +- [ADMX_LinkLayerTopologyDiscovery](policy-csp-admx-linklayertopologydiscovery.md) +- [ADMX_LocationProviderAdm](policy-csp-admx-locationprovideradm.md) +- [ADMX_Logon](policy-csp-admx-logon.md) +- [ADMX_MicrosoftDefenderAntivirus](policy-csp-admx-microsoftdefenderantivirus.md) +- [ADMX_MMC](policy-csp-admx-mmc.md) +- [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) +- [ADMX_MobilePCMobilityCenter](policy-csp-admx-mobilepcmobilitycenter.md) +- [ADMX_MobilePCPresentationSettings](policy-csp-admx-mobilepcpresentationsettings.md) +- [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) +- [ADMX_msched](policy-csp-admx-msched.md) +- [ADMX_MSDT](policy-csp-admx-msdt.md) +- [ADMX_MSI](policy-csp-admx-msi.md) +- [ADMX_MsiFileRecovery](policy-csp-admx-msifilerecovery.md) +- [ADMX_MSS-legacy](policy-csp-admx-mss-legacy.md) +- [ADMX_nca](policy-csp-admx-nca.md) +- [ADMX_NCSI](policy-csp-admx-ncsi.md) +- [ADMX_Netlogon](policy-csp-admx-netlogon.md) +- [ADMX_NetworkConnections](policy-csp-admx-networkconnections.md) +- [ADMX_OfflineFiles](policy-csp-admx-offlinefiles.md) +- [ADMX_pca](policy-csp-admx-pca.md) +- [ADMX_PeerToPeerCaching](policy-csp-admx-peertopeercaching.md) +- [ADMX_PenTraining](policy-csp-admx-pentraining.md) +- [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) +- [ADMX_Power](policy-csp-admx-power.md) +- [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) +- [ADMX_PreviousVersions](policy-csp-admx-previousversions.md) +- [ADMX_Printing](policy-csp-admx-printing.md) +- [ADMX_Printing2](policy-csp-admx-printing2.md) +- [ADMX_Programs](policy-csp-admx-programs.md) +- [ADMX_PushToInstall](policy-csp-admx-pushtoinstall.md) +- [ADMX_QOS](policy-csp-admx-qos.md) +- [ADMX_Radar](policy-csp-admx-radar.md) +- [ADMX_Reliability](policy-csp-admx-reliability.md) +- [ADMX_RemoteAssistance](policy-csp-admx-remoteassistance.md) +- [ADMX_RemovableStorage](policy-csp-admx-removablestorage.md) +- [ADMX_RPC](policy-csp-admx-rpc.md) +- [ADMX_sam](policy-csp-admx-sam.md) +- [ADMX_Scripts](policy-csp-admx-scripts.md) +- [ADMX_sdiageng](policy-csp-admx-sdiageng.md) +- [ADMX_sdiagschd](policy-csp-admx-sdiagschd.md) +- [ADMX_Securitycenter](policy-csp-admx-securitycenter.md) +- [ADMX_Sensors](policy-csp-admx-sensors.md) +- [ADMX_ServerManager](policy-csp-admx-servermanager.md) +- [ADMX_Servicing](policy-csp-admx-servicing.md) +- [ADMX_SettingSync](policy-csp-admx-settingsync.md) +- [ADMX_SharedFolders](policy-csp-admx-sharedfolders.md) +- [ADMX_Sharing](policy-csp-admx-sharing.md) +- [ADMX_ShellCommandPromptRegEditTools](policy-csp-admx-shellcommandpromptregedittools.md) +- [ADMX_Smartcard](policy-csp-admx-smartcard.md) +- [ADMX_Snmp](policy-csp-admx-snmp.md) +- [ADMX_SoundRec](policy-csp-admx-soundrec.md) +- [ADMX_srmfci](policy-csp-admx-srmfci.md) +- [ADMX_StartMenu](policy-csp-admx-startmenu.md) +- [ADMX_SystemRestore](policy-csp-admx-systemrestore.md) +- [ADMX_TabletPCInputPanel](policy-csp-admx-tabletpcinputpanel.md) +- [ADMX_TabletShell](policy-csp-admx-tabletshell.md) +- [ADMX_Taskbar](policy-csp-admx-taskbar.md) +- [ADMX_tcpip](policy-csp-admx-tcpip.md) +- [ADMX_TerminalServer](policy-csp-admx-terminalserver.md) +- [ADMX_Thumbnails](policy-csp-admx-thumbnails.md) +- [ADMX_TouchInput](policy-csp-admx-touchinput.md) +- [ADMX_TPM](policy-csp-admx-tpm.md) +- [ADMX_UserExperienceVirtualization](policy-csp-admx-userexperiencevirtualization.md) +- [ADMX_UserProfiles](policy-csp-admx-userprofiles.md) +- [ADMX_W32Time](policy-csp-admx-w32time.md) +- [ADMX_WCM](policy-csp-admx-wcm.md) +- [ADMX_WDI](policy-csp-admx-wdi.md) +- [ADMX_WinCal](policy-csp-admx-wincal.md) +- [ADMX_WindowsColorSystem](policy-csp-admx-windowscolorsystem.md) +- [ADMX_WindowsConnectNow](policy-csp-admx-windowsconnectnow.md) +- [ADMX_WindowsExplorer](policy-csp-admx-windowsexplorer.md) +- [ADMX_WindowsMediaDRM](policy-csp-admx-windowsmediadrm.md) +- [ADMX_WindowsMediaPlayer](policy-csp-admx-windowsmediaplayer.md) +- [ADMX_WindowsRemoteManagement](policy-csp-admx-windowsremotemanagement.md) +- [ADMX_WindowsStore](policy-csp-admx-windowsstore.md) +- [ADMX_WinInit](policy-csp-admx-wininit.md) +- [ADMX_WinLogon](policy-csp-admx-winlogon.md) +- [ADMX_Winsrv](policy-csp-admx-winsrv.md) +- [ADMX_wlansvc](policy-csp-admx-wlansvc.md) +- [ADMX_WordWheel](policy-csp-admx-wordwheel.md) +- [ADMX_WorkFoldersClient](policy-csp-admx-workfoldersclient.md) +- [ADMX_WPN](policy-csp-admx-wpn.md) +- [ApplicationDefaults](policy-csp-applicationdefaults.md) +- [ApplicationManagement](policy-csp-applicationmanagement.md) +- [AppRuntime](policy-csp-appruntime.md) +- [AppVirtualization](policy-csp-appvirtualization.md) +- [AttachmentManager](policy-csp-attachmentmanager.md) +- [Audit](policy-csp-audit.md) +- [Authentication](policy-csp-authentication.md) +- [Autoplay](policy-csp-autoplay.md) +- [Bitlocker](policy-csp-bitlocker.md) +- [BITS](policy-csp-bits.md) +- [Bluetooth](policy-csp-bluetooth.md) +- [Browser](policy-csp-browser.md) +- [Camera](policy-csp-camera.md) +- [Cellular](policy-csp-cellular.md) +- [CloudPC](policy-csp-cloudpc.md) +- [Connectivity](policy-csp-connectivity.md) +- [ControlPolicyConflict](policy-csp-controlpolicyconflict.md) +- [CredentialProviders](policy-csp-credentialproviders.md) +- [CredentialsDelegation](policy-csp-credentialsdelegation.md) +- [CredentialsUI](policy-csp-credentialsui.md) +- [Cryptography](policy-csp-cryptography.md) +- [DataProtection](policy-csp-dataprotection.md) +- [DataUsage](policy-csp-datausage.md) +- [Defender](policy-csp-defender.md) +- [DeliveryOptimization](policy-csp-deliveryoptimization.md) +- [Desktop](policy-csp-desktop.md) +- [DesktopAppInstaller](policy-csp-desktopappinstaller.md) +- [DeviceGuard](policy-csp-deviceguard.md) +- [DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md) +- [DeviceInstallation](policy-csp-deviceinstallation.md) +- [DeviceLock](policy-csp-devicelock.md) +- [Display](policy-csp-display.md) +- [DmaGuard](policy-csp-dmaguard.md) +- [Eap](policy-csp-eap.md) +- [Education](policy-csp-education.md) +- [EnterpriseCloudPrint](policy-csp-enterprisecloudprint.md) +- [ErrorReporting](policy-csp-errorreporting.md) +- [EventLogService](policy-csp-eventlogservice.md) +- [Experience](policy-csp-experience.md) +- [ExploitGuard](policy-csp-exploitguard.md) +- [FederatedAuthentication](policy-csp-federatedauthentication.md) +- [FileExplorer](policy-csp-fileexplorer.md) +- [Games](policy-csp-games.md) +- [Handwriting](policy-csp-handwriting.md) +- [HumanPresence](policy-csp-humanpresence.md) +- [InternetExplorer](policy-csp-internetexplorer.md) +- [Kerberos](policy-csp-kerberos.md) +- [KioskBrowser](policy-csp-kioskbrowser.md) +- [LanmanWorkstation](policy-csp-lanmanworkstation.md) +- [Licensing](policy-csp-licensing.md) +- [LocalPoliciesSecurityOptions](policy-csp-localpoliciessecurityoptions.md) +- [LocalSecurityAuthority](policy-csp-lsa.md) +- [LocalUsersAndGroups](policy-csp-localusersandgroups.md) +- [LockDown](policy-csp-lockdown.md) +- [Maps](policy-csp-maps.md) +- [MemoryDump](policy-csp-memorydump.md) +- [Messaging](policy-csp-messaging.md) +- [MixedReality](policy-csp-mixedreality.md) +- [MSSecurityGuide](policy-csp-mssecurityguide.md) +- [MSSLegacy](policy-csp-msslegacy.md) +- [Multitasking](policy-csp-multitasking.md) +- [NetworkIsolation](policy-csp-networkisolation.md) +- [NetworkListManager](policy-csp-networklistmanager.md) +- [NewsAndInterests](policy-csp-newsandinterests.md) +- [Notifications](policy-csp-notifications.md) +- [Power](policy-csp-power.md) +- [Printers](policy-csp-printers.md) +- [Privacy](policy-csp-privacy.md) +- [RemoteAssistance](policy-csp-remoteassistance.md) +- [RemoteDesktop](policy-csp-remotedesktop.md) +- [RemoteDesktopServices](policy-csp-remotedesktopservices.md) +- [RemoteManagement](policy-csp-remotemanagement.md) +- [RemoteProcedureCall](policy-csp-remoteprocedurecall.md) +- [RemoteShell](policy-csp-remoteshell.md) +- [RestrictedGroups](policy-csp-restrictedgroups.md) +- [Search](policy-csp-search.md) +- [Security](policy-csp-security.md) +- [ServiceControlManager](policy-csp-servicecontrolmanager.md) +- [Settings](policy-csp-settings.md) +- [SettingsSync](policy-csp-settingssync.md) +- [SmartScreen](policy-csp-smartscreen.md) +- [Speech](policy-csp-speech.md) +- [Start](policy-csp-start.md) +- [Stickers](policy-csp-stickers.md) +- [Storage](policy-csp-storage.md) +- [System](policy-csp-system.md) +- [SystemServices](policy-csp-systemservices.md) +- [TaskManager](policy-csp-taskmanager.md) +- [TaskScheduler](policy-csp-taskscheduler.md) +- [TenantDefinedTelemetry](policy-csp-tenantdefinedtelemetry.md) +- [TenantRestrictions](policy-csp-tenantrestrictions.md) +- [TextInput](policy-csp-textinput.md) +- [TimeLanguageSettings](policy-csp-timelanguagesettings.md) +- [Troubleshooting](policy-csp-troubleshooting.md) +- [Update](policy-csp-update.md) +- [UserRights](policy-csp-userrights.md) +- [VirtualizationBasedTechnology](policy-csp-virtualizationbasedtechnology.md) +- [WebThreatDefense](policy-csp-webthreatdefense.md) +- [Wifi](policy-csp-wifi.md) +- [WindowsAutopilot](policy-csp-windowsautopilot.md) +- [WindowsConnectionManager](policy-csp-windowsconnectionmanager.md) +- [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md) +- [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md) +- [WindowsLogon](policy-csp-windowslogon.md) +- [WindowsPowerShell](policy-csp-windowspowershell.md) +- [WindowsSandbox](policy-csp-windowssandbox.md) +- [WirelessDisplay](policy-csp-wirelessdisplay.md) + + + + + + +## Related articles + +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md new file mode 100644 index 0000000000..9fd3985c30 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -0,0 +1,806 @@ +--- +title: ADMX_MSS-legacy Policy CSP +description: Learn more about the ADMX_MSS-legacy CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - ADMX_MSS-legacy + + + + + + +## Pol_MSS_AutoAdminLogon + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_AutoAdminLogon +``` + + + + + + + + +Enable Automatic Logon (not recommended). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_AutoReboot + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_AutoReboot +``` + + + + + + + + +Allow Windows to automatically restart after a system crash (recommended except for highly secure environments). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_AutoShareServer + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_AutoShareServer +``` + + + + + + + + +Enable administrative shares on servers (recommended except for highly secure environments). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_AutoShareWks + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_AutoShareWks +``` + + + + + + + + +Enable administrative shares on workstations (recommended except for highly secure environments). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_DisableSavePassword + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_DisableSavePassword +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + +Prevent the dial-up password from being saved (recommended). + + + + + +## Pol_MSS_EnableDeadGWDetect + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_EnableDeadGWDetect +``` + + + + + + + + +Allow automatic detection of dead network gateways (could lead to DoS). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_HideFromBrowseList + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_HideFromBrowseList +``` + + + + + + + + +Hide Computer From the Browse List (not recommended except for highly secure environments). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_KeepAliveTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_KeepAliveTime +``` + + + + + + + + +Define how often keep-alive packets are sent in milliseconds. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_NoDefaultExempt + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_NoDefaultExempt +``` + + + + + + + + +Configure IPSec exemptions for various types of network traffic. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_NtfsDisable8dot3NameCreation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_NtfsDisable8dot3NameCreation +``` + + + + + + + + +Enable the computer to stop generating 8.3 style filenames. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_PerformRouterDiscovery + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_PerformRouterDiscovery +``` + + + + + + + + + Allow IRDP to detect and configure Default Gateway addresses (could lead to DoS). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_SafeDllSearchMode + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_SafeDllSearchMode +``` + + + + + + + + +Enable Safe DLL search mode (recommended). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_ScreenSaverGracePeriod + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_ScreenSaverGracePeriod +``` + + + + + + + + +he time in seconds before the screen saver grace period expires (0 recommended). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_SynAttackProtect + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_SynAttackProtect +``` + + + + + + + + +Syn attack protection level (protects against DoS). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_TcpMaxConnectResponseRetransmissions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_TcpMaxConnectResponseRetransmissions +``` + + + + + + + + +SYN-ACK retransmissions when a connection request is not acknowledged. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_TcpMaxDataRetransmissions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_TcpMaxDataRetransmissions +``` + + + + + + + + +Define how many times unacknowledged data is retransmitted (3 recommended, 5 is default). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_TcpMaxDataRetransmissionsIPv6 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_TcpMaxDataRetransmissionsIPv6 +``` + + + + + + + + +Define how many times unacknowledged data is retransmitted (3 recommended, 5 is default). + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + +## Pol_MSS_WarningLevel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_WarningLevel +``` + + + + + + + + +Percentage threshold for the security event log at which the system will generate a warning. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md new file mode 100644 index 0000000000..7d57c3d4a1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -0,0 +1,1139 @@ +--- +title: ADMX_QOS Policy CSP +description: Learn more about the ADMX_QOS CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - ADMX_QOS + + + + + + +## QosMaxOutstandingSends + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosMaxOutstandingSends +``` + + + +Specifies the maximum number of outstanding packets permitted on the system. When the number of outstanding packets reaches this limit, the Packet Scheduler postpones all submissions to network adapters until the number falls below this limit. + +"Outstanding packets" are packets that the Packet Scheduler has submitted to a network adapter for transmission, but which have not yet been sent. + +If you enable this setting, you can limit the number of outstanding packets. + +If you disable this setting or do not configure it, then the setting has no effect on the system. + +Important: If the maximum number of outstanding packets is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosMaxOutstandingSends | +| Friendly Name | Limit outstanding packets | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosNonBestEffortLimit + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosNonBestEffortLimit +``` + + + +Determines the percentage of connection bandwidth that the system can reserve. This value limits the combined bandwidth reservations of all programs running on the system. + +By default, the Packet Scheduler limits the system to 80 percent of the bandwidth of a connection, but you can use this setting to override the default. + +If you enable this setting, you can use the "Bandwidth limit" box to adjust the amount of bandwidth the system can reserve. + +If you disable this setting or do not configure it, the system uses the default value of 80 percent of the connection. + +Important: If a bandwidth limit is set for a particular network adapter in the registry, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosNonBestEffortLimit | +| Friendly Name | Limit reservable bandwidth | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeBestEffort_C + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeBestEffort_C +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Best Effort service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeBestEffort_C | +| Friendly Name | Best effort service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeBestEffort_NC + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeBestEffort_NC +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that do not conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Best Effort service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeBestEffort_NC | +| Friendly Name | Best effort service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of non-conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeBestEffort_PV + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeBestEffort_PV +``` + + + +Specifies an alternate link layer (Layer-2) priority value for packets with the Best Effort service type (ServiceTypeBestEffort). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets. + +If you enable this setting, you can change the default priority value associated with the Best Effort service type. + +If you disable this setting, the system uses the default priority value of 0. + +Important: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeBestEffort_PV | +| Friendly Name | Best effort service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > Layer-2 priority value | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeControlledLoad_C + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeControlledLoad_C +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Controlled Load service type. + +If you disable this setting, the system uses the default DSCP value of 24 (0x18). + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeControlledLoad_C | +| Friendly Name | Controlled load service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeControlledLoad_NC + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeControlledLoad_NC +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that do not conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Controlled Load service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeControlledLoad_NC | +| Friendly Name | Controlled load service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of non-conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeControlledLoad_PV + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeControlledLoad_PV +``` + + + +Specifies an alternate link layer (Layer-2) priority value for packets with the Controlled Load service type (ServiceTypeControlledLoad). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets. + +If you enable this setting, you can change the default priority value associated with the Controlled Load service type. + +If you disable this setting, the system uses the default priority value of 0. + +Important: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeControlledLoad_PV | +| Friendly Name | Controlled load service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > Layer-2 priority value | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeGuaranteed_C + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeGuaranteed_C +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Guaranteed service type. + +If you disable this setting, the system uses the default DSCP value of 40 (0x28). + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeGuaranteed_C | +| Friendly Name | Guaranteed service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeGuaranteed_NC + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeGuaranteed_NC +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that do not conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Guaranteed service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeGuaranteed_NC | +| Friendly Name | Guaranteed service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of non-conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeGuaranteed_PV + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeGuaranteed_PV +``` + + + +Specifies an alternate link layer (Layer-2) priority value for packets with the Guaranteed service type (ServiceTypeGuaranteed). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets. + +If you enable this setting, you can change the default priority value associated with the Guaranteed service type. + +If you disable this setting, the system uses the default priority value of 0. + +Important: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeGuaranteed_PV | +| Friendly Name | Guaranteed service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > Layer-2 priority value | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeNetworkControl_C + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeNetworkControl_C +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type (ServiceTypeNetworkControl). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Network Control service type. + +If you disable this setting, the system uses the default DSCP value of 48 (0x30). + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeNetworkControl_C | +| Friendly Name | Network control service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeNetworkControl_NC + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeNetworkControl_NC +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Network Control service type (ServiceTypeNetworkControl). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that do not conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Network Control service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeNetworkControl_NC | +| Friendly Name | Network control service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of non-conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeNetworkControl_PV + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeNetworkControl_PV +``` + + + +Specifies an alternate link layer (Layer-2) priority value for packets with the Network Control service type (ServiceTypeNetworkControl). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets. + +If you enable this setting, you can change the default priority value associated with the Network Control service type. + +If you disable this setting, the system uses the default priority value of 0. + +Important: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeNetworkControl_PV | +| Friendly Name | Network control service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > Layer-2 priority value | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeNonConforming + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeNonConforming +``` + + + +Specifies an alternate link layer (Layer-2) priority value for packets that do not conform to the flow specification. The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets. + +If you enable this setting, you can change the default priority value associated with nonconforming packets. + +If you disable this setting, the system uses the default priority value of 0. + +Important: If the Layer-2 priority value for nonconforming packets is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeNonConforming | +| Friendly Name | Non-conforming packets | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > Layer-2 priority value | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeQualitative_C + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeQualitative_C +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (ServiceTypeQualitative). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Qualitative service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeQualitative_C | +| Friendly Name | Qualitative service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeQualitative_NC + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeQualitative_NC +``` + + + +Specifies an alternate Layer-3 Differentiated Services Code Point (DSCP) value for packets with the Qualitative service type (ServiceTypeQualitative). The Packet Scheduler inserts the corresponding DSCP value in the IP header of the packets. + +This setting applies only to packets that do not conform to the flow specification. + +If you enable this setting, you can change the default DSCP value associated with the Qualitative service type. + +If you disable this setting, the system uses the default DSCP value of 0. + +Important: If the DSCP value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeQualitative_NC | +| Friendly Name | Qualitative service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > DSCP value of non-conforming packets | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\DiffservByteMappingNonConforming | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosServiceTypeQualitative_PV + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosServiceTypeQualitative_PV +``` + + + +Specifies an alternate link layer (Layer-2) priority value for packets with the Qualitative service type (ServiceTypeQualitative). The Packet Scheduler inserts the corresponding priority value in the Layer-2 header of the packets. + +If you enable this setting, you can change the default priority value associated with the Qualitative service type. + +If you disable this setting, the system uses the default priority value of 0. + +Important: If the Layer-2 priority value for this service type is specified in the registry for a particular network adapter, this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosServiceTypeQualitative_PV | +| Friendly Name | Qualitative service type | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler > Layer-2 priority value | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched\UserPriorityMapping | +| ADMX File Name | QOS.admx | + + + + + + + + + +## QosTimerResolution + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_QOS/QosTimerResolution +``` + + + +Determines the smallest unit of time that the Packet Scheduler uses when scheduling packets for transmission. The Packet Scheduler cannot schedule packets for transmission more frequently than permitted by the value of this entry. + +If you enable this setting, you can override the default timer resolution established for the system, usually units of 10 microseconds. + +If you disable this setting or do not configure it, the setting has no effect on the system. + +Important: If a timer resolution is specified in the registry for a particular network adapter, then this setting is ignored when configuring that network adapter. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | QosTimerResolution | +| Friendly Name | Set timer resolution | +| Location | Computer Configuration | +| Path | Network > QoS Packet Scheduler | +| Registry Key Name | Software\Policies\Microsoft\Windows\Psched | +| ADMX File Name | QOS.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md new file mode 100644 index 0000000000..66267fea76 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -0,0 +1,1032 @@ +--- +title: ADMX_TabletPCInputPanel Policy CSP +description: Learn more about the ADMX_TabletPCInputPanel CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - ADMX_TabletPCInputPanel + + + + + + +## AutoComplete_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/AutoComplete_2 +``` + + + +Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, application auto complete lists will never appear next to Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will be able to configure this setting on the Text completion tab in Input Panel Options. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoComplete | +| Friendly Name | Turn off AutoComplete integration with Input Panel | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | DisableACIntegration | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## EdgeTarget_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/EdgeTarget_2 +``` + + + +Prevents Input Panel tab from appearing on the edge of the Tablet PC screen. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel tab will not appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will be able to configure this setting on the Opening tab in Input Panel Options. + +Caution: If you enable both the “Prevent Input Panel from appearing next to text entry areas” policy and the “Prevent Input Panel tab from appearing” policy, and disable the “Show Input Panel taskbar icon” policy, the user will then have no way to access Input Panel. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EdgeTarget | +| Friendly Name | Prevent Input Panel tab from appearing | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | DisableEdgeTarget | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## IPTIPTarget_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/IPTIPTarget_2 +``` + + + +Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when using a tablet pen as an input device. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel will never appear next to text entry areas when using a tablet pen as an input device. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel will appear next to any text entry area in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options. + +Caution: If you enable both the “Prevent Input Panel from appearing next to text entry areas” policy and the “Prevent Input Panel tab from appearing” policy, and disable the “Show Input Panel taskbar icon” policy, the user will then have no way to access Input Panel. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | IPTIPTarget | +| Friendly Name | For tablet pen input, don’t show the Input Panel icon | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | HideIPTIPTarget | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## IPTIPTouchTarget_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/IPTIPTouchTarget_2 +``` + + + +Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when a user is using touch input. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel will never appear next to any text entry area when a user is using touch input. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | IPTIPTouchTarget | +| Friendly Name | For touch input, don’t show the Input Panel icon | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | HideIPTIPTouchTarget | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## PasswordSecurity_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/PasswordSecurity_2 +``` + + + +Adjusts password security settings in Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista). These settings include using the on-screen keyboard by default, preventing users from switching to another Input Panel skin (the writing pad or character pad), and not showing what keys are tapped when entering a password. + +Touch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy and choose “Low” from the drop-down box, password security is set to “Low.” At this setting, all password security settings are turned off. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “Medium-Low” from the drop-down box, password security is set to “Medium-Low.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “Medium” from the drop-down box, password security is set to “Medium.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose to “Medium-High” from the drop-down box, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “High” from the drop-down box, password security is set to “High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, password security is set to “Medium-High” by default. At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will be able to configure this setting on the Advanced tab in Input Panel Options in Windows 7 and Windows Vista. + +Caution: If you lower password security settings, people who can see the user’s screen might be able to see their passwords. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | PasswordSecurity | +| Friendly Name | Turn off password security in Input Panel | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | PasswordSecurityState | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## Prediction_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/Prediction_2 +``` + + + +Prevents the Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista) from providing text prediction suggestions. This policy applies for both the on-screen keyboard and the handwriting tab when the feature is available for the current input area and input language. + +Touch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel will not provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel will provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel will provide text prediction suggestions. Users will be able to configure this setting on the Text Completion tab in Input Panel Options in Windows 7 and Windows Vista. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnablePrediction | +| Friendly Name | Disable text prediction | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | DisablePrediction | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## RareChar_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/RareChar_2 +``` + + + +Includes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies only to the use of the Microsoft recognizers for Chinese (Simplified), Chinese (Traditional), Japanese, and Korean. This setting appears in Input Panel Options (in Windows 7 and Windows Vista only) only when these input languages or keyboards are installed. + +Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista) enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, rarely used Chinese, Kanji, and Hanja characters will be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will be able to configure this setting on the Ink to text conversion tab in Input Panel Options (in Windows 7 and Windows Vista). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | RareChar | +| Friendly Name | Include rarely used Chinese, Kanji, or Hanja characters | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | IncludeRareChar | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## ScratchOut_2 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/ScratchOut_2 +``` + + + +Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. + +The tolerant gestures let users scratch out ink in Input Panel by using strikethrough and other scratch-out gesture shapes. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy and choose “All” from the drop-down menu, no scratch-out gestures will be available in Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “Tolerant," users will be able to use the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “None,” users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will be able to configure this setting on the Gestures tab in Input Panel Options. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | ScratchOut | +| Friendly Name | Turn off tolerant and Z-shaped scratch-out gestures | +| Location | Computer Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | ScratchOutState | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## AutoComplete_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/AutoComplete_1 +``` + + + +Turns off the integration of application auto complete lists with Tablet PC Input Panel in applications where this behavior is available. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, application auto complete lists will never appear next to Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, application auto complete lists will appear next to Input Panel in applications where the functionality is available. Users will be able to configure this setting on the Text completion tab in Input Panel Options. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | AutoComplete | +| Friendly Name | Turn off AutoComplete integration with Input Panel | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | DisableACIntegration | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## EdgeTarget_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/EdgeTarget_1 +``` + + + +Prevents Input Panel tab from appearing on the edge of the Tablet PC screen. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel tab will not appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel tab will appear on the edge of the Tablet PC screen. Users will be able to configure this setting on the Opening tab in Input Panel Options. + +Caution: If you enable both the “Prevent Input Panel from appearing next to text entry areas” policy and the “Prevent Input Panel tab from appearing” policy, and disable the “Show Input Panel taskbar icon” policy, the user will then have no way to access Input Panel. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EdgeTarget | +| Friendly Name | Prevent Input Panel tab from appearing | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | DisableEdgeTarget | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## IPTIPTarget_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/IPTIPTarget_1 +``` + + + +Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when using a tablet pen as an input device. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel will never appear next to text entry areas when using a tablet pen as an input device. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel will appear next to any text entry area in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options. + +Caution: If you enable both the “Prevent Input Panel from appearing next to text entry areas” policy and the “Prevent Input Panel tab from appearing” policy, and disable the “Show Input Panel taskbar icon” policy, the user will then have no way to access Input Panel. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | IPTIPTarget | +| Friendly Name | For tablet pen input, don’t show the Input Panel icon | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | HideIPTIPTarget | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## IPTIPTouchTarget_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/IPTIPTouchTarget_1 +``` + + + +Prevents the Tablet PC Input Panel icon from appearing next to any text entry area in applications where this behavior is available. This policy applies only when a user is using touch input. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel will never appear next to any text entry area when a user is using touch input. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel will appear next to text entry areas in applications where this behavior is available. Users will be able to configure this setting on the Opening tab in Input Panel Options. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | IPTIPTouchTarget | +| Friendly Name | For touch input, don’t show the Input Panel icon | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | HideIPTIPTouchTarget | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## PasswordSecurity_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/PasswordSecurity_1 +``` + + + +Adjusts password security settings in Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista). These settings include using the on-screen keyboard by default, preventing users from switching to another Input Panel skin (the writing pad or character pad), and not showing what keys are tapped when entering a password. + +Touch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy and choose “Low” from the drop-down box, password security is set to “Low.” At this setting, all password security settings are turned off. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “Medium-Low” from the drop-down box, password security is set to “Medium-Low.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “Medium” from the drop-down box, password security is set to “Medium.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel displays the cursor and which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose to “Medium-High” from the drop-down box, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “High” from the drop-down box, password security is set to “High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is not allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, password security is set to “Medium-High.” At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, password security is set to “Medium-High” by default. At this setting, when users enter passwords from Input Panel they use the on-screen keyboard by default, skin switching is allowed, and Input Panel does not display the cursor or which keys are tapped. Users will be able to configure this setting on the Advanced tab in Input Panel Options in Windows 7 and Windows Vista. + +Caution: If you lower password security settings, people who can see the user’s screen might be able to see their passwords. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | PasswordSecurity | +| Friendly Name | Turn off password security in Input Panel | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | PasswordSecurityState | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## Prediction_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/Prediction_1 +``` + + + +Prevents the Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista) from providing text prediction suggestions. This policy applies for both the on-screen keyboard and the handwriting tab when the feature is available for the current input area and input language. + +Touch Keyboard and Handwriting panel enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, Input Panel will not provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, Input Panel will provide text prediction suggestions. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, Input Panel will provide text prediction suggestions. Users will be able to configure this setting on the Text Completion tab in Input Panel Options in Windows 7 and Windows Vista. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | EnablePrediction | +| Friendly Name | Disable text prediction | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | DisablePrediction | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## RareChar_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/RareChar_1 +``` + + + +Includes rarely used Chinese, Kanji, and Hanja characters when handwriting is converted to typed text. This policy applies only to the use of the Microsoft recognizers for Chinese (Simplified), Chinese (Traditional), Japanese, and Korean. This setting appears in Input Panel Options (in Windows 7 and Windows Vista only) only when these input languages or keyboards are installed. + +Touch Keyboard and Handwriting panel (a.k.a. Tablet PC Input Panel in Windows 7 and Windows Vista) enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy, rarely used Chinese, Kanji, and Hanja characters will be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, rarely used Chinese, Kanji, and Hanja characters will not be included in recognition results when handwriting is converted to typed text. Users will be able to configure this setting on the Ink to text conversion tab in Input Panel Options (in Windows 7 and Windows Vista). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | RareChar | +| Friendly Name | Include rarely used Chinese, Kanji, or Hanja characters | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | IncludeRareChar | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + +## ScratchOut_1 + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```User +./User/Vendor/MSFT/Policy/Config/ADMX_TabletPCInputPanel/ScratchOut_1 +``` + + + +Turns off both the more tolerant scratch-out gestures that were added in Windows Vista and the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. + +The tolerant gestures let users scratch out ink in Input Panel by using strikethrough and other scratch-out gesture shapes. + +Tablet PC Input Panel is a Tablet PC accessory that enables you to use handwriting or an on-screen keyboard to enter text, symbols, numbers, or keyboard shortcuts. + +If you enable this policy and choose “All” from the drop-down menu, no scratch-out gestures will be available in Input Panel. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “Tolerant," users will be able to use the Z-shaped scratch-out gesture that was available in Microsoft Windows XP Tablet PC Edition. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you enable this policy and choose “None,” users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you disable this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will not be able to configure this setting in the Input Panel Options dialog box. + +If you do not configure this policy, users will be able to use both the tolerant scratch-out gestures and the Z-shaped scratch-out gesture. Users will be able to configure this setting on the Gestures tab in Input Panel Options. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | ScratchOut | +| Friendly Name | Turn off tolerant and Z-shaped scratch-out gestures | +| Location | User Configuration | +| Path | WindowsComponents > Tablet PC > Input Panel | +| Registry Key Name | software\policies\microsoft\TabletTip\1.7 | +| Registry Value Name | ScratchOutState | +| ADMX File Name | TabletPCInputPanel.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 9b84b9e141..e76be954c3 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -898,7 +898,7 @@ You can configure ASR rules in the Configure Attack Surface Reduction rules GP s | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -988,7 +988,7 @@ You can exclude folders or files in the ""Exclude files and paths from Attack Su | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | @@ -1305,7 +1305,7 @@ Default system folders are automatically guarded, but you can add folders in the | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -1377,7 +1377,7 @@ Microsoft Defender Antivirus automatically determines which applications can be | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -1874,7 +1874,7 @@ Allows an administrator to specify a list of file type extensions to ignore duri | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -1928,7 +1928,7 @@ Allows an administrator to specify a list of directory paths to ignore during a | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -1982,7 +1982,7 @@ Allows an administrator to specify a list of files opened by processes to ignore | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -2461,7 +2461,7 @@ If you disable or do not configure this setting, security intelligence will be r | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | @@ -2519,7 +2519,7 @@ If you disable or do not configure this setting, security intelligence update so | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -2576,7 +2576,7 @@ If you disable or do not configure this setting, the list will remain empty by d | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | | Allowed Values | List (Delimiter: `|`) | @@ -2759,7 +2759,7 @@ Allows an administrator to specify any valid threat severity levels and the corr | Property name | Property value | |:--|:--| -| Format | chr | +| Format | chr (string) | | Access Type | Add, Delete, Get, Replace | diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 69fb84b6e9..43921b19b7 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,211 +1,204 @@ --- -title: Policy CSP - MSSLegacy -description: Learn how Policy CSP - MSSLegacy, an ADMX-backed policy, requires a special SyncML format to enable or disable. -ms.author: vinpa -ms.topic: article -ms.prod: windows-client -ms.technology: itpro-manage +title: MSSLegacy Policy CSP +description: Learn more about the MSSLegacy CSP Policy author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 09/27/2019 -ms.reviewer: manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article --- + + + # Policy CSP - MSSLegacy -
+ + + - -## MSSLegacy policies + +## AllowICMPRedirectsToOverrideOSPFGeneratedRoutes -
-
- MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes -
-
- MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers -
-
- MSSLegacy/IPSourceRoutingProtectionLevel -
-
- MSSLegacy/IPv6SourceRoutingProtectionLevel -
-
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -> [!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + +```Device +./Device/Vendor/MSFT/Policy/Config/MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes +``` + -
+ + + - -**MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes** + + +Allow ICMP redirects to override OSPF generated routes. + - + +**Description framework properties**: -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - -
+ + + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+ +## AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers - - + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + - + +```Device +./Device/Vendor/MSFT/Policy/Config/MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers +``` + - -ADMX Info: -- GP name: *Pol_MSS_EnableICMPRedirect* -- GP ADMX file name: *mss-legacy.admx* + + + - - + + +Allow the computer to ignore NetBIOS name release requests except from WINS servers. + -
+ +**Description framework properties**: - -**MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers** +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## IPSourceRoutingProtectionLevel -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/MSSLegacy/IPSourceRoutingProtectionLevel +``` + - - + + + - + + +IP source routing protection level (protects against packet spoofing). + + +**Description framework properties**: - -ADMX Info: -- GP name: *Pol_MSS_NoNameReleaseOnDemand* -- GP ADMX file name: *mss-legacy.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - + + + -
+ + + - -**MSSLegacy/IPSourceRoutingProtectionLevel** + - + +## IPv6SourceRoutingProtectionLevel -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + - -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/MSSLegacy/IPv6SourceRoutingProtectionLevel +``` + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + + +IPv6 source routing protection level (protects against packet spoofing). + -
+ +**Description framework properties**: - - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - + + + - -ADMX Info: -- GP name: *Pol_MSS_DisableIPSourceRouting* -- GP ADMX file name: *mss-legacy.admx* + + + - - + -
+ + + - -**MSSLegacy/IPv6SourceRoutingProtectionLevel** + - +## Related articles -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - - - - - -ADMX Info: -- GP name: *Pol_MSS_DisableIPSourceRoutingIPv6* -- GP ADMX file name: *mss-legacy.admx* - - - -
- - - - -## Related topics - -[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md new file mode 100644 index 0000000000..dd6e6688f3 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -0,0 +1,90 @@ +--- +title: SettingsSync Policy CSP +description: Learn more about the SettingsSync CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - SettingsSync + + + + + + +## DisableAccessibilitySettingSync + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/SettingsSync/DisableAccessibilitySettingSync +``` + + + +Prevent the "accessibility" group from syncing to and from this PC. This turns off and disables the "accessibility" group on the "Windows backup" settings page in PC settings. + +If you enable this policy setting, the "accessibility", group will not be synced. + +Use the option "Allow users to turn accessibility syncing on" so that syncing is turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "accessibility" group is on by default and configurable by the user. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DisableAccessibilitySettingSync | +| Friendly Name | Do not sync accessibility settings | +| Location | Computer Configuration | +| Path | Windows Components > Sync your settings | +| Registry Key Name | Software\Policies\Microsoft\Windows\SettingSync | +| Registry Value Name | DisableAccessibilitySettingSync | +| ADMX File Name | SettingSync.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md new file mode 100644 index 0000000000..dc23e0f9a1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -0,0 +1,92 @@ +--- +title: TenantRestrictions Policy CSP +description: Learn more about the TenantRestrictions CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - TenantRestrictions + + + + + + +## ConfigureTenantRestrictions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Unknown [10.0.20348.320] and later
:heavy_check_mark: Windows 10, version 2004 [10.0.19041.1320] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1320] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1320] and later
:heavy_check_mark: Windows 10, version 21H2 [10.0.19044] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/TenantRestrictions/ConfigureTenantRestrictions +``` + + + +This setting enables and configures the device-based tenant restrictions feature for Azure Active Directory. + +When you enable this setting, compliant applications will be prevented from accessing disallowed tenants, according to a policy set in your Azure AD tenant. + +Note: Creation of a policy in your home tenant is required, and additional security measures for managed devices are recommended for best protection. Refer to Azure AD Tenant Restrictions for more details. + +https://go.microsoft.com/fwlink/?linkid=2148762 + +Before enabling firewall protection, ensure that a Windows Defender Application Control (WDAC) policy that correctly tags applications has been applied to the target devices. Enabling firewall protection without a corresponding WDAC policy will prevent all applications from reaching Microsoft endpoints. This firewall setting is not supported on all versions of Windows - see the following link for more information. +For details about setting up WDAC with tenant restrictions, see https://go.microsoft.com/fwlink/?linkid=2155230 + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | trv2_payload | +| Friendly Name | Cloud Policy Details | +| Location | Computer Configuration | +| Path | Windows Components > Tenant Restrictions | +| Registry Key Name | SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload | +| ADMX File Name | TenantRestrictions.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 8a09a4ba72..c7458eaa49 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -210,6 +210,8 @@ items: href: policy-csp-admx-msi.md - name: ADMX_MsiFileRecovery href: policy-csp-admx-msifilerecovery.md + - name: ADMX_MSS-legacy + href: policy-csp-admx-mss-legacy.md - name: ADMX_nca href: policy-csp-admx-nca.md - name: ADMX_NCSI @@ -240,6 +242,8 @@ items: href: policy-csp-admx-printing2.md - name: ADMX_Programs href: policy-csp-admx-programs.md + - name: ADMX_QOS + href: policy-csp-admx-qos.md - name: ADMX_Reliability href: policy-csp-admx-reliability.md - name: ADMX_RemoteAssistance @@ -278,6 +282,8 @@ items: href: policy-csp-admx-startmenu.md - name: ADMX_SystemRestore href: policy-csp-admx-systemrestore.md + - name: ADMX_TabletPCInputPanel + href: policy-csp-admx-tabletpcinputpanel.md - name: ADMX_TabletShell href: policy-csp-admx-tabletshell.md - name: ADMX_Taskbar @@ -488,6 +494,8 @@ items: href: policy-csp-servicecontrolmanager.md - name: Settings href: policy-csp-settings.md + - name: SettingsSync + href: policy-csp-settingssync.md - name: Speech href: policy-csp-speech.md - name: Start @@ -502,6 +510,8 @@ items: href: policy-csp-taskmanager.md - name: TaskScheduler href: policy-csp-taskscheduler.md + - name: TenantRestrictions + href: policy-csp-tenantrestrictions.md - name: TextInput href: policy-csp-textinput.md - name: TimeLanguageSettings From 3e364eb30f4b4e9ad1c23d44b651851b84abddff Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 1 Nov 2022 16:35:23 -0400 Subject: [PATCH 004/324] Add more missing areas, and fixes. --- ...in-policy-csp-supported-by-group-policy.md | 1464 ++++++++--------- .../policy-configuration-service-provider.md | 50 +- .../mdm/policy-csp-admx-sam.md | 107 ++ .../mdm/policy-csp-cloudpc.md | 80 + .../mdm/policy-csp-stickers.md | 80 + .../mdm/policy-csp-tenantdefinedtelemetry.md | 81 + windows/client-management/mdm/toc.yml | 8 + 7 files changed, 1137 insertions(+), 733 deletions(-) create mode 100644 windows/client-management/mdm/policy-csp-admx-sam.md create mode 100644 windows/client-management/mdm/policy-csp-cloudpc.md create mode 100644 windows/client-management/mdm/policy-csp-stickers.md create mode 100644 windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index c6bf79ea9c..43d727892e 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -20,918 +20,918 @@ This article lists the policies in Policy CSP that have a group policy mapping. ## AboveLock -- [AllowCortanaAboveLock](policy-csp-abovelock.md#abovelock-allowcortanaabovelock) +- [AllowCortanaAboveLock](policy-csp-abovelock.md) ## Accounts -- [RestrictToEnterpriseDeviceAuthenticationOnly](policy-csp-accounts.md#accounts-restricttoenterprisedeviceauthenticationonly) +- [RestrictToEnterpriseDeviceAuthenticationOnly](policy-csp-accounts.md) ## ApplicationDefaults -- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) -- [EnableAppUriHandlers](policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) +- [DefaultAssociationsConfiguration](policy-csp-applicationdefaults.md) +- [EnableAppUriHandlers](policy-csp-applicationdefaults.md) ## ApplicationManagement -- [RequirePrivateStoreOnly](policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) -- [MSIAlwaysInstallWithElevatedPrivileges](policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) -- [AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [AllowAutomaticAppArchiving](policy-csp-applicationmanagement.md#applicationmanagement-allowautomaticapparchiving) -- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [AllowGameDVR](policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) -- [AllowSharedUserAppData](policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) -- [RequirePrivateStoreOnly](policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) -- [MSIAlwaysInstallWithElevatedPrivileges](policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) -- [MSIAllowUserControlOverInstall](policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) -- [RestrictAppDataToSystemVolume](policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) -- [RestrictAppToSystemVolume](policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) -- [DisableStoreOriginatedApps](policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) -- [BlockNonAdminUserInstall](policy-csp-applicationmanagement.md#applicationmanagement-blocknonadminuserinstall) +- [RequirePrivateStoreOnly](policy-csp-applicationmanagement.md) +- [MSIAlwaysInstallWithElevatedPrivileges](policy-csp-applicationmanagement.md) +- [AllowAllTrustedApps](policy-csp-applicationmanagement.md) +- [AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md) +- [AllowAutomaticAppArchiving](policy-csp-applicationmanagement.md) +- [AllowDeveloperUnlock](policy-csp-applicationmanagement.md) +- [AllowGameDVR](policy-csp-applicationmanagement.md) +- [AllowSharedUserAppData](policy-csp-applicationmanagement.md) +- [RequirePrivateStoreOnly](policy-csp-applicationmanagement.md) +- [MSIAlwaysInstallWithElevatedPrivileges](policy-csp-applicationmanagement.md) +- [MSIAllowUserControlOverInstall](policy-csp-applicationmanagement.md) +- [RestrictAppDataToSystemVolume](policy-csp-applicationmanagement.md) +- [RestrictAppToSystemVolume](policy-csp-applicationmanagement.md) +- [DisableStoreOriginatedApps](policy-csp-applicationmanagement.md) +- [BlockNonAdminUserInstall](policy-csp-applicationmanagement.md) ## Audit -- [AccountLogon_AuditCredentialValidation](policy-csp-audit.md#audit-accountlogon-auditcredentialvalidation) -- [AccountLogon_AuditKerberosAuthenticationService](policy-csp-audit.md#audit-accountlogon-auditkerberosauthenticationservice) -- [AccountLogon_AuditKerberosServiceTicketOperations](policy-csp-audit.md#audit-accountlogon-auditkerberosserviceticketoperations) -- [AccountLogon_AuditOtherAccountLogonEvents](policy-csp-audit.md#audit-accountlogon-auditotheraccountlogonevents) -- [AccountManagement_AuditApplicationGroupManagement](policy-csp-audit.md#audit-accountmanagement-auditapplicationgroupmanagement) -- [AccountManagement_AuditComputerAccountManagement](policy-csp-audit.md#audit-accountmanagement-auditcomputeraccountmanagement) -- [AccountManagement_AuditDistributionGroupManagement](policy-csp-audit.md#audit-accountmanagement-auditdistributiongroupmanagement) -- [AccountManagement_AuditOtherAccountManagementEvents](policy-csp-audit.md#audit-accountmanagement-auditotheraccountmanagementevents) -- [AccountManagement_AuditSecurityGroupManagement](policy-csp-audit.md#audit-accountmanagement-auditsecuritygroupmanagement) -- [AccountManagement_AuditUserAccountManagement](policy-csp-audit.md#audit-accountmanagement-audituseraccountmanagement) -- [DetailedTracking_AuditDPAPIActivity](policy-csp-audit.md#audit-detailedtracking-auditdpapiactivity) -- [DetailedTracking_AuditPNPActivity](policy-csp-audit.md#audit-detailedtracking-auditpnpactivity) -- [DetailedTracking_AuditProcessCreation](policy-csp-audit.md#audit-detailedtracking-auditprocesscreation) -- [DetailedTracking_AuditProcessTermination](policy-csp-audit.md#audit-detailedtracking-auditprocesstermination) -- [DetailedTracking_AuditRPCEvents](policy-csp-audit.md#audit-detailedtracking-auditrpcevents) -- [DetailedTracking_AuditTokenRightAdjusted](policy-csp-audit.md#audit-detailedtracking-audittokenrightadjusted) -- [DSAccess_AuditDetailedDirectoryServiceReplication](policy-csp-audit.md#audit-dsaccess-auditdetaileddirectoryservicereplication) -- [DSAccess_AuditDirectoryServiceAccess](policy-csp-audit.md#audit-dsaccess-auditdirectoryserviceaccess) -- [DSAccess_AuditDirectoryServiceChanges](policy-csp-audit.md#audit-dsaccess-auditdirectoryservicechanges) -- [DSAccess_AuditDirectoryServiceReplication](policy-csp-audit.md#audit-dsaccess-auditdirectoryservicereplication) -- [AccountLogonLogoff_AuditAccountLockout](policy-csp-audit.md#audit-accountlogonlogoff-auditaccountlockout) -- [AccountLogonLogoff_AuditUserDeviceClaims](policy-csp-audit.md#audit-accountlogonlogoff-audituserdeviceclaims) -- [AccountLogonLogoff_AuditGroupMembership](policy-csp-audit.md#audit-accountlogonlogoff-auditgroupmembership) -- [AccountLogonLogoff_AuditIPsecExtendedMode](policy-csp-audit.md#audit-accountlogonlogoff-auditipsecextendedmode) -- [AccountLogonLogoff_AuditIPsecMainMode](policy-csp-audit.md#audit-accountlogonlogoff-auditipsecmainmode) -- [AccountLogonLogoff_AuditIPsecQuickMode](policy-csp-audit.md#audit-accountlogonlogoff-auditipsecquickmode) -- [AccountLogonLogoff_AuditLogoff](policy-csp-audit.md#audit-accountlogonlogoff-auditlogoff) -- [AccountLogonLogoff_AuditLogon](policy-csp-audit.md#audit-accountlogonlogoff-auditlogon) -- [AccountLogonLogoff_AuditNetworkPolicyServer](policy-csp-audit.md#audit-accountlogonlogoff-auditnetworkpolicyserver) -- [AccountLogonLogoff_AuditOtherLogonLogoffEvents](policy-csp-audit.md#audit-accountlogonlogoff-auditotherlogonlogoffevents) -- [AccountLogonLogoff_AuditSpecialLogon](policy-csp-audit.md#audit-accountlogonlogoff-auditspeciallogon) -- [ObjectAccess_AuditApplicationGenerated](policy-csp-audit.md#audit-objectaccess-auditapplicationgenerated) -- [ObjectAccess_AuditCertificationServices](policy-csp-audit.md#audit-objectaccess-auditcertificationservices) -- [ObjectAccess_AuditDetailedFileShare](policy-csp-audit.md#audit-objectaccess-auditdetailedfileshare) -- [ObjectAccess_AuditFileShare](policy-csp-audit.md#audit-objectaccess-auditfileshare) -- [ObjectAccess_AuditFileSystem](policy-csp-audit.md#audit-objectaccess-auditfilesystem) -- [ObjectAccess_AuditFilteringPlatformConnection](policy-csp-audit.md#audit-objectaccess-auditfilteringplatformconnection) -- [ObjectAccess_AuditFilteringPlatformPacketDrop](policy-csp-audit.md#audit-objectaccess-auditfilteringplatformpacketdrop) -- [ObjectAccess_AuditHandleManipulation](policy-csp-audit.md#audit-objectaccess-audithandlemanipulation) -- [ObjectAccess_AuditKernelObject](policy-csp-audit.md#audit-objectaccess-auditkernelobject) -- [ObjectAccess_AuditOtherObjectAccessEvents](policy-csp-audit.md#audit-objectaccess-auditotherobjectaccessevents) -- [ObjectAccess_AuditRegistry](policy-csp-audit.md#audit-objectaccess-auditregistry) -- [ObjectAccess_AuditRemovableStorage](policy-csp-audit.md#audit-objectaccess-auditremovablestorage) -- [ObjectAccess_AuditSAM](policy-csp-audit.md#audit-objectaccess-auditsam) -- [ObjectAccess_AuditCentralAccessPolicyStaging](policy-csp-audit.md#audit-objectaccess-auditcentralaccesspolicystaging) -- [PolicyChange_AuditPolicyChange](policy-csp-audit.md#audit-policychange-auditpolicychange) -- [PolicyChange_AuditAuthenticationPolicyChange](policy-csp-audit.md#audit-policychange-auditauthenticationpolicychange) -- [PolicyChange_AuditAuthorizationPolicyChange](policy-csp-audit.md#audit-policychange-auditauthorizationpolicychange) -- [PolicyChange_AuditFilteringPlatformPolicyChange](policy-csp-audit.md#audit-policychange-auditfilteringplatformpolicychange) -- [PolicyChange_AuditMPSSVCRuleLevelPolicyChange](policy-csp-audit.md#audit-policychange-auditmpssvcrulelevelpolicychange) -- [PolicyChange_AuditOtherPolicyChangeEvents](policy-csp-audit.md#audit-policychange-auditotherpolicychangeevents) -- [PrivilegeUse_AuditNonSensitivePrivilegeUse](policy-csp-audit.md#audit-privilegeuse-auditnonsensitiveprivilegeuse) -- [PrivilegeUse_AuditOtherPrivilegeUseEvents](policy-csp-audit.md#audit-privilegeuse-auditotherprivilegeuseevents) -- [PrivilegeUse_AuditSensitivePrivilegeUse](policy-csp-audit.md#audit-privilegeuse-auditsensitiveprivilegeuse) -- [System_AuditIPsecDriver](policy-csp-audit.md#audit-system-auditipsecdriver) -- [System_AuditOtherSystemEvents](policy-csp-audit.md#audit-system-auditothersystemevents) -- [System_AuditSecurityStateChange](policy-csp-audit.md#audit-system-auditsecuritystatechange) -- [System_AuditSecuritySystemExtension](policy-csp-audit.md#audit-system-auditsecuritysystemextension) -- [System_AuditSystemIntegrity](policy-csp-audit.md#audit-system-auditsystemintegrity) +- [AccountLogon_AuditCredentialValidation](policy-csp-audit.md) +- [AccountLogon_AuditKerberosAuthenticationService](policy-csp-audit.md) +- [AccountLogon_AuditKerberosServiceTicketOperations](policy-csp-audit.md) +- [AccountLogon_AuditOtherAccountLogonEvents](policy-csp-audit.md) +- [AccountManagement_AuditApplicationGroupManagement](policy-csp-audit.md) +- [AccountManagement_AuditComputerAccountManagement](policy-csp-audit.md) +- [AccountManagement_AuditDistributionGroupManagement](policy-csp-audit.md) +- [AccountManagement_AuditOtherAccountManagementEvents](policy-csp-audit.md) +- [AccountManagement_AuditSecurityGroupManagement](policy-csp-audit.md) +- [AccountManagement_AuditUserAccountManagement](policy-csp-audit.md) +- [DetailedTracking_AuditDPAPIActivity](policy-csp-audit.md) +- [DetailedTracking_AuditPNPActivity](policy-csp-audit.md) +- [DetailedTracking_AuditProcessCreation](policy-csp-audit.md) +- [DetailedTracking_AuditProcessTermination](policy-csp-audit.md) +- [DetailedTracking_AuditRPCEvents](policy-csp-audit.md) +- [DetailedTracking_AuditTokenRightAdjusted](policy-csp-audit.md) +- [DSAccess_AuditDetailedDirectoryServiceReplication](policy-csp-audit.md) +- [DSAccess_AuditDirectoryServiceAccess](policy-csp-audit.md) +- [DSAccess_AuditDirectoryServiceChanges](policy-csp-audit.md) +- [DSAccess_AuditDirectoryServiceReplication](policy-csp-audit.md) +- [AccountLogonLogoff_AuditAccountLockout](policy-csp-audit.md) +- [AccountLogonLogoff_AuditUserDeviceClaims](policy-csp-audit.md) +- [AccountLogonLogoff_AuditGroupMembership](policy-csp-audit.md) +- [AccountLogonLogoff_AuditIPsecExtendedMode](policy-csp-audit.md) +- [AccountLogonLogoff_AuditIPsecMainMode](policy-csp-audit.md) +- [AccountLogonLogoff_AuditIPsecQuickMode](policy-csp-audit.md) +- [AccountLogonLogoff_AuditLogoff](policy-csp-audit.md) +- [AccountLogonLogoff_AuditLogon](policy-csp-audit.md) +- [AccountLogonLogoff_AuditNetworkPolicyServer](policy-csp-audit.md) +- [AccountLogonLogoff_AuditOtherLogonLogoffEvents](policy-csp-audit.md) +- [AccountLogonLogoff_AuditSpecialLogon](policy-csp-audit.md) +- [ObjectAccess_AuditApplicationGenerated](policy-csp-audit.md) +- [ObjectAccess_AuditCertificationServices](policy-csp-audit.md) +- [ObjectAccess_AuditDetailedFileShare](policy-csp-audit.md) +- [ObjectAccess_AuditFileShare](policy-csp-audit.md) +- [ObjectAccess_AuditFileSystem](policy-csp-audit.md) +- [ObjectAccess_AuditFilteringPlatformConnection](policy-csp-audit.md) +- [ObjectAccess_AuditFilteringPlatformPacketDrop](policy-csp-audit.md) +- [ObjectAccess_AuditHandleManipulation](policy-csp-audit.md) +- [ObjectAccess_AuditKernelObject](policy-csp-audit.md) +- [ObjectAccess_AuditOtherObjectAccessEvents](policy-csp-audit.md) +- [ObjectAccess_AuditRegistry](policy-csp-audit.md) +- [ObjectAccess_AuditRemovableStorage](policy-csp-audit.md) +- [ObjectAccess_AuditSAM](policy-csp-audit.md) +- [ObjectAccess_AuditCentralAccessPolicyStaging](policy-csp-audit.md) +- [PolicyChange_AuditPolicyChange](policy-csp-audit.md) +- [PolicyChange_AuditAuthenticationPolicyChange](policy-csp-audit.md) +- [PolicyChange_AuditAuthorizationPolicyChange](policy-csp-audit.md) +- [PolicyChange_AuditFilteringPlatformPolicyChange](policy-csp-audit.md) +- [PolicyChange_AuditMPSSVCRuleLevelPolicyChange](policy-csp-audit.md) +- [PolicyChange_AuditOtherPolicyChangeEvents](policy-csp-audit.md) +- [PrivilegeUse_AuditNonSensitivePrivilegeUse](policy-csp-audit.md) +- [PrivilegeUse_AuditOtherPrivilegeUseEvents](policy-csp-audit.md) +- [PrivilegeUse_AuditSensitivePrivilegeUse](policy-csp-audit.md) +- [System_AuditIPsecDriver](policy-csp-audit.md) +- [System_AuditOtherSystemEvents](policy-csp-audit.md) +- [System_AuditSecurityStateChange](policy-csp-audit.md) +- [System_AuditSecuritySystemExtension](policy-csp-audit.md) +- [System_AuditSystemIntegrity](policy-csp-audit.md) ## Authentication -- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) +- [AllowSecondaryAuthenticationDevice](policy-csp-authentication.md) ## BITS -- [JobInactivityTimeout](policy-csp-bits.md#bits-jobinactivitytimeout) -- [BandwidthThrottlingStartTime](policy-csp-bits.md#bits-bandwidththrottlingstarttime) -- [BandwidthThrottlingEndTime](policy-csp-bits.md#bits-bandwidththrottlingendtime) -- [BandwidthThrottlingTransferRate](policy-csp-bits.md#bits-bandwidththrottlingtransferrate) -- [CostedNetworkBehaviorForegroundPriority](policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) -- [CostedNetworkBehaviorBackgroundPriority](policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) +- [JobInactivityTimeout](policy-csp-bits.md) +- [BandwidthThrottlingStartTime](policy-csp-bits.md) +- [BandwidthThrottlingEndTime](policy-csp-bits.md) +- [BandwidthThrottlingTransferRate](policy-csp-bits.md) +- [CostedNetworkBehaviorForegroundPriority](policy-csp-bits.md) +- [CostedNetworkBehaviorBackgroundPriority](policy-csp-bits.md) ## Browser -- [AllowAddressBarDropdown](policy-csp-browser.md#browser-allowaddressbardropdown) -- [AllowAutofill](policy-csp-browser.md#browser-allowautofill) -- [AllowCookies](policy-csp-browser.md#browser-allowcookies) -- [AllowDeveloperTools](policy-csp-browser.md#browser-allowdevelopertools) -- [AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) -- [AllowExtensions](policy-csp-browser.md#browser-allowextensions) -- [AllowFlash](policy-csp-browser.md#browser-allowflash) -- [AllowFlashClickToRun](policy-csp-browser.md#browser-allowflashclicktorun) -- [AllowFullScreenMode](policy-csp-browser.md#browser-allowfullscreenmode) -- [AllowInPrivate](policy-csp-browser.md#browser-allowinprivate) -- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) -- [ConfigureTelemetryForMicrosoft365Analytics](policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) -- [AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) -- [AllowPopups](policy-csp-browser.md#browser-allowpopups) -- [AllowPrinting](policy-csp-browser.md#browser-allowprinting) -- [AllowSavingHistory](policy-csp-browser.md#browser-allowsavinghistory) -- [AllowSearchEngineCustomization](policy-csp-browser.md#browser-allowsearchenginecustomization) -- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [AllowSideloadingOfExtensions](policy-csp-browser.md#browser-allowsideloadingofextensions) -- [AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) -- [AllowWebContentOnNewTabPage](policy-csp-browser.md#browser-allowwebcontentonnewtabpage) -- [AlwaysEnableBooksLibrary](policy-csp-browser.md#browser-alwaysenablebookslibrary) -- [ClearBrowsingDataOnExit](policy-csp-browser.md#browser-clearbrowsingdataonexit) -- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#browser-configureadditionalsearchengines) -- [ConfigureFavoritesBar](policy-csp-browser.md#browser-configurefavoritesbar) -- [ConfigureHomeButton](policy-csp-browser.md#browser-configurehomebutton) -- [ConfigureOpenMicrosoftEdgeWith](policy-csp-browser.md#browser-configureopenmicrosoftedgewith) -- [DisableLockdownOfStartPages](policy-csp-browser.md#browser-disablelockdownofstartpages) -- [EnableExtendedBooksTelemetry](policy-csp-browser.md#browser-enableextendedbookstelemetry) -- [AllowTabPreloading](policy-csp-browser.md#browser-allowtabpreloading) -- [AllowPrelaunch](policy-csp-browser.md#browser-allowprelaunch) -- [EnterpriseModeSiteList](policy-csp-browser.md#browser-enterprisemodesitelist) -- [PreventTurningOffRequiredExtensions](policy-csp-browser.md#browser-preventturningoffrequiredextensions) -- [HomePages](policy-csp-browser.md#browser-homepages) -- [LockdownFavorites](policy-csp-browser.md#browser-lockdownfavorites) -- [ConfigureKioskMode](policy-csp-browser.md#browser-configurekioskmode) -- [ConfigureKioskResetAfterIdleTimeout](policy-csp-browser.md#browser-configurekioskresetafteridletimeout) -- [PreventAccessToAboutFlagsInMicrosoftEdge](policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) -- [PreventFirstRunPage](policy-csp-browser.md#browser-preventfirstrunpage) -- [PreventCertErrorOverrides](policy-csp-browser.md#browser-preventcerterroroverrides) -- [PreventSmartScreenPromptOverride](policy-csp-browser.md#browser-preventsmartscreenpromptoverride) -- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) -- [PreventLiveTileDataCollection](policy-csp-browser.md#browser-preventlivetiledatacollection) -- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) -- [ProvisionFavorites](policy-csp-browser.md#browser-provisionfavorites) -- [SendIntranetTraffictoInternetExplorer](policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) -- [SetDefaultSearchEngine](policy-csp-browser.md#browser-setdefaultsearchengine) -- [SetHomeButtonURL](policy-csp-browser.md#browser-sethomebuttonurl) -- [SetNewTabPageURL](policy-csp-browser.md#browser-setnewtabpageurl) -- [ShowMessageWhenOpeningSitesInInternetExplorer](policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) -- [SyncFavoritesBetweenIEAndMicrosoftEdge](policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) -- [UnlockHomeButton](policy-csp-browser.md#browser-unlockhomebutton) -- [UseSharedFolderForBooks](policy-csp-browser.md#browser-usesharedfolderforbooks) -- [AllowAddressBarDropdown](policy-csp-browser.md#browser-allowaddressbardropdown) -- [AllowAutofill](policy-csp-browser.md#browser-allowautofill) -- [AllowCookies](policy-csp-browser.md#browser-allowcookies) -- [AllowDeveloperTools](policy-csp-browser.md#browser-allowdevelopertools) -- [AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) -- [AllowExtensions](policy-csp-browser.md#browser-allowextensions) -- [AllowFlash](policy-csp-browser.md#browser-allowflash) -- [AllowFlashClickToRun](policy-csp-browser.md#browser-allowflashclicktorun) -- [AllowFullScreenMode](policy-csp-browser.md#browser-allowfullscreenmode) -- [AllowInPrivate](policy-csp-browser.md#browser-allowinprivate) -- [AllowMicrosoftCompatibilityList](policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) -- [ConfigureTelemetryForMicrosoft365Analytics](policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) -- [AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) -- [AllowPopups](policy-csp-browser.md#browser-allowpopups) -- [AllowPrinting](policy-csp-browser.md#browser-allowprinting) -- [AllowSavingHistory](policy-csp-browser.md#browser-allowsavinghistory) -- [AllowSearchEngineCustomization](policy-csp-browser.md#browser-allowsearchenginecustomization) -- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [AllowSideloadingOfExtensions](policy-csp-browser.md#browser-allowsideloadingofextensions) -- [AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) -- [AllowWebContentOnNewTabPage](policy-csp-browser.md#browser-allowwebcontentonnewtabpage) -- [AlwaysEnableBooksLibrary](policy-csp-browser.md#browser-alwaysenablebookslibrary) -- [ClearBrowsingDataOnExit](policy-csp-browser.md#browser-clearbrowsingdataonexit) -- [ConfigureAdditionalSearchEngines](policy-csp-browser.md#browser-configureadditionalsearchengines) -- [ConfigureFavoritesBar](policy-csp-browser.md#browser-configurefavoritesbar) -- [ConfigureHomeButton](policy-csp-browser.md#browser-configurehomebutton) -- [ConfigureOpenMicrosoftEdgeWith](policy-csp-browser.md#browser-configureopenmicrosoftedgewith) -- [DisableLockdownOfStartPages](policy-csp-browser.md#browser-disablelockdownofstartpages) -- [EnableExtendedBooksTelemetry](policy-csp-browser.md#browser-enableextendedbookstelemetry) -- [AllowTabPreloading](policy-csp-browser.md#browser-allowtabpreloading) -- [AllowPrelaunch](policy-csp-browser.md#browser-allowprelaunch) -- [EnterpriseModeSiteList](policy-csp-browser.md#browser-enterprisemodesitelist) -- [PreventTurningOffRequiredExtensions](policy-csp-browser.md#browser-preventturningoffrequiredextensions) -- [HomePages](policy-csp-browser.md#browser-homepages) -- [LockdownFavorites](policy-csp-browser.md#browser-lockdownfavorites) -- [ConfigureKioskMode](policy-csp-browser.md#browser-configurekioskmode) -- [ConfigureKioskResetAfterIdleTimeout](policy-csp-browser.md#browser-configurekioskresetafteridletimeout) -- [PreventAccessToAboutFlagsInMicrosoftEdge](policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) -- [PreventFirstRunPage](policy-csp-browser.md#browser-preventfirstrunpage) -- [PreventCertErrorOverrides](policy-csp-browser.md#browser-preventcerterroroverrides) -- [PreventSmartScreenPromptOverride](policy-csp-browser.md#browser-preventsmartscreenpromptoverride) -- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) -- [PreventLiveTileDataCollection](policy-csp-browser.md#browser-preventlivetiledatacollection) -- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) -- [ProvisionFavorites](policy-csp-browser.md#browser-provisionfavorites) -- [SendIntranetTraffictoInternetExplorer](policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) -- [SetDefaultSearchEngine](policy-csp-browser.md#browser-setdefaultsearchengine) -- [SetHomeButtonURL](policy-csp-browser.md#browser-sethomebuttonurl) -- [SetNewTabPageURL](policy-csp-browser.md#browser-setnewtabpageurl) -- [ShowMessageWhenOpeningSitesInInternetExplorer](policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) -- [SyncFavoritesBetweenIEAndMicrosoftEdge](policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) -- [UnlockHomeButton](policy-csp-browser.md#browser-unlockhomebutton) -- [UseSharedFolderForBooks](policy-csp-browser.md#browser-usesharedfolderforbooks) +- [AllowAddressBarDropdown](policy-csp-browser.md) +- [AllowAutofill](policy-csp-browser.md) +- [AllowCookies](policy-csp-browser.md) +- [AllowDeveloperTools](policy-csp-browser.md) +- [AllowDoNotTrack](policy-csp-browser.md) +- [AllowExtensions](policy-csp-browser.md) +- [AllowFlash](policy-csp-browser.md) +- [AllowFlashClickToRun](policy-csp-browser.md) +- [AllowFullScreenMode](policy-csp-browser.md) +- [AllowInPrivate](policy-csp-browser.md) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md) +- [ConfigureTelemetryForMicrosoft365Analytics](policy-csp-browser.md) +- [AllowPasswordManager](policy-csp-browser.md) +- [AllowPopups](policy-csp-browser.md) +- [AllowPrinting](policy-csp-browser.md) +- [AllowSavingHistory](policy-csp-browser.md) +- [AllowSearchEngineCustomization](policy-csp-browser.md) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md) +- [AllowSideloadingOfExtensions](policy-csp-browser.md) +- [AllowSmartScreen](policy-csp-browser.md) +- [AllowWebContentOnNewTabPage](policy-csp-browser.md) +- [AlwaysEnableBooksLibrary](policy-csp-browser.md) +- [ClearBrowsingDataOnExit](policy-csp-browser.md) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md) +- [ConfigureFavoritesBar](policy-csp-browser.md) +- [ConfigureHomeButton](policy-csp-browser.md) +- [ConfigureOpenMicrosoftEdgeWith](policy-csp-browser.md) +- [DisableLockdownOfStartPages](policy-csp-browser.md) +- [EnableExtendedBooksTelemetry](policy-csp-browser.md) +- [AllowTabPreloading](policy-csp-browser.md) +- [AllowPrelaunch](policy-csp-browser.md) +- [EnterpriseModeSiteList](policy-csp-browser.md) +- [PreventTurningOffRequiredExtensions](policy-csp-browser.md) +- [HomePages](policy-csp-browser.md) +- [LockdownFavorites](policy-csp-browser.md) +- [ConfigureKioskMode](policy-csp-browser.md) +- [ConfigureKioskResetAfterIdleTimeout](policy-csp-browser.md) +- [PreventAccessToAboutFlagsInMicrosoftEdge](policy-csp-browser.md) +- [PreventFirstRunPage](policy-csp-browser.md) +- [PreventCertErrorOverrides](policy-csp-browser.md) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md) +- [PreventLiveTileDataCollection](policy-csp-browser.md) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md) +- [ProvisionFavorites](policy-csp-browser.md) +- [SendIntranetTraffictoInternetExplorer](policy-csp-browser.md) +- [SetDefaultSearchEngine](policy-csp-browser.md) +- [SetHomeButtonURL](policy-csp-browser.md) +- [SetNewTabPageURL](policy-csp-browser.md) +- [ShowMessageWhenOpeningSitesInInternetExplorer](policy-csp-browser.md) +- [SyncFavoritesBetweenIEAndMicrosoftEdge](policy-csp-browser.md) +- [UnlockHomeButton](policy-csp-browser.md) +- [UseSharedFolderForBooks](policy-csp-browser.md) +- [AllowAddressBarDropdown](policy-csp-browser.md) +- [AllowAutofill](policy-csp-browser.md) +- [AllowCookies](policy-csp-browser.md) +- [AllowDeveloperTools](policy-csp-browser.md) +- [AllowDoNotTrack](policy-csp-browser.md) +- [AllowExtensions](policy-csp-browser.md) +- [AllowFlash](policy-csp-browser.md) +- [AllowFlashClickToRun](policy-csp-browser.md) +- [AllowFullScreenMode](policy-csp-browser.md) +- [AllowInPrivate](policy-csp-browser.md) +- [AllowMicrosoftCompatibilityList](policy-csp-browser.md) +- [ConfigureTelemetryForMicrosoft365Analytics](policy-csp-browser.md) +- [AllowPasswordManager](policy-csp-browser.md) +- [AllowPopups](policy-csp-browser.md) +- [AllowPrinting](policy-csp-browser.md) +- [AllowSavingHistory](policy-csp-browser.md) +- [AllowSearchEngineCustomization](policy-csp-browser.md) +- [AllowSearchSuggestionsinAddressBar](policy-csp-browser.md) +- [AllowSideloadingOfExtensions](policy-csp-browser.md) +- [AllowSmartScreen](policy-csp-browser.md) +- [AllowWebContentOnNewTabPage](policy-csp-browser.md) +- [AlwaysEnableBooksLibrary](policy-csp-browser.md) +- [ClearBrowsingDataOnExit](policy-csp-browser.md) +- [ConfigureAdditionalSearchEngines](policy-csp-browser.md) +- [ConfigureFavoritesBar](policy-csp-browser.md) +- [ConfigureHomeButton](policy-csp-browser.md) +- [ConfigureOpenMicrosoftEdgeWith](policy-csp-browser.md) +- [DisableLockdownOfStartPages](policy-csp-browser.md) +- [EnableExtendedBooksTelemetry](policy-csp-browser.md) +- [AllowTabPreloading](policy-csp-browser.md) +- [AllowPrelaunch](policy-csp-browser.md) +- [EnterpriseModeSiteList](policy-csp-browser.md) +- [PreventTurningOffRequiredExtensions](policy-csp-browser.md) +- [HomePages](policy-csp-browser.md) +- [LockdownFavorites](policy-csp-browser.md) +- [ConfigureKioskMode](policy-csp-browser.md) +- [ConfigureKioskResetAfterIdleTimeout](policy-csp-browser.md) +- [PreventAccessToAboutFlagsInMicrosoftEdge](policy-csp-browser.md) +- [PreventFirstRunPage](policy-csp-browser.md) +- [PreventCertErrorOverrides](policy-csp-browser.md) +- [PreventSmartScreenPromptOverride](policy-csp-browser.md) +- [PreventSmartScreenPromptOverrideForFiles](policy-csp-browser.md) +- [PreventLiveTileDataCollection](policy-csp-browser.md) +- [PreventUsingLocalHostIPAddressForWebRTC](policy-csp-browser.md) +- [ProvisionFavorites](policy-csp-browser.md) +- [SendIntranetTraffictoInternetExplorer](policy-csp-browser.md) +- [SetDefaultSearchEngine](policy-csp-browser.md) +- [SetHomeButtonURL](policy-csp-browser.md) +- [SetNewTabPageURL](policy-csp-browser.md) +- [ShowMessageWhenOpeningSitesInInternetExplorer](policy-csp-browser.md) +- [SyncFavoritesBetweenIEAndMicrosoftEdge](policy-csp-browser.md) +- [UnlockHomeButton](policy-csp-browser.md) +- [UseSharedFolderForBooks](policy-csp-browser.md) ## Camera -- [AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [AllowCamera](policy-csp-camera.md) ## Cellular -- [LetAppsAccessCellularData](policy-csp-cellular.md#cellular-letappsaccesscellulardata) -- [LetAppsAccessCellularData_ForceAllowTheseApps](policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) -- [LetAppsAccessCellularData_ForceDenyTheseApps](policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) -- [LetAppsAccessCellularData_UserInControlOfTheseApps](policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) +- [LetAppsAccessCellularData](policy-csp-cellular.md) +- [LetAppsAccessCellularData_ForceAllowTheseApps](policy-csp-cellular.md) +- [LetAppsAccessCellularData_ForceDenyTheseApps](policy-csp-cellular.md) +- [LetAppsAccessCellularData_UserInControlOfTheseApps](policy-csp-cellular.md) ## Connectivity -- [AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming) -- [AllowPhonePCLinking](policy-csp-connectivity.md#connectivity-allowphonepclinking) -- [DisallowNetworkConnectivityActiveTests](policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) +- [AllowCellularDataRoaming](policy-csp-connectivity.md) +- [AllowPhonePCLinking](policy-csp-connectivity.md) +- [DisallowNetworkConnectivityActiveTests](policy-csp-connectivity.md) ## Cryptography -- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [AllowFipsAlgorithmPolicy](policy-csp-cryptography.md) ## Defender -- [AllowArchiveScanning](policy-csp-defender.md#allowarchivescanning) -- [AllowBehaviorMonitoring](policy-csp-defender.md#allowbehaviormonitoring) -- [AllowCloudProtection](policy-csp-defender.md#allowcloudprotection) -- [AllowEmailScanning](policy-csp-defender.md#allowemailscanning) -- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#allowfullscanonmappednetworkdrives) -- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md#allowfullscanremovabledrivescanning) -- [AllowIOAVProtection](policy-csp-defender.md#allowioavprotection) -- [AllowOnAccessProtection](policy-csp-defender.md#allowonaccessprotection) -- [AllowRealtimeMonitoring](policy-csp-defender.md#allowrealtimemonitoring) -- [AllowScanningNetworkFiles](policy-csp-defender.md#allowscanningnetworkfiles) -- [AllowUserUIAccess](policy-csp-defender.md#allowuseruiaccess) -- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md#attacksurfacereductiononlyexclusions) -- [AttackSurfaceReductionRules](policy-csp-defender.md#attacksurfacereductionrules) -- [AvgCPULoadFactor](policy-csp-defender.md#avgcpuloadfactor) -- [CloudBlockLevel](policy-csp-defender.md#cloudblocklevel) -- [CloudExtendedTimeout](policy-csp-defender.md#cloudextendedtimeout) -- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md#controlledfolderaccessallowedapplications) -- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md#checkforsignaturesbeforerunningscan) -- [SecurityIntelligenceLocation](policy-csp-defender.md#securityintelligencelocation) -- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md#controlledfolderaccessprotectedfolders) -- [DaysToRetainCleanedMalware](policy-csp-defender.md#daystoretaincleanedmalware) -- [DisableCatchupFullScan](policy-csp-defender.md#disablecatchupfullscan) -- [DisableCatchupQuickScan](policy-csp-defender.md#disablecatchupquickscan) -- [EnableControlledFolderAccess](policy-csp-defender.md#enablecontrolledfolderaccess) -- [EnableLowCPUPriority](policy-csp-defender.md#enablelowcpupriority) -- [EnableNetworkProtection](policy-csp-defender.md#enablenetworkprotection) -- [ExcludedPaths](policy-csp-defender.md#excludedpaths) -- [ExcludedExtensions](policy-csp-defender.md#excludedextensions) -- [ExcludedProcesses](policy-csp-defender.md#excludedprocesses) -- [PUAProtection](policy-csp-defender.md#puaprotection) -- [RealTimeScanDirection](policy-csp-defender.md#realtimescandirection) -- [ScanParameter](policy-csp-defender.md#scanparameter) -- [ScheduleQuickScanTime](policy-csp-defender.md#schedulequickscantime) -- [ScheduleScanDay](policy-csp-defender.md#schedulescanday) -- [ScheduleScanTime](policy-csp-defender.md#schedulescantime) -- [SignatureUpdateFallbackOrder](policy-csp-defender.md#signatureupdatefallbackorder) -- [SignatureUpdateFileSharesSources](policy-csp-defender.md#signatureupdatefilesharessources) -- [SignatureUpdateInterval](policy-csp-defender.md#signatureupdateinterval) -- [SubmitSamplesConsent](policy-csp-defender.md#submitsamplesconsent) -- [ThreatSeverityDefaultAction](policy-csp-defender.md#threatseveritydefaultaction) +- [AllowArchiveScanning](policy-csp-defender.md) +- [AllowBehaviorMonitoring](policy-csp-defender.md) +- [AllowCloudProtection](policy-csp-defender.md) +- [AllowEmailScanning](policy-csp-defender.md) +- [AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md) +- [AllowFullScanRemovableDriveScanning](policy-csp-defender.md) +- [AllowIOAVProtection](policy-csp-defender.md) +- [AllowOnAccessProtection](policy-csp-defender.md) +- [AllowRealtimeMonitoring](policy-csp-defender.md) +- [AllowScanningNetworkFiles](policy-csp-defender.md) +- [AllowUserUIAccess](policy-csp-defender.md) +- [AttackSurfaceReductionOnlyExclusions](policy-csp-defender.md) +- [AttackSurfaceReductionRules](policy-csp-defender.md) +- [AvgCPULoadFactor](policy-csp-defender.md) +- [CloudBlockLevel](policy-csp-defender.md) +- [CloudExtendedTimeout](policy-csp-defender.md) +- [ControlledFolderAccessAllowedApplications](policy-csp-defender.md) +- [CheckForSignaturesBeforeRunningScan](policy-csp-defender.md) +- [SecurityIntelligenceLocation](policy-csp-defender.md) +- [ControlledFolderAccessProtectedFolders](policy-csp-defender.md) +- [DaysToRetainCleanedMalware](policy-csp-defender.md) +- [DisableCatchupFullScan](policy-csp-defender.md) +- [DisableCatchupQuickScan](policy-csp-defender.md) +- [EnableControlledFolderAccess](policy-csp-defender.md) +- [EnableLowCPUPriority](policy-csp-defender.md) +- [EnableNetworkProtection](policy-csp-defender.md) +- [ExcludedPaths](policy-csp-defender.md) +- [ExcludedExtensions](policy-csp-defender.md) +- [ExcludedProcesses](policy-csp-defender.md) +- [PUAProtection](policy-csp-defender.md) +- [RealTimeScanDirection](policy-csp-defender.md) +- [ScanParameter](policy-csp-defender.md) +- [ScheduleQuickScanTime](policy-csp-defender.md) +- [ScheduleScanDay](policy-csp-defender.md) +- [ScheduleScanTime](policy-csp-defender.md) +- [SignatureUpdateFallbackOrder](policy-csp-defender.md) +- [SignatureUpdateFileSharesSources](policy-csp-defender.md) +- [SignatureUpdateInterval](policy-csp-defender.md) +- [SubmitSamplesConsent](policy-csp-defender.md) +- [ThreatSeverityDefaultAction](policy-csp-defender.md) ## DeliveryOptimization -- [DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxbackgrounddownloadbandwidth) -- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxforegrounddownloadbandwidth) -- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DOCacheHostSource](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehostsource) -- [DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) -- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) -- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DODownloadMode](policy-csp-deliveryoptimization.md) +- [DOGroupId](policy-csp-deliveryoptimization.md) +- [DOMaxCacheSize](policy-csp-deliveryoptimization.md) +- [DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md) +- [DOMaxCacheAge](policy-csp-deliveryoptimization.md) +- [DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md) +- [DOMinBackgroundQos](policy-csp-deliveryoptimization.md) +- [DOModifyCacheDrive](policy-csp-deliveryoptimization.md) +- [DOMaxBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOMaxForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md) +- [DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md) +- [DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md) +- [DOMinFileSizeToCache](policy-csp-deliveryoptimization.md) +- [DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md) +- [DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md) +- [DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md) +- [DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md) +- [DOCacheHost](policy-csp-deliveryoptimization.md) +- [DOCacheHostSource](policy-csp-deliveryoptimization.md) +- [DOGroupIdSource](policy-csp-deliveryoptimization.md) +- [DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md) +- [DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md) +- [DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md) +- [DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md) +- [DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md) ## DeviceGuard -- [EnableVirtualizationBasedSecurity](policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) -- [RequirePlatformSecurityFeatures](policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) -- [LsaCfgFlags](policy-csp-deviceguard.md#deviceguard-lsacfgflags) -- [ConfigureSystemGuardLaunch](policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) +- [EnableVirtualizationBasedSecurity](policy-csp-deviceguard.md) +- [RequirePlatformSecurityFeatures](policy-csp-deviceguard.md) +- [LsaCfgFlags](policy-csp-deviceguard.md) +- [ConfigureSystemGuardLaunch](policy-csp-deviceguard.md) ## DeviceLock -- [MinimumPasswordAge](policy-csp-devicelock.md#devicelock-minimumpasswordage) -- [MaximumPasswordAge](policy-csp-devicelock.md#devicelock-maximumpasswordage) -- [ClearTextPassword](policy-csp-devicelock.md#devicelock-cleartextpassword) -- [PasswordComplexity](policy-csp-devicelock.md#devicelock-passwordcomplexity) -- [PasswordHistorySize](policy-csp-devicelock.md#devicelock-passwordhistorysize) +- [MinimumPasswordAge](policy-csp-devicelock.md) +- [MaximumPasswordAge](policy-csp-devicelock.md) +- [ClearTextPassword](policy-csp-devicelock.md) +- [PasswordComplexity](policy-csp-devicelock.md) +- [PasswordHistorySize](policy-csp-devicelock.md) ## Display -- [EnablePerProcessDpi](policy-csp-display.md#display-enableperprocessdpi) -- [TurnOnGdiDPIScalingForApps](policy-csp-display.md#display-turnongdidpiscalingforapps) -- [TurnOffGdiDPIScalingForApps](policy-csp-display.md#display-turnoffgdidpiscalingforapps) -- [EnablePerProcessDpi](policy-csp-display.md#display-enableperprocessdpi) -- [EnablePerProcessDpiForApps](policy-csp-display.md#display-enableperprocessdpiforapps) -- [DisablePerProcessDpiForApps](policy-csp-display.md#display-disableperprocessdpiforapps) +- [EnablePerProcessDpi](policy-csp-display.md) +- [TurnOnGdiDPIScalingForApps](policy-csp-display.md) +- [TurnOffGdiDPIScalingForApps](policy-csp-display.md) +- [EnablePerProcessDpi](policy-csp-display.md) +- [EnablePerProcessDpiForApps](policy-csp-display.md) +- [DisablePerProcessDpiForApps](policy-csp-display.md) ## DmaGuard -- [DeviceEnumerationPolicy](policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) +- [DeviceEnumerationPolicy](policy-csp-dmaguard.md) ## Education -- [AllowGraphingCalculator](policy-csp-education.md#education-allowgraphingcalculator) -- [PreventAddingNewPrinters](policy-csp-education.md#education-preventaddingnewprinters) +- [AllowGraphingCalculator](policy-csp-education.md) +- [PreventAddingNewPrinters](policy-csp-education.md) ## Experience -- [AllowSpotlightCollection](policy-csp-experience.md#experience-allowspotlightcollection) -- [AllowThirdPartySuggestionsInWindowsSpotlight](policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) -- [AllowWindowsSpotlight](policy-csp-experience.md#experience-allowwindowsspotlight) -- [AllowWindowsSpotlightOnActionCenter](policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) -- [AllowWindowsSpotlightOnSettings](policy-csp-experience.md#experience-allowwindowsspotlightonsettings) -- [AllowWindowsSpotlightWindowsWelcomeExperience](policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) -- [AllowTailoredExperiencesWithDiagnosticData](policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) -- [ConfigureWindowsSpotlightOnLockScreen](policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) -- [AllowCortana](policy-csp-experience.md#experience-allowcortana) -- [AllowWindowsConsumerFeatures](policy-csp-experience.md#experience-allowwindowsconsumerfeatures) -- [AllowWindowsTips](policy-csp-experience.md#experience-allowwindowstips) -- [DoNotShowFeedbackNotifications](policy-csp-experience.md#experience-donotshowfeedbacknotifications) -- [AllowFindMyDevice](policy-csp-experience.md#experience-allowfindmydevice) -- [AllowClipboardHistory](policy-csp-experience.md#experience-allowclipboardhistory) -- [DoNotSyncBrowserSettings](policy-csp-experience.md#experience-donotsyncbrowsersettings) -- [PreventUsersFromTurningOnBrowserSyncing](policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) -- [ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) -- [DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent) -- [DisableConsumerAccountStateContent](policy-csp-experience.md#experience-disableconsumeraccountstatecontent) -- [ConfigureChatIcon](policy-csp-experience.md#experience-configurechaticon) +- [AllowSpotlightCollection](policy-csp-experience.md) +- [AllowThirdPartySuggestionsInWindowsSpotlight](policy-csp-experience.md) +- [AllowWindowsSpotlight](policy-csp-experience.md) +- [AllowWindowsSpotlightOnActionCenter](policy-csp-experience.md) +- [AllowWindowsSpotlightOnSettings](policy-csp-experience.md) +- [AllowWindowsSpotlightWindowsWelcomeExperience](policy-csp-experience.md) +- [AllowTailoredExperiencesWithDiagnosticData](policy-csp-experience.md) +- [ConfigureWindowsSpotlightOnLockScreen](policy-csp-experience.md) +- [AllowCortana](policy-csp-experience.md) +- [AllowWindowsConsumerFeatures](policy-csp-experience.md) +- [AllowWindowsTips](policy-csp-experience.md) +- [DoNotShowFeedbackNotifications](policy-csp-experience.md) +- [AllowFindMyDevice](policy-csp-experience.md) +- [AllowClipboardHistory](policy-csp-experience.md) +- [DoNotSyncBrowserSettings](policy-csp-experience.md) +- [PreventUsersFromTurningOnBrowserSyncing](policy-csp-experience.md) +- [ShowLockOnUserTile](policy-csp-experience.md) +- [DisableCloudOptimizedContent](policy-csp-experience.md) +- [DisableConsumerAccountStateContent](policy-csp-experience.md) +- [ConfigureChatIcon](policy-csp-experience.md) ## ExploitGuard -- [ExploitProtectionSettings](policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) +- [ExploitProtectionSettings](policy-csp-exploitguard.md) ## FileExplorer -- [DisableGraphRecentItems](policy-csp-fileexplorer.md#fileexplorer-disablegraphrecentitems) +- [DisableGraphRecentItems](policy-csp-fileexplorer.md) ## Handwriting -- [PanelDefaultModeDocked](policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) +- [PanelDefaultModeDocked](policy-csp-handwriting.md) ## HumanPresence -- [ForceInstantWake](policy-csp-humanpresence.md#humanpresence-forceinstantwake) -- [ForceInstantLock](policy-csp-humanpresence.md#humanpresence-forceinstantlock) -- [ForceLockTimeout](policy-csp-humanpresence.md#humanpresence-forcelocktimeout) -- [ForceInstantDim](policy-csp-humanpresence.md#humanpresence-forceinstantdim) +- [ForceInstantWake](policy-csp-humanpresence.md) +- [ForceInstantLock](policy-csp-humanpresence.md) +- [ForceLockTimeout](policy-csp-humanpresence.md) +- [ForceInstantDim](policy-csp-humanpresence.md) ## Kerberos -- [PKInitHashAlgorithmConfiguration](policy-csp-kerberos.md#kerberos-pkinithashalgorithmconfiguration) -- [PKInitHashAlgorithmSHA1](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha1) -- [PKInitHashAlgorithmSHA256](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha256) -- [PKInitHashAlgorithmSHA384](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha384) -- [PKInitHashAlgorithmSHA512](policy-csp-kerberos.md#kerberos-pkinithashalgorithmsha512) -- [CloudKerberosTicketRetrievalEnabled](policy-csp-kerberos.md#kerberos-cloudkerberosticketretrievalenabled) +- [PKInitHashAlgorithmConfiguration](policy-csp-kerberos.md) +- [PKInitHashAlgorithmSHA1](policy-csp-kerberos.md) +- [PKInitHashAlgorithmSHA256](policy-csp-kerberos.md) +- [PKInitHashAlgorithmSHA384](policy-csp-kerberos.md) +- [PKInitHashAlgorithmSHA512](policy-csp-kerberos.md) +- [CloudKerberosTicketRetrievalEnabled](policy-csp-kerberos.md) ## LanmanWorkstation -- [EnableInsecureGuestLogons](policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) +- [EnableInsecureGuestLogons](policy-csp-lanmanworkstation.md) ## Licensing -- [AllowWindowsEntitlementReactivation](policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) -- [DisallowKMSClientOnlineAVSValidation](policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) +- [AllowWindowsEntitlementReactivation](policy-csp-licensing.md) +- [DisallowKMSClientOnlineAVSValidation](policy-csp-licensing.md) ## LocalPoliciesSecurityOptions -- [Accounts_EnableAdministratorAccountStatus](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableadministratoraccountstatus) -- [Accounts_BlockMicrosoftAccounts](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) -- [Accounts_EnableGuestAccountStatus](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableguestaccountstatus) -- [Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) -- [Accounts_RenameAdministratorAccount](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) -- [Accounts_RenameGuestAccount](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) -- [Devices_AllowUndockWithoutHavingToLogon](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) -- [Devices_AllowedToFormatAndEjectRemovableMedia](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) -- [Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) -- [Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) -- [InteractiveLogon_DoNotRequireCTRLALTDEL](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) -- [InteractiveLogon_DoNotDisplayLastSignedIn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) -- [InteractiveLogon_DoNotDisplayUsernameAtSignIn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) -- [InteractiveLogon_MachineInactivityLimit](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) -- [InteractiveLogon_MessageTextForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) -- [InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) -- [InteractiveLogon_SmartCardRemovalBehavior](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) -- [MicrosoftNetworkClient_DigitallySignCommunicationsAlways](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) -- [MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) -- [MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) -- [MicrosoftNetworkServer_DigitallySignCommunicationsAlways](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) -- [MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) -- [NetworkAccess_AllowAnonymousSIDOrNameTranslation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-allowanonymoussidornametranslation) -- [NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) -- [NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) -- [NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) -- [NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) -- [NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowlocalsystemtousecomputeridentityforntlm) -- [NetworkSecurity_AllowPKU2UAuthenticationRequests](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) -- [NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) -- [NetworkSecurity_ForceLogoffWhenLogonHoursExpire](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-forcelogoffwhenlogonhoursexpire) -- [NetworkSecurity_LANManagerAuthenticationLevel](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) -- [NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) -- [NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) -- [NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) -- [NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) -- [NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) -- [NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) -- [Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) -- [Shutdown_ClearVirtualMemoryPageFile](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) -- [UserAccountControl_UseAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) -- [UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) -- [UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) -- [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) -- [UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) -- [UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) -- [UserAccountControl_RunAllAdministratorsInAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) -- [UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) -- [UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) -- [UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) +- [Accounts_EnableAdministratorAccountStatus](policy-csp-localpoliciessecurityoptions.md) +- [Accounts_BlockMicrosoftAccounts](policy-csp-localpoliciessecurityoptions.md) +- [Accounts_EnableGuestAccountStatus](policy-csp-localpoliciessecurityoptions.md) +- [Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](policy-csp-localpoliciessecurityoptions.md) +- [Accounts_RenameAdministratorAccount](policy-csp-localpoliciessecurityoptions.md) +- [Accounts_RenameGuestAccount](policy-csp-localpoliciessecurityoptions.md) +- [Devices_AllowUndockWithoutHavingToLogon](policy-csp-localpoliciessecurityoptions.md) +- [Devices_AllowedToFormatAndEjectRemovableMedia](policy-csp-localpoliciessecurityoptions.md) +- [Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](policy-csp-localpoliciessecurityoptions.md) +- [Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_DoNotRequireCTRLALTDEL](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_DoNotDisplayLastSignedIn](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_DoNotDisplayUsernameAtSignIn](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_MachineInactivityLimit](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_MessageTextForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](policy-csp-localpoliciessecurityoptions.md) +- [InteractiveLogon_SmartCardRemovalBehavior](policy-csp-localpoliciessecurityoptions.md) +- [MicrosoftNetworkClient_DigitallySignCommunicationsAlways](policy-csp-localpoliciessecurityoptions.md) +- [MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](policy-csp-localpoliciessecurityoptions.md) +- [MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](policy-csp-localpoliciessecurityoptions.md) +- [MicrosoftNetworkServer_DigitallySignCommunicationsAlways](policy-csp-localpoliciessecurityoptions.md) +- [MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](policy-csp-localpoliciessecurityoptions.md) +- [NetworkAccess_AllowAnonymousSIDOrNameTranslation](policy-csp-localpoliciessecurityoptions.md) +- [NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](policy-csp-localpoliciessecurityoptions.md) +- [NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](policy-csp-localpoliciessecurityoptions.md) +- [NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](policy-csp-localpoliciessecurityoptions.md) +- [NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_AllowPKU2UAuthenticationRequests](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_ForceLogoffWhenLogonHoursExpire](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_LANManagerAuthenticationLevel](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](policy-csp-localpoliciessecurityoptions.md) +- [NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](policy-csp-localpoliciessecurityoptions.md) +- [Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](policy-csp-localpoliciessecurityoptions.md) +- [Shutdown_ClearVirtualMemoryPageFile](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_UseAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_RunAllAdministratorsInAdminApprovalMode](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](policy-csp-localpoliciessecurityoptions.md) +- [UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](policy-csp-localpoliciessecurityoptions.md) ## LocalSecurityAuthority -- [ConfigureLsaProtectedProcess](policy-csp-lsa.md#localsecurityauthority-configurelsaprotectedprocess) +- [ConfigureLsaProtectedProcess](policy-csp-lsa.md) ## LockDown -- [AllowEdgeSwipe](policy-csp-lockdown.md#lockdown-allowedgeswipe) +- [AllowEdgeSwipe](policy-csp-lockdown.md) ## Maps -- [EnableOfflineMapsAutoUpdate](policy-csp-maps.md#maps-enableofflinemapsautoupdate) +- [EnableOfflineMapsAutoUpdate](policy-csp-maps.md) ## Messaging -- [AllowMessageSync](policy-csp-messaging.md#messaging-allowmessagesync) +- [AllowMessageSync](policy-csp-messaging.md) ## Multitasking -- [BrowserAltTabBlowout](policy-csp-multitasking.md#multitasking-browseralttabblowout) +- [BrowserAltTabBlowout](policy-csp-multitasking.md) ## NetworkIsolation -- [EnterpriseCloudResources](policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) -- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) -- [EnterpriseIPRange](policy-csp-networkisolation.md#networkisolation-enterpriseiprange) -- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) -- [EnterpriseProxyServers](policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) -- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) -- [NeutralResources](policy-csp-networkisolation.md#networkisolation-neutralresources) +- [EnterpriseCloudResources](policy-csp-networkisolation.md) +- [EnterpriseInternalProxyServers](policy-csp-networkisolation.md) +- [EnterpriseIPRange](policy-csp-networkisolation.md) +- [EnterpriseIPRangesAreAuthoritative](policy-csp-networkisolation.md) +- [EnterpriseProxyServers](policy-csp-networkisolation.md) +- [EnterpriseProxyServersAreAuthoritative](policy-csp-networkisolation.md) +- [NeutralResources](policy-csp-networkisolation.md) ## NewsAndInterests -- [AllowNewsAndInterests](policy-csp-newsandinterests.md#newsandinterests-allownewsandinterests) +- [AllowNewsAndInterests](policy-csp-newsandinterests.md) ## Notifications -- [DisallowNotificationMirroring](policy-csp-notifications.md#notifications-disallownotificationmirroring) -- [DisallowTileNotification](policy-csp-notifications.md#notifications-disallowtilenotification) -- [DisallowCloudNotification](policy-csp-notifications.md#notifications-disallowcloudnotification) -- [WnsEndpoint](policy-csp-notifications.md#notifications-wnsendpoint) +- [DisallowNotificationMirroring](policy-csp-notifications.md) +- [DisallowTileNotification](policy-csp-notifications.md) +- [DisallowCloudNotification](policy-csp-notifications.md) +- [WnsEndpoint](policy-csp-notifications.md) ## Power -- [EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md#power-energysaverbatterythresholdpluggedin) -- [EnergySaverBatteryThresholdOnBattery](policy-csp-power.md#power-energysaverbatterythresholdonbattery) -- [SelectPowerButtonActionPluggedIn](policy-csp-power.md#power-selectpowerbuttonactionpluggedin) -- [SelectPowerButtonActionOnBattery](policy-csp-power.md#power-selectpowerbuttonactiononbattery) -- [SelectSleepButtonActionPluggedIn](policy-csp-power.md#power-selectsleepbuttonactionpluggedin) -- [SelectSleepButtonActionOnBattery](policy-csp-power.md#power-selectsleepbuttonactiononbattery) -- [SelectLidCloseActionPluggedIn](policy-csp-power.md#power-selectlidcloseactionpluggedin) -- [SelectLidCloseActionOnBattery](policy-csp-power.md#power-selectlidcloseactiononbattery) -- [TurnOffHybridSleepPluggedIn](policy-csp-power.md#power-turnoffhybridsleeppluggedin) -- [TurnOffHybridSleepOnBattery](policy-csp-power.md#power-turnoffhybridsleeponbattery) -- [UnattendedSleepTimeoutPluggedIn](policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) -- [UnattendedSleepTimeoutOnBattery](policy-csp-power.md#power-unattendedsleeptimeoutonbattery) +- [EnergySaverBatteryThresholdPluggedIn](policy-csp-power.md) +- [EnergySaverBatteryThresholdOnBattery](policy-csp-power.md) +- [SelectPowerButtonActionPluggedIn](policy-csp-power.md) +- [SelectPowerButtonActionOnBattery](policy-csp-power.md) +- [SelectSleepButtonActionPluggedIn](policy-csp-power.md) +- [SelectSleepButtonActionOnBattery](policy-csp-power.md) +- [SelectLidCloseActionPluggedIn](policy-csp-power.md) +- [SelectLidCloseActionOnBattery](policy-csp-power.md) +- [TurnOffHybridSleepPluggedIn](policy-csp-power.md) +- [TurnOffHybridSleepOnBattery](policy-csp-power.md) +- [UnattendedSleepTimeoutPluggedIn](policy-csp-power.md) +- [UnattendedSleepTimeoutOnBattery](policy-csp-power.md) ## Privacy -- [DisablePrivacyExperience](policy-csp-privacy.md#privacy-disableprivacyexperience) -- [DisableAdvertisingId](policy-csp-privacy.md#privacy-disableadvertisingid) -- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) -- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [LetAppsRunInBackground](policy-csp-privacy.md#privacy-letappsruninbackground) -- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) -- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) -- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) -- [AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) -- [LetAppsAccessAccountInfo](policy-csp-privacy.md#privacy-letappsaccessaccountinfo) -- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [LetAppsAccessCalendar](policy-csp-privacy.md#privacy-letappsaccesscalendar) -- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) -- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) -- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) -- [LetAppsAccessCallHistory](policy-csp-privacy.md#privacy-letappsaccesscallhistory) -- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) -- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) -- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) -- [LetAppsAccessCamera](policy-csp-privacy.md#privacy-letappsaccesscamera) -- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) -- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) -- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) -- [LetAppsAccessContacts](policy-csp-privacy.md#privacy-letappsaccesscontacts) -- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) -- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) -- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) -- [LetAppsAccessEmail](policy-csp-privacy.md#privacy-letappsaccessemail) -- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) -- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) -- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) -- [LetAppsAccessGraphicsCaptureProgrammatic](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic) -- [LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic-forceallowtheseapps) -- [LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic-forcedenytheseapps) -- [LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscaptureprogrammatic-userincontroloftheseapps) -- [LetAppsAccessGraphicsCaptureWithoutBorder](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder) -- [LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder-forceallowtheseapps) -- [LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder-forcedenytheseapps) -- [LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessgraphicscapturewithoutborder-userincontroloftheseapps) -- [LetAppsAccessLocation](policy-csp-privacy.md#privacy-letappsaccesslocation) -- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) -- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) -- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) -- [LetAppsAccessMessaging](policy-csp-privacy.md#privacy-letappsaccessmessaging) -- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) -- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) -- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) -- [LetAppsAccessMicrophone](policy-csp-privacy.md#privacy-letappsaccessmicrophone) -- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) -- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) -- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) -- [LetAppsAccessMotion](policy-csp-privacy.md#privacy-letappsaccessmotion) -- [LetAppsAccessMotion_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) -- [LetAppsAccessMotion_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) -- [LetAppsAccessMotion_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) -- [LetAppsAccessNotifications](policy-csp-privacy.md#privacy-letappsaccessnotifications) -- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) -- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) -- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) -- [LetAppsAccessPhone](policy-csp-privacy.md#privacy-letappsaccessphone) -- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) -- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) -- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) -- [LetAppsAccessRadios](policy-csp-privacy.md#privacy-letappsaccessradios) -- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) -- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) -- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) -- [LetAppsAccessTasks](policy-csp-privacy.md#privacy-letappsaccesstasks) -- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) -- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) -- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) -- [LetAppsAccessTrustedDevices](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) -- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) -- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) -- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) -- [LetAppsSyncWithDevices](policy-csp-privacy.md#privacy-letappssyncwithdevices) -- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) -- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) -- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) -- [EnableActivityFeed](policy-csp-privacy.md#privacy-enableactivityfeed) -- [PublishUserActivities](policy-csp-privacy.md#privacy-publishuseractivities) -- [UploadUserActivities](policy-csp-privacy.md#privacy-uploaduseractivities) -- [AllowCrossDeviceClipboard](policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) -- [DisablePrivacyExperience](policy-csp-privacy.md#privacy-disableprivacyexperience) -- [LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) -- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [DisablePrivacyExperience](policy-csp-privacy.md) +- [DisableAdvertisingId](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsRunInBackground](policy-csp-privacy.md) +- [LetAppsRunInBackground_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsRunInBackground_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsRunInBackground_UserInControlOfTheseApps](policy-csp-privacy.md) +- [AllowInputPersonalization](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCalendar](policy-csp-privacy.md) +- [LetAppsAccessCalendar_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCalendar_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCalendar_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCallHistory](policy-csp-privacy.md) +- [LetAppsAccessCallHistory_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCallHistory_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCallHistory_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCamera](policy-csp-privacy.md) +- [LetAppsAccessCamera_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCamera_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessCamera_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessContacts](policy-csp-privacy.md) +- [LetAppsAccessContacts_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessContacts_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessContacts_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessEmail](policy-csp-privacy.md) +- [LetAppsAccessEmail_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessEmail_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessEmail_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureProgrammatic](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureProgrammatic_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureWithoutBorder](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureWithoutBorder_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessLocation](policy-csp-privacy.md) +- [LetAppsAccessLocation_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessLocation_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessLocation_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMessaging](policy-csp-privacy.md) +- [LetAppsAccessMessaging_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMessaging_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMessaging_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMicrophone](policy-csp-privacy.md) +- [LetAppsAccessMicrophone_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMicrophone_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMicrophone_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMotion](policy-csp-privacy.md) +- [LetAppsAccessMotion_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMotion_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessMotion_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessNotifications](policy-csp-privacy.md) +- [LetAppsAccessNotifications_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessNotifications_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessNotifications_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessPhone](policy-csp-privacy.md) +- [LetAppsAccessPhone_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessPhone_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessPhone_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessRadios](policy-csp-privacy.md) +- [LetAppsAccessRadios_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessRadios_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessRadios_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTasks](policy-csp-privacy.md) +- [LetAppsAccessTasks_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTasks_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTasks_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsAccessTrustedDevices_UserInControlOfTheseApps](policy-csp-privacy.md) +- [LetAppsSyncWithDevices](policy-csp-privacy.md) +- [LetAppsSyncWithDevices_ForceAllowTheseApps](policy-csp-privacy.md) +- [LetAppsSyncWithDevices_ForceDenyTheseApps](policy-csp-privacy.md) +- [LetAppsSyncWithDevices_UserInControlOfTheseApps](policy-csp-privacy.md) +- [EnableActivityFeed](policy-csp-privacy.md) +- [PublishUserActivities](policy-csp-privacy.md) +- [UploadUserActivities](policy-csp-privacy.md) +- [AllowCrossDeviceClipboard](policy-csp-privacy.md) +- [DisablePrivacyExperience](policy-csp-privacy.md) +- [LetAppsActivateWithVoice](policy-csp-privacy.md) +- [LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md) ## RemoteDesktop -- [AutoSubscription](policy-csp-remotedesktop.md#remotedesktop-autosubscription) +- [AutoSubscription](policy-csp-remotedesktop.md) ## Search -- [AllowIndexingEncryptedStoresOrItems](policy-csp-search.md#search-allowindexingencryptedstoresoritems) -- [AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) -- [AllowUsingDiacritics](policy-csp-search.md#search-allowusingdiacritics) -- [AlwaysUseAutoLangDetection](policy-csp-search.md#search-alwaysuseautolangdetection) -- [DisableBackoff](policy-csp-search.md#search-disablebackoff) -- [DisableRemovableDriveIndexing](policy-csp-search.md#search-disableremovabledriveindexing) -- [DisableSearch](policy-csp-search.md#search-disablesearch) -- [PreventIndexingLowDiskSpaceMB](policy-csp-search.md#search-preventindexinglowdiskspacemb) -- [PreventRemoteQueries](policy-csp-search.md#search-preventremotequeries) -- [AllowCloudSearch](policy-csp-search.md#search-allowcloudsearch) -- [DoNotUseWebResults](policy-csp-search.md#search-donotusewebresults) -- [AllowCortanaInAAD](policy-csp-search.md#search-allowcortanainaad) -- [AllowFindMyFiles](policy-csp-search.md#search-allowfindmyfiles) -- [AllowSearchHighlights](policy-csp-search.md#search-allowsearchhighlights) +- [AllowIndexingEncryptedStoresOrItems](policy-csp-search.md) +- [AllowSearchToUseLocation](policy-csp-search.md) +- [AllowUsingDiacritics](policy-csp-search.md) +- [AlwaysUseAutoLangDetection](policy-csp-search.md) +- [DisableBackoff](policy-csp-search.md) +- [DisableRemovableDriveIndexing](policy-csp-search.md) +- [DisableSearch](policy-csp-search.md) +- [PreventIndexingLowDiskSpaceMB](policy-csp-search.md) +- [PreventRemoteQueries](policy-csp-search.md) +- [AllowCloudSearch](policy-csp-search.md) +- [DoNotUseWebResults](policy-csp-search.md) +- [AllowCortanaInAAD](policy-csp-search.md) +- [AllowFindMyFiles](policy-csp-search.md) +- [AllowSearchHighlights](policy-csp-search.md) ## Security -- [ClearTPMIfNotReady](policy-csp-security.md#security-cleartpmifnotready) +- [ClearTPMIfNotReady](policy-csp-security.md) ## Settings -- [ConfigureTaskbarCalendar](policy-csp-settings.md#settings-configuretaskbarcalendar) -- [PageVisibilityList](policy-csp-settings.md#settings-pagevisibilitylist) -- [PageVisibilityList](policy-csp-settings.md#settings-pagevisibilitylist) -- [AllowOnlineTips](policy-csp-settings.md#settings-allowonlinetips) +- [ConfigureTaskbarCalendar](policy-csp-settings.md) +- [PageVisibilityList](policy-csp-settings.md) +- [PageVisibilityList](policy-csp-settings.md) +- [AllowOnlineTips](policy-csp-settings.md) ## SmartScreen -- [EnableSmartScreenInShell](policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) -- [PreventOverrideForFilesInShell](policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) -- [EnableAppInstallControl](policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) +- [EnableSmartScreenInShell](policy-csp-smartscreen.md) +- [PreventOverrideForFilesInShell](policy-csp-smartscreen.md) +- [EnableAppInstallControl](policy-csp-smartscreen.md) ## Speech -- [AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [AllowSpeechModelUpdate](policy-csp-speech.md) ## Start -- [ForceStartSize](policy-csp-start.md#start-forcestartsize) -- [DisableContextMenus](policy-csp-start.md#start-disablecontextmenus) -- [ShowOrHideMostUsedApps](policy-csp-start.md#start-showorhidemostusedapps) -- [HideFrequentlyUsedApps](policy-csp-start.md#start-hidefrequentlyusedapps) -- [HideRecentlyAddedApps](policy-csp-start.md#start-hiderecentlyaddedapps) -- [HidePeopleBar](policy-csp-start.md#start-hidepeoplebar) -- [StartLayout](policy-csp-start.md#start-startlayout) -- [ConfigureStartPins](policy-csp-start.md#start-configurestartpins) -- [HideRecommendedSection](policy-csp-start.md#start-hiderecommendedsection) -- [HideTaskViewButton](policy-csp-start.md#start-hidetaskviewbutton) -- [DisableControlCenter](policy-csp-start.md#start-disablecontrolcenter) -- [ForceStartSize](policy-csp-start.md#start-forcestartsize) -- [DisableContextMenus](policy-csp-start.md#start-disablecontextmenus) -- [ShowOrHideMostUsedApps](policy-csp-start.md#start-showorhidemostusedapps) -- [HideFrequentlyUsedApps](policy-csp-start.md#start-hidefrequentlyusedapps) -- [HideRecentlyAddedApps](policy-csp-start.md#start-hiderecentlyaddedapps) -- [StartLayout](policy-csp-start.md#start-startlayout) -- [ConfigureStartPins](policy-csp-start.md#start-configurestartpins) -- [HideRecommendedSection](policy-csp-start.md#start-hiderecommendedsection) -- [SimplifyQuickSettings](policy-csp-start.md#start-simplifyquicksettings) -- [DisableEditingQuickSettings](policy-csp-start.md#start-disableeditingquicksettings) -- [HideTaskViewButton](policy-csp-start.md#start-hidetaskviewbutton) +- [ForceStartSize](policy-csp-start.md) +- [DisableContextMenus](policy-csp-start.md) +- [ShowOrHideMostUsedApps](policy-csp-start.md) +- [HideFrequentlyUsedApps](policy-csp-start.md) +- [HideRecentlyAddedApps](policy-csp-start.md) +- [HidePeopleBar](policy-csp-start.md) +- [StartLayout](policy-csp-start.md) +- [ConfigureStartPins](policy-csp-start.md) +- [HideRecommendedSection](policy-csp-start.md) +- [HideTaskViewButton](policy-csp-start.md) +- [DisableControlCenter](policy-csp-start.md) +- [ForceStartSize](policy-csp-start.md) +- [DisableContextMenus](policy-csp-start.md) +- [ShowOrHideMostUsedApps](policy-csp-start.md) +- [HideFrequentlyUsedApps](policy-csp-start.md) +- [HideRecentlyAddedApps](policy-csp-start.md) +- [StartLayout](policy-csp-start.md) +- [ConfigureStartPins](policy-csp-start.md) +- [HideRecommendedSection](policy-csp-start.md) +- [SimplifyQuickSettings](policy-csp-start.md) +- [DisableEditingQuickSettings](policy-csp-start.md) +- [HideTaskViewButton](policy-csp-start.md) ## Storage -- [AllowDiskHealthModelUpdates](policy-csp-storage.md#storage-allowdiskhealthmodelupdates) -- [RemovableDiskDenyWriteAccess](policy-csp-storage.md#storage-removablediskdenywriteaccess) -- [AllowStorageSenseGlobal](policy-csp-storage.md#storage-allowstoragesenseglobal) -- [ConfigStorageSenseGlobalCadence](policy-csp-storage.md#storage-configstoragesenseglobalcadence) -- [AllowStorageSenseTemporaryFilesCleanup](policy-csp-storage.md#storage-allowstoragesensetemporaryfilescleanup) -- [ConfigStorageSenseRecycleBinCleanupThreshold](policy-csp-storage.md#storage-configstoragesenserecyclebincleanupthreshold) -- [ConfigStorageSenseDownloadsCleanupThreshold](policy-csp-storage.md#storage-configstoragesensedownloadscleanupthreshold) -- [ConfigStorageSenseCloudContentDehydrationThreshold](policy-csp-storage.md#storage-configstoragesensecloudcontentdehydrationthreshold) +- [AllowDiskHealthModelUpdates](policy-csp-storage.md) +- [RemovableDiskDenyWriteAccess](policy-csp-storage.md) +- [AllowStorageSenseGlobal](policy-csp-storage.md) +- [ConfigStorageSenseGlobalCadence](policy-csp-storage.md) +- [AllowStorageSenseTemporaryFilesCleanup](policy-csp-storage.md) +- [ConfigStorageSenseRecycleBinCleanupThreshold](policy-csp-storage.md) +- [ConfigStorageSenseDownloadsCleanupThreshold](policy-csp-storage.md) +- [ConfigStorageSenseCloudContentDehydrationThreshold](policy-csp-storage.md) ## System -- [AllowTelemetry](policy-csp-system.md#system-allowtelemetry) -- [AllowBuildPreview](policy-csp-system.md#system-allowbuildpreview) -- [AllowFontProviders](policy-csp-system.md#system-allowfontproviders) -- [AllowLocation](policy-csp-system.md#system-allowlocation) -- [AllowTelemetry](policy-csp-system.md#system-allowtelemetry) -- [TelemetryProxy](policy-csp-system.md#system-telemetryproxy) -- [DisableOneDriveFileSync](policy-csp-system.md#system-disableonedrivefilesync) -- [AllowWUfBCloudProcessing](policy-csp-system.md#system-allowwufbcloudprocessing) -- [AllowUpdateComplianceProcessing](policy-csp-system.md#system-allowupdatecomplianceprocessing) -- [AllowDesktopAnalyticsProcessing](policy-csp-system.md#system-allowdesktopanalyticsprocessing) -- [DisableEnterpriseAuthProxy](policy-csp-system.md#system-disableenterpriseauthproxy) -- [LimitEnhancedDiagnosticDataWindowsAnalytics](policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) -- [AllowDeviceNameInDiagnosticData](policy-csp-system.md#system-allowdevicenameindiagnosticdata) -- [ConfigureTelemetryOptInSettingsUx](policy-csp-system.md#system-configuretelemetryoptinsettingsux) -- [ConfigureTelemetryOptInChangeNotification](policy-csp-system.md#system-configuretelemetryoptinchangenotification) -- [DisableDeviceDelete](policy-csp-system.md#system-disabledevicedelete) -- [DisableDiagnosticDataViewer](policy-csp-system.md#system-disablediagnosticdataviewer) -- [ConfigureMicrosoft365UploadEndpoint](policy-csp-system.md#system-configuremicrosoft365uploadendpoint) -- [TurnOffFileHistory](policy-csp-system.md#system-turnofffilehistory) -- [DisableDirectXDatabaseUpdate](policy-csp-system.md#system-disabledirectxdatabaseupdate) -- [AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline) -- [LimitDiagnosticLogCollection](policy-csp-system.md#system-limitdiagnosticlogcollection) -- [LimitDumpCollection](policy-csp-system.md#system-limitdumpcollection) -- [EnableOneSettingsAuditing](policy-csp-system.md#system-enableonesettingsauditing) -- [DisableOneSettingsDownloads](policy-csp-system.md#system-disableonesettingsdownloads) -- [HideUnsupportedHardwareNotifications](policy-csp-system.md#system-hideunsupportedhardwarenotifications) +- [AllowTelemetry](policy-csp-system.md) +- [AllowBuildPreview](policy-csp-system.md) +- [AllowFontProviders](policy-csp-system.md) +- [AllowLocation](policy-csp-system.md) +- [AllowTelemetry](policy-csp-system.md) +- [TelemetryProxy](policy-csp-system.md) +- [DisableOneDriveFileSync](policy-csp-system.md) +- [AllowWUfBCloudProcessing](policy-csp-system.md) +- [AllowUpdateComplianceProcessing](policy-csp-system.md) +- [AllowDesktopAnalyticsProcessing](policy-csp-system.md) +- [DisableEnterpriseAuthProxy](policy-csp-system.md) +- [LimitEnhancedDiagnosticDataWindowsAnalytics](policy-csp-system.md) +- [AllowDeviceNameInDiagnosticData](policy-csp-system.md) +- [ConfigureTelemetryOptInSettingsUx](policy-csp-system.md) +- [ConfigureTelemetryOptInChangeNotification](policy-csp-system.md) +- [DisableDeviceDelete](policy-csp-system.md) +- [DisableDiagnosticDataViewer](policy-csp-system.md) +- [ConfigureMicrosoft365UploadEndpoint](policy-csp-system.md) +- [TurnOffFileHistory](policy-csp-system.md) +- [DisableDirectXDatabaseUpdate](policy-csp-system.md) +- [AllowCommercialDataPipeline](policy-csp-system.md) +- [LimitDiagnosticLogCollection](policy-csp-system.md) +- [LimitDumpCollection](policy-csp-system.md) +- [EnableOneSettingsAuditing](policy-csp-system.md) +- [DisableOneSettingsDownloads](policy-csp-system.md) +- [HideUnsupportedHardwareNotifications](policy-csp-system.md) ## SystemServices -- [ConfigureHomeGroupListenerServiceStartupMode](policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) -- [ConfigureHomeGroupProviderServiceStartupMode](policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) -- [ConfigureXboxAccessoryManagementServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) -- [ConfigureXboxLiveAuthManagerServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) -- [ConfigureXboxLiveGameSaveServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) -- [ConfigureXboxLiveNetworkingServiceStartupMode](policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) +- [ConfigureHomeGroupListenerServiceStartupMode](policy-csp-systemservices.md) +- [ConfigureHomeGroupProviderServiceStartupMode](policy-csp-systemservices.md) +- [ConfigureXboxAccessoryManagementServiceStartupMode](policy-csp-systemservices.md) +- [ConfigureXboxLiveAuthManagerServiceStartupMode](policy-csp-systemservices.md) +- [ConfigureXboxLiveGameSaveServiceStartupMode](policy-csp-systemservices.md) +- [ConfigureXboxLiveNetworkingServiceStartupMode](policy-csp-systemservices.md) ## TextInput -- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) -- [AllowLinguisticDataCollection](policy-csp-textinput.md#textinput-allowlinguisticdatacollection) -- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md#textinput-configuresimplifiedchineseimeversion) -- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md#textinput-configuretraditionalchineseimeversion) -- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md#textinput-configurejapaneseimeversion) -- [ConfigureKoreanIMEVersion](policy-csp-textinput.md#textinput-configurekoreanimeversion) +- [AllowLanguageFeaturesUninstall](policy-csp-textinput.md) +- [AllowLinguisticDataCollection](policy-csp-textinput.md) +- [ConfigureSimplifiedChineseIMEVersion](policy-csp-textinput.md) +- [ConfigureTraditionalChineseIMEVersion](policy-csp-textinput.md) +- [ConfigureJapaneseIMEVersion](policy-csp-textinput.md) +- [ConfigureKoreanIMEVersion](policy-csp-textinput.md) ## TimeLanguageSettings -- [RestrictLanguagePacksAndFeaturesInstall](policy-csp-timelanguagesettings.md#timelanguagesettings-restrictlanguagepacksandfeaturesinstall) -- [BlockCleanupOfUnusedPreinstalledLangPacks](policy-csp-timelanguagesettings.md#timelanguagesettings-blockcleanupofunusedpreinstalledlangpacks) -- [MachineUILanguageOverwrite](policy-csp-timelanguagesettings.md#timelanguagesettings-machineuilanguageoverwrite) -- [RestrictLanguagePacksAndFeaturesInstall](policy-csp-timelanguagesettings.md#timelanguagesettings-restrictlanguagepacksandfeaturesinstall) +- [RestrictLanguagePacksAndFeaturesInstall](policy-csp-timelanguagesettings.md) +- [BlockCleanupOfUnusedPreinstalledLangPacks](policy-csp-timelanguagesettings.md) +- [MachineUILanguageOverwrite](policy-csp-timelanguagesettings.md) +- [RestrictLanguagePacksAndFeaturesInstall](policy-csp-timelanguagesettings.md) ## Troubleshooting -- [AllowRecommendations](policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) +- [AllowRecommendations](policy-csp-troubleshooting.md) ## Update -- [ActiveHoursEnd](policy-csp-update.md#update-activehoursend) -- [ActiveHoursStart](policy-csp-update.md#update-activehoursstart) -- [ActiveHoursMaxRange](policy-csp-update.md#update-activehoursmaxrange) -- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md#update-autorestartrequirednotificationdismissal) -- [AutoRestartNotificationSchedule](policy-csp-update.md#update-autorestartnotificationschedule) -- [SetAutoRestartNotificationDisable](policy-csp-update.md#update-setautorestartnotificationdisable) -- [ScheduleRestartWarning](policy-csp-update.md#update-schedulerestartwarning) -- [ScheduleImminentRestartWarning](policy-csp-update.md#update-scheduleimminentrestartwarning) -- [AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) -- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md#update-autorestartdeadlineperiodindays) -- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) -- [EngagedRestartTransitionSchedule](policy-csp-update.md#update-engagedrestarttransitionschedule) -- [EngagedRestartSnoozeSchedule](policy-csp-update.md#update-engagedrestartsnoozeschedule) -- [EngagedRestartDeadline](policy-csp-update.md#update-engagedrestartdeadline) -- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) -- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) -- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) -- [DetectionFrequency](policy-csp-update.md#update-detectionfrequency) -- [ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) -- [BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) -- [ProductVersion](policy-csp-update.md#update-productversion) -- [TargetReleaseVersion](policy-csp-update.md#update-targetreleaseversion) -- [AllowUpdateService](policy-csp-update.md#update-allowupdateservice) -- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) -- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) -- [DeferUpdatePeriod](policy-csp-update.md#update-deferupdateperiod) -- [DeferUpgradePeriod](policy-csp-update.md#update-deferupgradeperiod) -- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md#update-excludewudriversinqualityupdate) -- [PauseDeferrals](policy-csp-update.md#update-pausedeferrals) -- [PauseFeatureUpdates](policy-csp-update.md#update-pausefeatureupdates) -- [PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) -- [PauseFeatureUpdatesStartTime](policy-csp-update.md#update-pausefeatureupdatesstarttime) -- [PauseQualityUpdatesStartTime](policy-csp-update.md#update-pausequalityupdatesstarttime) -- [RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) -- [AllowMUUpdateService](policy-csp-update.md#update-allowmuupdateservice) -- [ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) -- [ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) -- [ScheduledInstallEveryWeek](policy-csp-update.md#update-scheduledinstalleveryweek) -- [ScheduledInstallFirstWeek](policy-csp-update.md#update-scheduledinstallfirstweek) -- [ScheduledInstallSecondWeek](policy-csp-update.md#update-scheduledinstallsecondweek) -- [ScheduledInstallThirdWeek](policy-csp-update.md#update-scheduledinstallthirdweek) -- [ScheduledInstallFourthWeek](policy-csp-update.md#update-scheduledinstallfourthweek) -- [UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) -- [UpdateServiceUrlAlternate](policy-csp-update.md#update-updateserviceurlalternate) -- [FillEmptyContentUrls](policy-csp-update.md#update-fillemptycontenturls) -- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md#update-setproxybehaviorforupdatedetection) -- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md#update-donotenforceenterprisetlscertpinningforupdatedetection) -- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourceforfeatureupdates) -- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourceforqualityupdates) -- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourcefordriverupdates) -- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md#update-setpolicydrivenupdatesourceforotherupdates) -- [SetEDURestart](policy-csp-update.md#update-setedurestart) -- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) -- [SetDisableUXWUAccess](policy-csp-update.md#update-setdisableuxwuaccess) -- [SetDisablePauseUXAccess](policy-csp-update.md#update-setdisablepauseuxaccess) -- [UpdateNotificationLevel](policy-csp-update.md#update-updatenotificationlevel) -- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md#update-noupdatenotificationsduringactivehours) -- [DisableDualScan](policy-csp-update.md#update-disabledualscan) -- [AutomaticMaintenanceWakeUp](policy-csp-update.md#update-automaticmaintenancewakeup) -- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) -- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) -- [ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) -- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md#update-configuredeadlinegraceperiodforfeatureupdates) -- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) -- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md#update-configuredeadlinenoautorebootforfeatureupdates) -- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md#update-configuredeadlinenoautorebootforqualityupdates) +- [ActiveHoursEnd](policy-csp-update.md) +- [ActiveHoursStart](policy-csp-update.md) +- [ActiveHoursMaxRange](policy-csp-update.md) +- [AutoRestartRequiredNotificationDismissal](policy-csp-update.md) +- [AutoRestartNotificationSchedule](policy-csp-update.md) +- [SetAutoRestartNotificationDisable](policy-csp-update.md) +- [ScheduleRestartWarning](policy-csp-update.md) +- [ScheduleImminentRestartWarning](policy-csp-update.md) +- [AllowAutoUpdate](policy-csp-update.md) +- [AutoRestartDeadlinePeriodInDays](policy-csp-update.md) +- [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](policy-csp-update.md) +- [EngagedRestartTransitionSchedule](policy-csp-update.md) +- [EngagedRestartSnoozeSchedule](policy-csp-update.md) +- [EngagedRestartDeadline](policy-csp-update.md) +- [EngagedRestartTransitionScheduleForFeatureUpdates](policy-csp-update.md) +- [EngagedRestartSnoozeScheduleForFeatureUpdates](policy-csp-update.md) +- [EngagedRestartDeadlineForFeatureUpdates](policy-csp-update.md) +- [DetectionFrequency](policy-csp-update.md) +- [ManagePreviewBuilds](policy-csp-update.md) +- [BranchReadinessLevel](policy-csp-update.md) +- [ProductVersion](policy-csp-update.md) +- [TargetReleaseVersion](policy-csp-update.md) +- [AllowUpdateService](policy-csp-update.md) +- [DeferFeatureUpdatesPeriodInDays](policy-csp-update.md) +- [DeferQualityUpdatesPeriodInDays](policy-csp-update.md) +- [DeferUpdatePeriod](policy-csp-update.md) +- [DeferUpgradePeriod](policy-csp-update.md) +- [ExcludeWUDriversInQualityUpdate](policy-csp-update.md) +- [PauseDeferrals](policy-csp-update.md) +- [PauseFeatureUpdates](policy-csp-update.md) +- [PauseQualityUpdates](policy-csp-update.md) +- [PauseFeatureUpdatesStartTime](policy-csp-update.md) +- [PauseQualityUpdatesStartTime](policy-csp-update.md) +- [RequireDeferUpgrade](policy-csp-update.md) +- [AllowMUUpdateService](policy-csp-update.md) +- [ScheduledInstallDay](policy-csp-update.md) +- [ScheduledInstallTime](policy-csp-update.md) +- [ScheduledInstallEveryWeek](policy-csp-update.md) +- [ScheduledInstallFirstWeek](policy-csp-update.md) +- [ScheduledInstallSecondWeek](policy-csp-update.md) +- [ScheduledInstallThirdWeek](policy-csp-update.md) +- [ScheduledInstallFourthWeek](policy-csp-update.md) +- [UpdateServiceUrl](policy-csp-update.md) +- [UpdateServiceUrlAlternate](policy-csp-update.md) +- [FillEmptyContentUrls](policy-csp-update.md) +- [SetProxyBehaviorForUpdateDetection](policy-csp-update.md) +- [DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForFeatureUpdates](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForQualityUpdates](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForDriverUpdates](policy-csp-update.md) +- [SetPolicyDrivenUpdateSourceForOtherUpdates](policy-csp-update.md) +- [SetEDURestart](policy-csp-update.md) +- [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](policy-csp-update.md) +- [SetDisableUXWUAccess](policy-csp-update.md) +- [SetDisablePauseUXAccess](policy-csp-update.md) +- [UpdateNotificationLevel](policy-csp-update.md) +- [NoUpdateNotificationsDuringActiveHours](policy-csp-update.md) +- [DisableDualScan](policy-csp-update.md) +- [AutomaticMaintenanceWakeUp](policy-csp-update.md) +- [ConfigureDeadlineForQualityUpdates](policy-csp-update.md) +- [ConfigureDeadlineForFeatureUpdates](policy-csp-update.md) +- [ConfigureDeadlineGracePeriod](policy-csp-update.md) +- [ConfigureDeadlineGracePeriodForFeatureUpdates](policy-csp-update.md) +- [ConfigureDeadlineNoAutoReboot](policy-csp-update.md) +- [ConfigureDeadlineNoAutoRebootForFeatureUpdates](policy-csp-update.md) +- [ConfigureDeadlineNoAutoRebootForQualityUpdates](policy-csp-update.md) ## UserRights -- [AccessCredentialManagerAsTrustedCaller](policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) -- [AccessFromNetwork](policy-csp-userrights.md#userrights-accessfromnetwork) -- [ActAsPartOfTheOperatingSystem](policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) -- [AllowLocalLogOn](policy-csp-userrights.md#userrights-allowlocallogon) -- [BackupFilesAndDirectories](policy-csp-userrights.md#userrights-backupfilesanddirectories) -- [ChangeSystemTime](policy-csp-userrights.md#userrights-changesystemtime) -- [CreatePageFile](policy-csp-userrights.md#userrights-createpagefile) -- [CreateToken](policy-csp-userrights.md#userrights-createtoken) -- [CreateGlobalObjects](policy-csp-userrights.md#userrights-createglobalobjects) -- [CreatePermanentSharedObjects](policy-csp-userrights.md#userrights-createpermanentsharedobjects) -- [CreateSymbolicLinks](policy-csp-userrights.md#userrights-createsymboliclinks) -- [DebugPrograms](policy-csp-userrights.md#userrights-debugprograms) -- [DenyAccessFromNetwork](policy-csp-userrights.md#userrights-denyaccessfromnetwork) -- [DenyLocalLogOn](policy-csp-userrights.md#userrights-denylocallogon) -- [DenyRemoteDesktopServicesLogOn](policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) -- [EnableDelegation](policy-csp-userrights.md#userrights-enabledelegation) -- [RemoteShutdown](policy-csp-userrights.md#userrights-remoteshutdown) -- [GenerateSecurityAudits](policy-csp-userrights.md#userrights-generatesecurityaudits) -- [ImpersonateClient](policy-csp-userrights.md#userrights-impersonateclient) -- [IncreaseSchedulingPriority](policy-csp-userrights.md#userrights-increaseschedulingpriority) -- [LoadUnloadDeviceDrivers](policy-csp-userrights.md#userrights-loadunloaddevicedrivers) -- [LockMemory](policy-csp-userrights.md#userrights-lockmemory) -- [ManageAuditingAndSecurityLog](policy-csp-userrights.md#userrights-manageauditingandsecuritylog) -- [ModifyObjectLabel](policy-csp-userrights.md#userrights-modifyobjectlabel) -- [ModifyFirmwareEnvironment](policy-csp-userrights.md#userrights-modifyfirmwareenvironment) -- [ManageVolume](policy-csp-userrights.md#userrights-managevolume) -- [ProfileSingleProcess](policy-csp-userrights.md#userrights-profilesingleprocess) -- [RestoreFilesAndDirectories](policy-csp-userrights.md#userrights-restorefilesanddirectories) -- [TakeOwnership](policy-csp-userrights.md#userrights-takeownership) -- [BypassTraverseChecking](policy-csp-userrights.md#userrights-bypasstraversechecking) -- [ReplaceProcessLevelToken](policy-csp-userrights.md#userrights-replaceprocessleveltoken) -- [ChangeTimeZone](policy-csp-userrights.md#userrights-changetimezone) -- [ShutDownTheSystem](policy-csp-userrights.md#userrights-shutdownthesystem) -- [LogOnAsBatchJob](policy-csp-userrights.md#userrights-logonasbatchjob) -- [ProfileSystemPerformance](policy-csp-userrights.md#userrights-profilesystemperformance) -- [DenyLogOnAsBatchJob](policy-csp-userrights.md#userrights-denylogonasbatchjob) -- [LogOnAsService](policy-csp-userrights.md#userrights-logonasservice) -- [IncreaseProcessWorkingSet](policy-csp-userrights.md#userrights-increaseprocessworkingset) +- [AccessCredentialManagerAsTrustedCaller](policy-csp-userrights.md) +- [AccessFromNetwork](policy-csp-userrights.md) +- [ActAsPartOfTheOperatingSystem](policy-csp-userrights.md) +- [AllowLocalLogOn](policy-csp-userrights.md) +- [BackupFilesAndDirectories](policy-csp-userrights.md) +- [ChangeSystemTime](policy-csp-userrights.md) +- [CreatePageFile](policy-csp-userrights.md) +- [CreateToken](policy-csp-userrights.md) +- [CreateGlobalObjects](policy-csp-userrights.md) +- [CreatePermanentSharedObjects](policy-csp-userrights.md) +- [CreateSymbolicLinks](policy-csp-userrights.md) +- [DebugPrograms](policy-csp-userrights.md) +- [DenyAccessFromNetwork](policy-csp-userrights.md) +- [DenyLocalLogOn](policy-csp-userrights.md) +- [DenyRemoteDesktopServicesLogOn](policy-csp-userrights.md) +- [EnableDelegation](policy-csp-userrights.md) +- [RemoteShutdown](policy-csp-userrights.md) +- [GenerateSecurityAudits](policy-csp-userrights.md) +- [ImpersonateClient](policy-csp-userrights.md) +- [IncreaseSchedulingPriority](policy-csp-userrights.md) +- [LoadUnloadDeviceDrivers](policy-csp-userrights.md) +- [LockMemory](policy-csp-userrights.md) +- [ManageAuditingAndSecurityLog](policy-csp-userrights.md) +- [ModifyObjectLabel](policy-csp-userrights.md) +- [ModifyFirmwareEnvironment](policy-csp-userrights.md) +- [ManageVolume](policy-csp-userrights.md) +- [ProfileSingleProcess](policy-csp-userrights.md) +- [RestoreFilesAndDirectories](policy-csp-userrights.md) +- [TakeOwnership](policy-csp-userrights.md) +- [BypassTraverseChecking](policy-csp-userrights.md) +- [ReplaceProcessLevelToken](policy-csp-userrights.md) +- [ChangeTimeZone](policy-csp-userrights.md) +- [ShutDownTheSystem](policy-csp-userrights.md) +- [LogOnAsBatchJob](policy-csp-userrights.md) +- [ProfileSystemPerformance](policy-csp-userrights.md) +- [DenyLogOnAsBatchJob](policy-csp-userrights.md) +- [LogOnAsService](policy-csp-userrights.md) +- [IncreaseProcessWorkingSet](policy-csp-userrights.md) ## VirtualizationBasedTechnology -- [HypervisorEnforcedCodeIntegrity](policy-csp-virtualizationbasedtechnology.md#virtualizationbasedtechnology-hypervisorenforcedcodeintegrity) -- [RequireUEFIMemoryAttributesTable](policy-csp-virtualizationbasedtechnology.md#virtualizationbasedtechnology-requireuefimemoryattributestable) +- [HypervisorEnforcedCodeIntegrity](policy-csp-virtualizationbasedtechnology.md) +- [RequireUEFIMemoryAttributesTable](policy-csp-virtualizationbasedtechnology.md) ## WebThreatDefense -- [ServiceEnabled](policy-csp-webthreatdefense.md#webthreatdefense-serviceenabled) -- [NotifyMalicious](policy-csp-webthreatdefense.md#webthreatdefense-notifymalicious) -- [NotifyPasswordReuse](policy-csp-webthreatdefense.md#webthreatdefense-notifypasswordreuse) -- [NotifyUnsafeApp](policy-csp-webthreatdefense.md#webthreatdefense-notifyunsafeapp) +- [ServiceEnabled](policy-csp-webthreatdefense.md) +- [NotifyMalicious](policy-csp-webthreatdefense.md) +- [NotifyPasswordReuse](policy-csp-webthreatdefense.md) +- [NotifyUnsafeApp](policy-csp-webthreatdefense.md) ## Wifi -- [AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) -- [AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md) +- [AllowInternetSharing](policy-csp-wifi.md) ## WindowsDefenderSecurityCenter -- [CompanyName](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) -- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) -- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) -- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) -- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) -- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) -- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) -- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) -- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) -- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) -- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) -- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) -- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) -- [Email](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) -- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) -- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) -- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) -- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) -- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) -- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) -- [Phone](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) -- [URL](policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) +- [CompanyName](policy-csp-windowsdefendersecuritycenter.md) +- [DisableAppBrowserUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableEnhancedNotifications](policy-csp-windowsdefendersecuritycenter.md) +- [DisableFamilyUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableAccountProtectionUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableClearTpmButton](policy-csp-windowsdefendersecuritycenter.md) +- [DisableDeviceSecurityUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableHealthUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableNetworkUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisableNotifications](policy-csp-windowsdefendersecuritycenter.md) +- [DisableTpmFirmwareUpdateWarning](policy-csp-windowsdefendersecuritycenter.md) +- [DisableVirusUI](policy-csp-windowsdefendersecuritycenter.md) +- [DisallowExploitProtectionOverride](policy-csp-windowsdefendersecuritycenter.md) +- [Email](policy-csp-windowsdefendersecuritycenter.md) +- [EnableCustomizedToasts](policy-csp-windowsdefendersecuritycenter.md) +- [EnableInAppCustomization](policy-csp-windowsdefendersecuritycenter.md) +- [HideRansomwareDataRecovery](policy-csp-windowsdefendersecuritycenter.md) +- [HideSecureBoot](policy-csp-windowsdefendersecuritycenter.md) +- [HideTPMTroubleshooting](policy-csp-windowsdefendersecuritycenter.md) +- [HideWindowsSecurityNotificationAreaControl](policy-csp-windowsdefendersecuritycenter.md) +- [Phone](policy-csp-windowsdefendersecuritycenter.md) +- [URL](policy-csp-windowsdefendersecuritycenter.md) ## WindowsInkWorkspace -- [AllowWindowsInkWorkspace](policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) -- [AllowSuggestedAppsInWindowsInkWorkspace](policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) +- [AllowWindowsInkWorkspace](policy-csp-windowsinkworkspace.md) +- [AllowSuggestedAppsInWindowsInkWorkspace](policy-csp-windowsinkworkspace.md) ## WindowsLogon -- [HideFastUserSwitching](policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) -- [EnableFirstLogonAnimation](policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) +- [HideFastUserSwitching](policy-csp-windowslogon.md) +- [EnableFirstLogonAnimation](policy-csp-windowslogon.md) ## WindowsSandbox -- [AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu) -- [AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking) -- [AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput) -- [AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) -- [AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection) -- [AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection) +- [AllowVGPU](policy-csp-windowssandbox.md) +- [AllowNetworking](policy-csp-windowssandbox.md) +- [AllowAudioInput](policy-csp-windowssandbox.md) +- [AllowVideoInput](policy-csp-windowssandbox.md) +- [AllowPrinterRedirection](policy-csp-windowssandbox.md) +- [AllowClipboardRedirection](policy-csp-windowssandbox.md) ## WirelessDisplay -- [AllowProjectionToPC](policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) -- [RequirePinForPairing](policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) +- [AllowProjectionToPC](policy-csp-wirelessdisplay.md) +- [RequirePinForPairing](policy-csp-wirelessdisplay.md) ## Related articles diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index ca3b912970..43dbef71be 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -19,6 +19,34 @@ ms.topic: article +The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 11. Use this configuration service provider to configure any company policies. + +The Policy configuration service provider has the following sub-categories: + +- Policy/Config/**AreaName** - Handles the policy configuration request from the server. +- Policy/Result/**AreaName** - Provides a read-only path to policies enforced on the device. + + + +> [!IMPORTANT] +> Policy scope is the level at which a policy can be configured. Some policies can only be configured at the device level, meaning the policy will take effect independent of who is logged into the device. Other policies can be configured at the user level, meaning the policy will only take effect for that user. +> +> The allowed scope of a specific policy is represented below its table of supported Windows editions. To configure a policy under a specific scope (user vs. device), please use the following paths: +> +> User scope: +> +> - **./User/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. +> - **./User/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. +> +> Device scope: +> +> - **./Device/Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. +> - **./Device/Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. +> +> For device wide configuration the **_Device/_** portion may be omitted from the path, deeming the following paths respectively equivalent to the paths provided above: +> +> - **./Vendor/MSFT/Policy/Config/_AreaName/PolicyName_** to configure the policy. +> - **./Vendor/MSFT/Policy/Result/_AreaName/PolicyName_** to get the result. @@ -149,6 +177,14 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs +The following list shows some tips to help you when configuring policies: + +- Separate substring values by Unicode `0xF000` in the XML file. + > [!NOTE] + > A query from a different caller could provide a different value as each caller could have different values for a named policy. +- In SyncML, wrap this policy with the Atomic command so that the policy settings are treated as a single transaction. +- Supported operations are Add, Get, Delete, and Replace. +- Value type is string. @@ -226,6 +262,10 @@ Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported + For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](../win32-and-centennial-app-policy-configuration.md). + +> [!NOTE] +> The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](/previous-versions/office/office-2013-resource-kit/cc179097(v=office.15)). @@ -689,6 +729,14 @@ The area group that can be configured by a single technology for a single provid +The following list shows some tips to help you when configuring policies: + +- Separate substring values by Unicode `0xF000` in the XML file. + > [!NOTE] + > A query from a different caller could provide a different value as each caller could have different values for a named policy. +- In SyncML, wrap this policy with the Atomic command so that the policy settings are treated as a single transaction. +- Supported operations are Add, Get, Delete, and Replace. +- Value type is string. @@ -862,7 +910,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f -## Policy CSPs +## Policy Areas - [AboveLock](policy-csp-abovelock.md) - [Accounts](policy-csp-accounts.md) diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md new file mode 100644 index 0000000000..3525bf6adf --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -0,0 +1,107 @@ +--- +title: ADMX_sam Policy CSP +description: Learn more about the ADMX_sam CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - ADMX_sam + + + + + + +## SamNGCKeyROCAValidation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_sam/SamNGCKeyROCAValidation +``` + + + +This policy setting allows you to configure how domain controllers handle Windows Hello for Business (WHfB) keys that are vulnerable to the "Return of Coppersmith's attack" (ROCA) vulnerability. + +For more information on the ROCA vulnerability, please see: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15361 + +https://en.wikipedia.org/wiki/ROCA_vulnerability + +If you enable this policy setting the following options are supported: + +Ignore: during authentication the domain controller will not probe any WHfB keys for the ROCA vulnerability. + +Audit: during authentication the domain controller will emit audit events for WHfB keys that are subject to the ROCA vulnerability (authentications will still succeed). + +Block: during authentication the domain controller will block the use of WHfB keys that are subject to the ROCA vulnerability (authentications will fail). + +This setting only takes effect on domain controllers. + +If not configured, domain controllers will default to using their local configuration. The default local configuration is Audit. + +A reboot is not required for changes to this setting to take effect. + +Note: to avoid unexpected disruptions this setting should not be set to Block until appropriate mitigations have been performed, for example patching of vulnerable TPMs. + +More information is available at https://go.microsoft.com/fwlink/?linkid=2116430. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | SamNGCKeyROCAValidation | +| Friendly Name | Configure validation of ROCA-vulnerable WHfB keys during authentication | +| Location | Computer Configuration | +| Path | System > Security Account Manager | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\SAM | +| ADMX File Name | sam.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-cloudpc.md b/windows/client-management/mdm/policy-csp-cloudpc.md new file mode 100644 index 0000000000..64eba24f5e --- /dev/null +++ b/windows/client-management/mdm/policy-csp-cloudpc.md @@ -0,0 +1,80 @@ +--- +title: CloudPC Policy CSP +description: Learn more about the CloudPC CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - CloudPC + + + + + + +## CloudPCConfiguration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/CloudPC/CloudPCConfiguration +``` + + + +This policy is used by IT admin to set the configuration mode of cloud PC. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Fast Switching Configuration. | +| 1 | Boot to cloud PC Configuration. | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md new file mode 100644 index 0000000000..3a1d8fa452 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -0,0 +1,80 @@ +--- +title: Stickers Policy CSP +description: Learn more about the Stickers CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - Stickers + + + + + + +## EnableStickers + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/Stickers/EnableStickers +``` + + + +This policy setting allows you to control whether you want to allow stickers to be edited and placed on Desktop + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled. | +| 1 | Enabled. | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md new file mode 100644 index 0000000000..9ff31f2a3c --- /dev/null +++ b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md @@ -0,0 +1,81 @@ +--- +title: TenantDefinedTelemetry Policy CSP +description: Learn more about the TenantDefinedTelemetry CSP Policy +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/01/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.reviewer: +ms.technology: itpro-manage +ms.topic: article +--- + + + + +# Policy CSP - TenantDefinedTelemetry + + + + + + +## CustomTelemetryId + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:x: Pro
:x: Enterprise
:x: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/TenantDefinedTelemetry/CustomTelemetryId +``` + + + +This policy is used to let mission control what type of Edition we are currently in. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Base | +| 1 | Education | +| 2 | Commercial | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index c7458eaa49..9ff945c474 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -252,6 +252,8 @@ items: href: policy-csp-admx-removablestorage.md - name: ADMX_RPC href: policy-csp-admx-rpc.md + - name: ADMX_sam + href: policy-csp-admx-sam.md - name: ADMX_Scripts href: policy-csp-admx-scripts.md - name: ADMX_sdiageng @@ -364,6 +366,8 @@ items: href: policy-csp-camera.md - name: Cellular href: policy-csp-cellular.md + - name: CloudPC + href: policy-csp-cloudpc.md - name: Connectivity href: policy-csp-connectivity.md - name: ControlPolicyConflict @@ -500,6 +504,8 @@ items: href: policy-csp-speech.md - name: Start href: policy-csp-start.md + - name: Stickers + href: policy-csp-stickers.md - name: Storage href: policy-csp-storage.md - name: System @@ -510,6 +516,8 @@ items: href: policy-csp-taskmanager.md - name: TaskScheduler href: policy-csp-taskscheduler.md + - name: TenantDefinedTelemetry + href: policy-csp-tenantdefinedtelemetry.md - name: TenantRestrictions href: policy-csp-tenantrestrictions.md - name: TextInput From 7a2eb5c5ed5e9b1e8b5a707a1bfe36f0352c9615 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 1 Nov 2022 16:56:21 -0400 Subject: [PATCH 005/324] Fix links in other files --- .../client-management/enable-admx-backed-policies-in-mdm.md | 4 ++-- windows/client-management/mdm/enterprisedataprotection-csp.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/enable-admx-backed-policies-in-mdm.md b/windows/client-management/enable-admx-backed-policies-in-mdm.md index a5dc882b93..ce77a2e025 100644 --- a/windows/client-management/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/enable-admx-backed-policies-in-mdm.md @@ -8,7 +8,7 @@ ms.technology: itpro-manage author: vinaypamnani-msft ms.localizationpriority: medium ms.date: 11/01/2017 -ms.reviewer: +ms.reviewer: manager: aaroncz --- @@ -105,7 +105,7 @@ See [Support Tip: Ingesting Office ADMX policies using Microsoft Intune](https:/ 2. Find the variable names of the parameters in the ADMX file. - You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](mdm/policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). + You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](mdm/policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2). ![Publishing server 2 policy description.](images/admx-appv-policy-description.png) diff --git a/windows/client-management/mdm/enterprisedataprotection-csp.md b/windows/client-management/mdm/enterprisedataprotection-csp.md index 17adea149a..0fd382bd56 100644 --- a/windows/client-management/mdm/enterprisedataprotection-csp.md +++ b/windows/client-management/mdm/enterprisedataprotection-csp.md @@ -277,7 +277,7 @@ Specifies whether to allow Azure RMS encryption for Windows Information Protecti Supported operations are Add, Get, Replace, and Delete. Value type is integer. **Settings/SMBAutoEncryptedFileExtensions** -Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from a Server Message Block (SMB) share within the corporate boundary as defined in the Policy CSP nodes for [NetworkIsolation/EnterpriseIPRange](policy-configuration-service-provider.md#networkisolation-enterpriseiprange) and [NetworkIsolation/EnterpriseNetworkDomainNames](policy-configuration-service-provider.md#networkisolation-enterprisenetworkdomainnames). Use semicolon (;) delimiter in the list. +Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from a Server Message Block (SMB) share within the corporate boundary as defined in the Policy CSP nodes for [NetworkIsolation/EnterpriseIPRange](policy-csp-networkisolation.md) and [NetworkIsolation/EnterpriseNetworkDomainNames](policy-csp-networkisolation.md). Use semicolon (;) delimiter in the list. When this policy isn't specified, the existing auto-encryption behavior is applied. When this policy is configured, only files with the extensions in the list will be encrypted. Supported operations are Add, Get, Replace and Delete. Value type is string. From 1252ea0791958596da552d1a03598ed6debcd43b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 2 Nov 2022 13:05:26 -0400 Subject: [PATCH 006/324] Add Defender CSP & update metadata --- windows/client-management/mdm/defender-csp.md | 4234 ++++++++++++++--- windows/client-management/mdm/defender-ddf.md | 3027 ++++++++---- .../mdm/policies-in-policy-csp-admx-backed.md | 5 +- ...in-policy-csp-supported-by-group-policy.md | 5 +- .../policy-configuration-service-provider.md | 5 +- .../mdm/policy-csp-admx-mss-legacy.md | 5 +- .../mdm/policy-csp-admx-qos.md | 5 +- .../mdm/policy-csp-admx-sam.md | 5 +- .../mdm/policy-csp-admx-tabletpcinputpanel.md | 5 +- .../mdm/policy-csp-cloudpc.md | 5 +- .../mdm/policy-csp-defender.md | 5 +- .../mdm/policy-csp-msslegacy.md | 5 +- .../mdm/policy-csp-settingssync.md | 5 +- .../mdm/policy-csp-stickers.md | 5 +- .../mdm/policy-csp-tenantdefinedtelemetry.md | 5 +- .../mdm/policy-csp-tenantrestrictions.md | 5 +- 16 files changed, 5746 insertions(+), 1585 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 53f26f9b51..d6cf51c3ac 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,445 +1,3100 @@ --- title: Defender CSP -description: Learn how the Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. -ms.reviewer: +description: Learn more about the Defender CSP Policy +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: vinaypamnani-msft +ms.date: 11/02/2022 ms.localizationpriority: medium -ms.date: 02/22/2022 +ms.prod: windows-client +ms.technology: itpro-manage +ms.topic: reference --- + + + # Defender CSP -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +The following example shows the Defender configuration service provider in tree format. -The Windows Defender configuration service provider is used to configure various Windows Defender actions across the enterprise. - -The following example shows the Windows Defender configuration service provider in tree format. +```text +./Device/Vendor/MSFT/Defender +--- Configuration +------ AllowDatagramProcessingOnWinServer +------ AllowNetworkProtectionDownLevel +------ AllowNetworkProtectionOnWinServer +------ ASROnlyPerRuleExclusions +------ DataDuplicationDirectory +------ DataDuplicationRemoteLocation +------ DefaultEnforcement +------ DeviceControl +--------- PolicyGroups +------------ {GroupId} +--------------- GroupData +--------- PolicyRules +------------ {RuleId} +--------------- RuleData +------ DeviceControlEnabled +------ DisableCpuThrottleOnIdleScans +------ DisableDnsOverTcpParsing +------ DisableDnsParsing +------ DisableFtpParsing +------ DisableGradualRelease +------ DisableHttpParsing +------ DisableInboundConnectionFiltering +------ DisableLocalAdminMerge +------ DisableNetworkProtectionPerfTelemetry +------ DisableRdpParsing +------ DisableSshParsing +------ DisableTlsParsing +------ EnableDnsSinkhole +------ EnableFileHashComputation +------ EngineUpdatesChannel +------ ExcludedIpAddresses +------ HideExclusionsFromLocalAdmins +------ MeteredConnectionUpdates +------ PassiveRemediation +------ PauseUpdateExpirationTime +------ PauseUpdateFlag +------ PauseUpdateStartTime +------ PlatformUpdatesChannel +------ SchedulerRandomizationTime +------ SecurityIntelligenceUpdatesChannel +------ SupportLogLocation +------ TamperProtection +------ TDTFeatureEnabled +------ ThrottleForScheduledScanOnly +--- Detections +------ {ThreatId} +--------- Category +--------- CurrentStatus +--------- ExecutionStatus +--------- InitialDetectionTime +--------- LastThreatStatusChangeTime +--------- Name +--------- NumberOfDetections +--------- Severity +--------- URL +--- Health +------ ComputerState +------ DefenderEnabled +------ DefenderVersion +------ EngineVersion +------ FullScanOverdue +------ FullScanRequired +------ FullScanSigVersion +------ FullScanTime +------ IsVirtualMachine +------ NisEnabled +------ ProductStatus +------ QuickScanOverdue +------ QuickScanSigVersion +------ QuickScanTime +------ RebootRequired +------ RtpEnabled +------ SignatureOutOfDate +------ SignatureVersion +------ TamperProtectionEnabled +--- OfflineScan +--- RollbackEngine +--- RollbackPlatform +--- Scan +--- UpdateSignature ``` -./Vendor/MSFT -Defender -----Detections ---------ThreatId -------------Name -------------URL -------------Severity -------------Category -------------CurrentStatus -------------ExecutionStatus -------------InitialDetectionTime -------------LastThreatStatusChangeTime -------------NumberOfDetections -----EnableNetworkProtection ---------AllowNetworkProtectionDownLevel ---------AllowNetworkProtectionOnWinServer ---------DisableNetworkProtectionPerfTelemetry ---------DisableDatagramProcessing ---------DisableInboundConnectionFiltering ---------EnableDnsSinkhole ---------DisableDnsOverTcpParsing ---------DisableHttpParsing ---------DisableRdpParsing ---------DisableSshParsing ---------DisableTlsParsing -----Health ---------ProductStatus (Added in Windows 10 version 1809) ---------ComputerState ---------DefenderEnabled ---------RtpEnabled ---------NisEnabled ---------QuickScanOverdue ---------FullScanOverdue ---------SignatureOutOfDate ---------RebootRequired ---------FullScanRequired ---------EngineVersion ---------SignatureVersion ---------DefenderVersion ---------QuickScanTime ---------FullScanTime ---------QuickScanSigVersion ---------FullScanSigVersion ---------TamperProtectionEnabled (Added in Windows 10, version 1903) ---------IsVirtualMachine (Added in Windows 10, version 1903) -----Configuration (Added in Windows 10, version 1903) ---------TamperProtection (Added in Windows 10, version 1903) ---------EnableFileHashComputation (Added in Windows 10, version 1903) ---------SupportLogLocation (Added in the next major release of Windows 10) ---------PlatformUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) ---------EngineUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) ---------SecurityIntelligenceUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) ---------DisableGradualRelease (Added with the 4.18.2106.5 Defender platform release) ---------PassiveRemediation (Added with the 4.18.2202.X Defender platform release) -----Scan -----UpdateSignature -----OfflineScan (Added in Windows 10 version 1803) + + + +## Configuration + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration ``` -**Detections** + + + +An interior node to group Windows Defender configuration information. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### Configuration/AllowDatagramProcessingOnWinServer + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/AllowDatagramProcessingOnWinServer +``` + + + +This settings controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of DisableDatagramProcessing will be ignored and default to disabling Datagram inspection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Datagram processing on Windows Server is enabled. | +| 0 | Datagram processing on Windows Server is disabled. | + + + + + + + + + +### Configuration/AllowNetworkProtectionDownLevel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/AllowNetworkProtectionDownLevel +``` + + + +This settings controls whether Network Protection is allowed to be configured into block or audit mode on windows downlevel of RS3. If false, the value of EnableNetworkProtection will be ignored. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Network protection will be enabled downlevel. | +| 0 | Network protection will be disabled downlevel. | + + + + + + + + + +### Configuration/AllowNetworkProtectionOnWinServer + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/AllowNetworkProtectionOnWinServer +``` + + + +This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 (Default) | Allow | +| 0 | Disallow | + + + + + + + + + +### Configuration/ASROnlyPerRuleExclusions + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1709 [10.0.16299] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ASROnlyPerRuleExclusions +``` + + + +Apply ASR only per rule exclusions. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/DataDuplicationDirectory + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DataDuplicationDirectory +``` + + + +Define data duplication directory for device control. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/DataDuplicationRemoteLocation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DataDuplicationRemoteLocation +``` + + + +Define data duplication remote location for device control. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/DefaultEnforcement + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DefaultEnforcement +``` + + + +Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Default Allow Enforcement | +| 2 | Default Deny Enforcement | + + + + + + + + + +### Configuration/DeviceControl + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +#### Configuration/DeviceControl/PolicyGroups + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +##### Configuration/DeviceControl/PolicyGroups/{GroupId} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/{GroupId} +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +###### Configuration/DeviceControl/PolicyGroups/{GroupId}/GroupData + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyGroups/{GroupId}/GroupData +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +#### Configuration/DeviceControl/PolicyRules + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +##### Configuration/DeviceControl/PolicyRules/{RuleId} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/{RuleId} +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +###### Configuration/DeviceControl/PolicyRules/{RuleId}/RuleData + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControl/PolicyRules/{RuleId}/RuleData +``` + + + + + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/DeviceControlEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DeviceControlEnabled +``` + + + +Control Device Control feature. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | | +| 0 | | + + + + + + + + + +### Configuration/DisableCpuThrottleOnIdleScans + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableCpuThrottleOnIdleScans +``` + + + +Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and will not throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans this flag will have no impact and normal throttling will occur. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 (Default) | Disable CPU Throttle on idle scans | +| 0 | Enable CPU Throttle on idle scans | + + + + + + + + + +### Configuration/DisableDnsOverTcpParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableDnsOverTcpParsing +``` + + + +This setting disables DNS over TCP Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | DNS over TCP parsing is disabled | +| 0 (Default) | DNS over TCP parsing is enabled | + + + + + + + + + +### Configuration/DisableDnsParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableDnsParsing +``` + + + +This setting disables DNS Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | DNS parsing is disabled | +| 0 (Default) | DNS parsing is enabled | + + + + + + + + + +### Configuration/DisableFtpParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableFtpParsing +``` + + + +This setting disables FTP Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | FTP parsing is disabled | +| 0 (Default) | FTP parsing is enabled | + + + + + + + + + +### Configuration/DisableGradualRelease + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableGradualRelease +``` + + + +Enable this policy to disable gradual rollout of Defender updates. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Gradual release is disabled | +| 0 | Gradual release is enabled | + + + + + + + + + +### Configuration/DisableHttpParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableHttpParsing +``` + + + +This setting disables HTTP Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | HTTP parsing is disabled | +| 0 (Default) | HTTP parsing is enabled | + + + + + + + + + +### Configuration/DisableInboundConnectionFiltering + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableInboundConnectionFiltering +``` + + + +This setting disables Inbound connection filtering for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Inbound connection filtering is disabled | +| 0 | Inbound connection filtering is enabled | + + + + + + + + + +### Configuration/DisableLocalAdminMerge + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableLocalAdminMerge +``` + + + +When this value is set to false, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Disable Local Admin Merge | +| 0 | Enable Local Admin Merge | + + + + + + + + + +### Configuration/DisableNetworkProtectionPerfTelemetry + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableNetworkProtectionPerfTelemetry +``` + + + +This setting disables the gathering and send of performance telemetry from Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Network protection telemetry is disabled | +| 0 | Network protection telemetry is enabled | + + + + + + + + + +### Configuration/DisableRdpParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableRdpParsing +``` + + + +This setting disables RDP Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | RDP Parsing is disabled | +| 0 | RDP Parsing is enabled | + + + + + + + + + +### Configuration/DisableSshParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableSshParsing +``` + + + +This setting disables SSH Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | SSH parsing is disabled | +| 0 (Default) | SSH parsing is enabled | + + + + + + + + + +### Configuration/DisableTlsParsing + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/DisableTlsParsing +``` + + + +This setting disables TLS Parsing for Network Protection. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | TLS parsing is disabled | +| 0 (Default) | TLS parsing is enabled | + + + + + + + + + +### Configuration/EnableDnsSinkhole + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EnableDnsSinkhole +``` + + + +This setting enables the DNS Sinkhole feature for Network Protection, respecting the value of EnableNetworkProtection for block vs audit, does nothing in inspect mode. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | DNS Sinkhole is disabled | +| 0 | DNS Sinkhole is enabled | + + + + + + + + + +### Configuration/EnableFileHashComputation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EnableFileHashComputation +``` + + + +Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Disable | +| 1 | Enable | + + + + + + + + + +### Configuration/EngineUpdatesChannel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/EngineUpdatesChannel +``` + + + +Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. | +| 2 | Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. | +| 3 | Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. | +| 4 | Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). | +| 5 | Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). | +| 6 | Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. | + + + + + + + + + +### Configuration/ExcludedIpAddresses + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ExcludedIpAddresses +``` + + + +This node contains a list of values specifying any IP addresses that wdnisdrv will ignore when intercepting traffic. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | List (Delimiter: `|`) | + + + + + + + + + +### Configuration/HideExclusionsFromLocalAdmins + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/HideExclusionsFromLocalAdmins +``` + + + +This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled. + + + + +> [!NOTE] +> Applying this setting won't remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in Get-MpPreference. + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | If you enable this setting, local admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell. | +| 0 | If you disable or do not configure this setting, local admins will be able to see exclusions in the Windows Security App and via PowerShell. | + + + + + + + + + +### Configuration/MeteredConnectionUpdates + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/MeteredConnectionUpdates +``` + + + +Allow managed devices to update through metered connections. Default is 0 - not allowed, 1 - allowed + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | Allowed | +| 0 (Default) | Not Allowed | + + + + + + + + + +### Configuration/PassiveRemediation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/PassiveRemediation +``` + + + +Setting to control automatic remediation for Sense scans. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Flag | Description | +|:--|:--| +| 0x1 | PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation | +| 0x2 | PASSIVE_REMEDIATION_FLAG_RTP_AUDIT: Passive Remediation Realtime Protection Audit | +| 0x4 | PASSIVE_REMEDIATION_FLAG_RTP_REMEDIATION: Passive Remediation Realtime Protection Remediation | + + + + + + + + + +### Configuration/PauseUpdateExpirationTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/PauseUpdateExpirationTime +``` + + + +Pause update until the UTC time in ISO string format without milliseconds, for example, 2022-02-24T00:03:59Z. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/PauseUpdateFlag + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/PauseUpdateFlag +``` + + + +Setting to control automatic remediation for Sense scans. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Update not paused | +| 1 | Update paused | + + + + + + + + + +### Configuration/PauseUpdateStartTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/PauseUpdateStartTime +``` + + + +Pause update from the UTC time in ISO string format without milliseconds, for example, 2022-02-24T00:03:59Z. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/PlatformUpdatesChannel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/PlatformUpdatesChannel +``` + + + +Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. | +| 2 | Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. | +| 3 | Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. | +| 4 | Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). | +| 5 | Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). | +| 6 | Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. | + + + + + + + + + +### Configuration/SchedulerRandomizationTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/SchedulerRandomizationTime +``` + + + +This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours. For more information on the randomization effect please check the RandomizeScheduleTaskTimes setting. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Allowed Values | Range: `[1-23]` | +| Default Value | 4 | + + + + + + + + + +### Configuration/SecurityIntelligenceUpdatesChannel + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/SecurityIntelligenceUpdatesChannel +``` + + + +Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 | Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. | +| 4 | Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). | +| 5 | Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). | + + + + + + + + + +### Configuration/SupportLogLocation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/SupportLogLocation +``` + + + +The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (MpCmdRun.exe) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise. + + + + +Intune Support Log Location setting UI supports three states: + +- Not configured (default) - Doesn't have any impact on the default state of the device. +- 1 - Enabled. Enables the Support log location feature. Requires admin to set custom file path. +- 0 - Disabled. Turns off the Support log location feature. + +When enabled or disabled exists on the client and admin moves the setting to not configured, it won't have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. + +More details: + +- [Microsoft Defender Antivirus diagnostic data](/microsoft-365/security/defender-endpoint/collect-diagnostic-data) +- [Collect investigation package from devices](/microsoft-365/security/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices) + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/TamperProtection + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/TamperProtection +``` + + + +Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. The data type is a Signed blob. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + + + + + + + +### Configuration/TDTFeatureEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/TDTFeatureEnabled +``` + + + +This policy setting configures the integration level for Intel TDT integration for Intel TDT-capable devices. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | If you do not configure this setting, the default value will be applied. The default value is set to control by signatures. TDT will be enabled based on particular signatures that are released by Microsoft. | +| 2 | If you configure this setting to disabled, Intel TDT integration will be turned off. | + + + + + + + + + +### Configuration/ThrottleForScheduledScanOnly + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1607 [10.0.14393] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Configuration/ThrottleForScheduledScanOnly +``` + + + +A CPU usage limit can be applied to scheduled scans only, or to scheduled and custom scans. The default value applies a CPU usage limit to scheduled scans only. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 (Default) | If you enable this setting, CPU throttling will apply only to scheduled scans. | +| 0 | If you disable this setting, CPU throttling will apply to scheduled and custom scans. | + + + + + + + + + +## Detections + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Detections +``` + + + An interior node to group all threats detected by Windows Defender. + -Supported operation is Get. + + + -**Detections/***ThreatId* + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + + + + + + + + + +### Detections/{ThreatId} + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId} +``` + + + The ID of a threat that has been detected by Windows Defender. + -Supported operation is Get. + + + -**Detections/*ThreatId*/Name** -The name of the specific threat. + +**Description framework properties**: -The data type is a string. +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | +| Dynamic Node Naming | ClientInventory | + -Supported operation is Get. + + + -**Detections/*ThreatId*/URL** -URL link for more threat information. + -The data type is a string. + +#### Detections/{ThreatId}/Category -Supported operation is Get. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -**Detections/*ThreatId*/Severity** -Threat severity ID. + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/Category +``` + -The data type is integer. + +Threat category ID. Supported values: -The following list shows the supported values: +| Value | Description | +|:--|:--| +| 0 | Invalid | +| 1 | Adware | +| 2 | Spyware | +| 3 | Password stealer | +| 4 | Trojan downloader | +| 5 | Worm | +| 6 | Backdoor | +| 7 | Remote access Trojan | +| 8 | Trojan | +| 9 | Email flooder | +| 10 | Keylogger | +| 11 | Dialer | +| 12 | Monitoring software | +| 13 | Browser modifier | +| 14 | Cookie | +| 15 | Browser plugin | +| 16 | AOL exploit | +| 17 | Nuker | +| 18 | Security disabler | +| 19 | Joke program | +| 20 | Hostile ActiveX control | +| 21 | Software bundler | +| 22 | Stealth modifier | +| 23 | Settings modifier | +| 24 | Toolbar | +| 25 | Remote control software | +| 26 | Trojan FTP | +| 27 | Potential unwanted software | +| 28 | ICQ exploit | +| 29 | Trojan telnet | +| 30 | Exploit | +| 31 | File sharing program | +| 32 | Malware creation tool | +| 33 | Remote control software | +| 34 | Tool | +| 36 | Trojan denial of service | +| 37 | Trojan dropper | +| 38 | Trojan mass mailer | +| 39 | Trojan monitoring software | +| 40 | Trojan proxy server | +| 42 | Virus | +| 43 | Known | +| 44 | Unknown | +| 45 | SPP | +| 46 | Behavior | +| 47 | Vulnerability | +| 48 | Policy | +| 49 | EUS (Enterprise Unwanted Software) | +| 50 | Ransomware | +| 51 | ASR Rule | + -- 0 = Unknown -- 1 = Low -- 2 = Moderate -- 4 = High -- 5 = Severe + + + -Supported operation is Get. + +**Description framework properties**: -**Detections/*ThreatId*/Category** -Threat category ID. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + -The data type is integer. + + + -The following table describes the supported values: -

+ -| Value | Description | -|-------|-----------------------------| -| 0 | Invalid | -| 1 | Adware | -| 2 | Spyware | -| 3 | Password stealer | -| 4 | Trojan downloader | -| 5 | Worm | -| 6 | Backdoor | -| 7 | Remote access Trojan | -| 8 | Trojan | -| 9 | Email flooder | -| 10 | Key logger | -| 11 | Dialer | -| 12 | Monitoring software | -| 13 | Browser modifier | -| 14 | Cookie | -| 15 | Browser plugin | -| 16 | AOL exploit | -| 17 | Nuker | -| 18 | Security disabler | -| 19 | Joke program | -| 20 | Hostile ActiveX control | -| 21 | Software bundler | -| 22 | Stealth modifier | -| 23 | Settings modifier | -| 24 | Toolbar | -| 25 | Remote control software | -| 26 | Trojan FTP | -| 27 | Potential unwanted software | -| 28 | ICQ exploit | -| 29 | Trojan telnet | -| 30 | Exploit | -| 31 | File sharing program | -| 32 | Malware creation tool | -| 33 | Remote control software | -| 34 | Tool | -| 36 | Trojan denial of service | -| 37 | Trojan dropper | -| 38 | Trojan mass mailer | -| 39 | Trojan monitoring software | -| 40 | Trojan proxy server | -| 42 | Virus | -| 43 | Known | -| 44 | Unknown | -| 45 | SPP | -| 46 | Behavior | -| 47 | Vulnerability | -| 48 | Policy | -| 49 | EUS (Enterprise Unwanted Software)| -| 50 | Ransomware | -| 51 | ASR Rule | + +#### Detections/{ThreatId}/CurrentStatus -Supported operation is Get. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -**Detections/*ThreatId*/CurrentStatus** -Information about the current status of the threat. + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/CurrentStatus +``` + -The data type is integer. + +Information about the current status of the threat. The following list shows the supported values: -The following list shows the supported values: +| Value | Description | +|:--|:--| +| 0 | Active | +| 1 | Action failed | +| 2 | Manual steps required | +| 3 | Full scan required | +| 4 | Reboot required | +| 5 | Remediated with noncritical failures | +| 6 | Quarantined | +| 7 | Removed | +| 8 | Cleaned | +| 9 | Allowed | +| 10 | No Status ( Cleared) | + -- 0 = Active -- 1 = Action failed -- 2 = Manual steps required -- 3 = Full scan required -- 4 = Reboot required -- 5 = Remediated with noncritical failures -- 6 = Quarantined -- 7 = Removed -- 8 = Cleaned -- 9 = Allowed -- 10 = No Status (Cleared) + + + -Supported operation is Get. + +**Description framework properties**: -**Detections/*ThreatId*/CurrentStatus** -Information about the current status of the threat. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + -The data type is integer. + + + -The following list shows the supported values: + -- 0 = Active -- 1 = Action failed -- 2 = Manual steps required -- 3 = Full scan required -- 4 = Reboot required -- 5 = Remediated with noncritical failures -- 6 = Quarantined -- 7 = Removed -- 8 = Cleaned -- 9 = Allowed -- 10 = No Status (Cleared) + +#### Detections/{ThreatId}/ExecutionStatus -Supported operation is Get. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -**Detections/*ThreatId*/ExecutionStatus** + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/ExecutionStatus +``` + + + Information about the execution status of the threat. + -The data type is integer. + + + -The following list shows the supported values: + +**Description framework properties**: -- 0 = Unknown -- 1 = Blocked -- 2 = Allowed -- 3 = Running -- 4 = Not running +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + -Supported operation is Get. + + + -**Detections/*ThreatId*/InitialDetectionTime** + + + +#### Detections/{ThreatId}/InitialDetectionTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/InitialDetectionTime +``` + + + The first time this particular threat was detected. + -The data type is a string. + + + -Supported operation is Get. + +**Description framework properties**: -**Detections/*ThreatId*/LastThreatStatusChangeTime** +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +#### Detections/{ThreatId}/LastThreatStatusChangeTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/LastThreatStatusChangeTime +``` + + + The last time this particular threat was changed. + -The data type is a string. + + + -Supported operation is Get. + +**Description framework properties**: -**Detections/*ThreatId*/NumberOfDetections** +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +#### Detections/{ThreatId}/Name + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/Name +``` + + + +The name of the specific threat. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +#### Detections/{ThreatId}/NumberOfDetections + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/NumberOfDetections +``` + + + Number of times this threat has been detected on a particular client. + -The data type is integer. + + + -Supported operation is Get. + +**Description framework properties**: -**EnableNetworkProtection** +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + -The Network Protection Service is a network filter that helps to protect you against web-based malicious threats, including phishing and malware. The Network Protection service contacts the SmartScreen URL reputation service to validate the safety of connections to web resources. -The acceptable values for this parameter are: -- 0: Disabled. The Network Protection service won't block navigation to malicious websites, or contact the SmartScreen URL reputation service. It will still send connection metadata to the antimalware engine if behavior monitoring is enabled, to enhance AV Detections. -- 1: Enabled. The Network Protection service will block connections to malicious websites based on URL Reputation from the SmartScreen URL reputation service. -- 2: AuditMode. As above, but the Network Protection service won't block connections to malicious websites, but will instead log the access to the event log. + + + -Accepted values: Disabled, Enabled, and AuditMode -Position: Named -Default value: Disabled -Accept pipeline input: False -Accept wildcard characters: False + -**EnableNetworkProtection/AllowNetworkProtectionDownLevel** + +#### Detections/{ThreatId}/Severity -By default, network protection isn't allowed to be enabled on Windows versions before 1709, regardless of the setting of the EnableNetworkProtection configuration. Set this configuration to "$true" to override that behavior and allow Network Protection to be set to Enabled or Audit Mode. -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -**EnableNetworkProtection/AllowNetworkProtectionOnWinServer** + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/Severity +``` + -By default, network protection isn't allowed to be enabled on Windows Server, regardless of the setting of the EnableNetworkProtection configuration. Set this configuration to "$true" to override that behavior and allow Network Protection to be set to Enabled or Audit Mode. + +Threat severity ID. The following list shows the supported values: -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False +| Value | Description | +|:--|:--| +| 0 | Unknown | +| 1 | Low | +| 2 | Moderate | +| 4 | High | +| 5 | Severe | + -**EnableNetworkProtection/DisableNetworkProtectionPerfTelemetry** + + + -Network Protection sends up anonymized performance statistics about its connection monitoring to improve our product and help to find bugs. You can disable this behavior by setting this configuration to "$true". + +**Description framework properties**: -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + -**EnableNetworkProtection/DisableDatagramProcessing** + + + -Network Protection inspects UDP connections allowing us to find malicious DNS or other UDP Traffic. To disable this functionality, set this configuration to "$true". + -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False + +#### Detections/{ThreatId}/URL -**EnableNetworkProtection/DisableInboundConnectionFiltering** + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -Network Protection inspects and can block both connections that originate from the host machine, and those connections that originate from outside the machine. To have network connection to inspect only outbound connections, set this configuration to "$true". + +```Device +./Device/Vendor/MSFT/Defender/Detections/{ThreatId}/URL +``` + -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False + +URL link for additional threat information. + -**EnableNetworkProtection/EnableDnsSinkhole** + + + -Network Protection can inspect the DNS traffic of a machine and, in conjunction with behavior monitoring, detect and sink hole DNS exfiltration attempts and other DNS-based malicious attacks. Set this configuration to "$true" to enable this feature. + +**Description framework properties**: -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + -**EnableNetworkProtection/DisableDnsOverTcpParsing** + + + -Network Protection inspects DNS traffic that occurs over a TCP channel, to provide metadata for Anti-malware Behavior Monitoring or to allow for DNS sink holing if the -EnableDnsSinkhole configuration is set. This attribute can be disabled by setting this value to "$true". + -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False + +## Health -**EnableNetworkProtection/DisableDnsParsing** + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -Network Protection inspects DNS traffic that occurs over a UDP channel, to provide metadata for Anti-malware Behavior Monitoring or to allow for DNS sink holing if the -EnableDnsSinkhole configuration is set. This attribute can be disabled by setting this value to "$true". + +```Device +./Device/Vendor/MSFT/Defender/Health +``` + -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False - -**EnableNetworkProtection/DisableHttpParsing** - -Network Protection inspects HTTP traffic to see if a connection is being made to a malicious website, and to provide metadata to Behavior Monitoring. HTTP connections to malicious websites can also be blocked if Enable Network Protection is set to enabled. HTTP inspection can be disabled by setting this value to "$true". - -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False - -**EnableNetworkProtection/DisableRdpParsing** - -Network Protection inspects RDP traffic so that it can block connections from known malicious hosts if Enable Network Protection is set to be enabled, and to provide metadata to behavior monitoring. RDP inspection can be disabled by setting this value to "$true". - -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False - -**EnableNetworkProtection/DisableSshParsing** - -Network Protection inspects SSH traffic, so that it can block connections from known malicious hosts. If Enable Network Protection is set to be enabled, and to provide metadata to behavior monitoring. SSH inspection can be disabled by setting this value to "$true". - -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False - -**EnableNetworkProtection/DisableTlsParsing** - -Network Protection inspects TLS traffic (also known as HTTPS traffic) to see if a connection is being made to a malicious website, and to provide metadata to Behavior Monitoring. TLS connections to malicious websites can also be blocked if Enable Network Protection is set to enabled. HTTP inspection can be disabled by setting this value to "$true". - -- Type: Boolean -- Position: Named -- Default value: False -- Accept pipeline input: False -- Accept wildcard characters: False - -**Health** + An interior node to group information about Windows Defender health status. + -Supported operation is Get. + + + -**Health/ProductStatus** -Added in Windows 10, version 1809. Provide the current state of the product. This value is a bitmask flag value that can represent one or multiple product states from below list. + +**Description framework properties**: -The data type is integer. Supported operation is Get. +| Property name | Property value | +|:--|:--| +| Format | node | +| Access Type | Get | + -Supported product status values: -- No status = 0 -- Service not running = 1 << 0 -- Service started without any malware protection engine = 1 << 1 -- Pending full scan due to threat action = 1 << 2 -- Pending reboot due to threat action = 1 << 3 -- ending manual steps due to threat action = 1 << 4 -- AV signatures out of date = 1 << 5 -- AS signatures out of date = 1 << 6 -- No quick scan has happened for a specified period = 1 << 7 -- No full scan has happened for a specified period = 1 << 8 -- System initiated scan in progress = 1 << 9 -- System initiated clean in progress = 1 << 10 -- There are samples pending submission = 1 << 11 -- Product running in evaluation mode = 1 << 12 -- Product running in non-genuine Windows mode = 1 << 13 -- Product expired = 1 << 14 -- Off-line scan required = 1 << 15 -- Service is shutting down as part of system shutdown = 1 << 16 -- Threat remediation failed critically = 1 << 17 -- Threat remediation failed non-critically = 1 << 18 -- No status flags set (well-initialized state) = 1 << 19 -- Platform is out of date = 1 << 20 -- Platform update is in progress = 1 << 21 -- Platform is about to be outdated = 1 << 22 -- Signature or platform end of life is past or is impending = 1 << 23 -- Windows SMode signatures still in use on non-Win10S install = 1 << 24 + + + -Example: + + + +### Health/ComputerState + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/ComputerState +``` + + + +Provide the current state of the device. The following list shows the supported values: + +| Value | Description | +|:--|:--| +| 0 | Clean | +| 1 | Pending full scan | +| 2 | Pending reboot | +| 4 | Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan) | +| 8 | Pending offline scan | +| 16 | Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) | + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + + + + + + + + + +### Health/DefenderEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/DefenderEnabled +``` + + + +Indicates whether the Windows Defender service is running. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/DefenderVersion + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/DefenderVersion +``` + + + +Version number of Windows Defender on the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/EngineVersion + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/EngineVersion +``` + + + +Version number of the current Windows Defender engine on the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/FullScanOverdue + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/FullScanOverdue +``` + + + +Indicates whether a Windows Defender full scan is overdue for the device. A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and catchup Full scans are disabled (default). + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/FullScanRequired + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/FullScanRequired +``` + + + +Indicates whether a Windows Defender full scan is required. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/FullScanSigVersion + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/FullScanSigVersion +``` + + + +Signature version used for the last full scan of the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/FullScanTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/FullScanTime +``` + + + +Time of the last Windows Defender full scan of the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/IsVirtualMachine + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/IsVirtualMachine +``` + + + +Indicates whether the device is a virtual machine. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/NisEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/NisEnabled +``` + + + +Indicates whether network protection is running. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/ProductStatus + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1809 [10.0.17763] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/ProductStatus +``` + + + +Provide the current state of the product. This is a bitmask flag value that can represent one or multiple product states from below list. Supported product status values: + +| Value | Description | +|:--|:--| +| 0 | No status | +| 1 (1 << 0) | Service not running | +| 2 (1 << 1) | Service started without any malware protection engine | +| 4 (1 << 2) | Pending full scan due to threat action | +| 8 (1 << 3) | Pending reboot due to threat action | +| 16 (1 << 4) | ending manual steps due to threat action | +| 32 (1 << 5) | AV signatures out of date | +| 64 (1 << 6) | AS signatures out of date | +| 128 (1 << 7) | No quick scan has happened for a specified period | +| 256 (1 << 8) | No full scan has happened for a specified period | +| 512 (1 << 9) | System initiated scan in progress | +| 1024 (1 << 10) | System initiated clean in progress | +| 2048 (1 << 11) | There are samples pending submission | +| 4096 (1 << 12) | Product running in evaluation mode | +| 8192 (1 << 13) | Product running in non-genuine Windows mode | +| 16384 (1 << 14) | Product expired | +| 32768 (1 << 15) | Off-line scan required | +| 65536 (1 << 16) | Service is shutting down as part of system shutdown | +| 131072 (1 << 17) | Threat remediation failed critically | +| 262144 (1 << 18) | Threat remediation failed non-critically | +| 524288 (1 << 19) | No status flags set (well initialized state) | +| 1048576 (1 << 20) | Platform is out of date | +| 2097152 (1 << 21) | Platform update is in progress | +| 4194304 (1 << 22) | Platform is about to be outdated | +| 8388608 (1 << 23) | Signature or platform end of life is past or is impending | +| 16777216 (1 << 24) | Windows SMode signatures still in use on non-Win10S install | + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Get | + + + + +**Example**: ```xml @@ -456,421 +3111,522 @@ Example: ``` + -**Health/ComputerState** -Provide the current state of the device. + -The data type is integer. + +### Health/QuickScanOverdue -The following list shows the supported values: + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -- 0 = Clean -- 1 = Pending full scan -- 2 = Pending reboot -- 4 = Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan) -- 8 = Pending offline scan -- 16 = Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) + +```Device +./Device/Vendor/MSFT/Defender/Health/QuickScanOverdue +``` + -Supported operation is Get. + +Indicates whether a Windows Defender quick scan is overdue for the device. A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and catchup Quick scans are disabled (default). + -**Health/DefenderEnabled** -Indicates whether the Windows Defender service is running. + + + -The data type is a Boolean. + +**Description framework properties**: -Supported operation is Get. +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + -**Health/RtpEnabled** -Indicates whether real-time protection is running. + + + -The data type is a Boolean. + -Supported operation is Get. + +### Health/QuickScanSigVersion -**Health/NisEnabled** -Indicates whether network protection is running. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + -The data type is a Boolean. + +```Device +./Device/Vendor/MSFT/Defender/Health/QuickScanSigVersion +``` + -Supported operation is Get. - -**Health/QuickScanOverdue** -Indicates whether a Windows Defender quick scan is overdue for the device. - -A Quick scan is overdue when a scheduled Quick scan didn't complete successfully for 2 weeks and [catchup Quick scans](./policy-csp-defender.md#disablecatchupquickscan) are disabled (default). - -The data type is a Boolean. - -Supported operation is Get. - -**Health/FullScanOverdue** -Indicates whether a Windows Defender full scan is overdue for the device. - -A Full scan is overdue when a scheduled Full scan didn't complete successfully for 2 weeks and [catchup Full scans](./policy-csp-defender.md#disablecatchupfullscan) are disabled (default). - -The data type is a Boolean. - -Supported operation is Get. - -**Health/SignatureOutOfDate** -Indicates whether the Windows Defender signature is outdated. - -The data type is a Boolean. - -Supported operation is Get. - -**Health/RebootRequired** -Indicates whether a device reboot is needed. - -The data type is a Boolean. - -Supported operation is Get. - -**Health/FullScanRequired** -Indicates whether a Windows Defender full scan is required. - -The data type is a Boolean. - -Supported operation is Get. - -**Health/EngineVersion** -Version number of the current Windows Defender engine on the device. - -The data type is a string. - -Supported operation is Get. - -**Health/SignatureVersion** -Version number of the current Windows Defender signatures on the device. - -The data type is a string. - -Supported operation is Get. - -**Health/DefenderVersion** -Version number of Windows Defender on the device. - -The data type is a string. - -Supported operation is Get. - -**Health/QuickScanTime** -Time of the last Windows Defender quick scan of the device. - -The data type is a string. - -Supported operation is Get. - -**Health/FullScanTime** -Time of the last Windows Defender full scan of the device. - -The data type is a string. - -Supported operation is Get. - -**Health/QuickScanSigVersion** + Signature version used for the last quick scan of the device. + -The data type is a string. + + + -Supported operation is Get. - -**Health/FullScanSigVersion** -Signature version used for the last full scan of the device. - -The data type is a string. - -Supported operation is Get. - -**Health/TamperProtectionEnabled** -Indicates whether the Windows Defender tamper protection feature is enabled.​ - -The data type is a Boolean. - -Supported operation is Get. - -**Health/IsVirtualMachine** -Indicates whether the device is a virtual machine. - -The data type is a string. - -Supported operation is Get. - -**Configuration** -An interior node to group Windows Defender configuration information. - -Supported operation is Get. - -**Configuration/TamperProtection** - -Tamper protection helps protect important security features from unwanted changes and interference. This protection includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. - - -Send off blob to device to reset the tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. - -The data type is a Signed BLOB. - -Supported operations are Add, Delete, Get, Replace. - -Intune tamper protection setting UX supports three states: -- Not configured (default): Doesn't have any impact on the default state of the device. -- Enabled: Enables the tamper protection feature. -- Disabled: Turns off the tamper protection feature. - -When enabled or disabled exists on the client and admin moves the setting to not configured, it won't have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. - -**Configuration/DisableLocalAdminMerge**
-This policy setting controls whether or not complex list settings configured by a local administrator are merged with managed settings. This setting applies to lists such as threats and exclusion list. - -If you disable or don't configure this setting, unique items defined in preference settings configured by the local administrator will be merged into the resulting effective policy. If conflicts occur, management settings will override preference settings. - -If you enable this setting, only items defined by management will be used in the resulting effective policy. Managed settings will override preference settings configured by the local administrator. - -> [!NOTE] -> Applying this setting won't remove exclusions from the device registry, it will only prevent them from being applied/used. This is reflected in **Get-MpPreference**. - -Supported OS versions: Windows 10 - -The data type is integer. - -Supported operations are Add, Delete, Get, Replace. - -Valid values are: -- 1 – Enable. -- 0 (default) – Disable. - -**Configuration/HideExclusionsFromLocalAdmins**
- -This policy setting controls whether or not exclusions are visible to Local Admins. For end users (that aren't Local Admins) exclusions aren't visible, whether or not this setting is enabled. - -If you disable or don't configure this setting, Local Admins will be able to see exclusions in the Windows Security App, in the registry, and via PowerShell. - -If you enable this setting, Local Admins will no longer be able to see the exclusion list in the Windows Security app, in the registry, or via PowerShell. - -> [!NOTE] -> Applying this setting won't remove exclusions, it will only prevent them from being visible to Local Admins. This is reflected in **Get-MpPreference**. - -Supported OS versions: Windows 10 - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 1 – Enable. -- 0 (default) – Disable. - -**Configuration/DisableCpuThrottleOnIdleScans**
- -Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and won't throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans, this flag will have no impact and normal throttling will occur. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 1 (default) – Enable. -- 0 – Disable. - -**Configuration/MeteredConnectionUpdates**
-Allow managed devices to update through metered connections. Data charges may apply. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 1 – Enable. -- 0 (default) – Disable. - -**Configuration/AllowNetworkProtectionOnWinServer**
-This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 1 – Enable. -- 0 (default) – Disable. - -**Configuration/ExclusionIpAddress**
-Allows an administrator to explicitly disable network packet inspection made by wdnisdrv on a particular set of IP addresses. - -The data type is string. - -Supported operations are Add, Delete, Get, and Replace. - -**Configuration/EnableFileHashComputation** -Enables or disables file hash computation feature. -When this feature is enabled, Windows Defender will compute hashes for files it scans. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 1 – Enable. -- 0 (default) – Disable. - -**Configuration/SupportLogLocation** -The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (**MpCmdRun.exe**) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise. - -Data type is string. - -Supported operations are Add, Delete, Get, and Replace. - -Intune Support log location setting UX supports three states: - -- Not configured (default) - Doesn't have any impact on the default state of the device. -- 1 - Enabled. Enables the Support log location feature. Requires admin to set custom file path. -- 0 - Disabled. Turns off the Support log location feature. - -When enabled or disabled exists on the client and admin moves the setting to not configured, it won't have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. - -More details: - -- [Microsoft Defender Antivirus diagnostic data](/microsoft-365/security/defender-endpoint/collect-diagnostic-data) -- [Collect investigation package from devices](/microsoft-365/security/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices) - -**Configuration/PlatformUpdatesChannel** -Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. - -Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. - -Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. - -Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested applying to a small, representative part of your production population (~10%). - -Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). - -Critical: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only - -If you disable or don't configure this policy, the device will stay up to date automatically during the gradual release cycle. Suitable for most devices. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 0: Not configured (Default) -- 2: Beta Channel - Prerelease -- 3: Current Channel (Preview) -- 4: Current Channel (Staged) -- 5: Current Channel (Broad) -- 6: Critical- Time Delay - - -More details: - -- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) -- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) - -**Configuration/EngineUpdatesChannel** -Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. - -Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. - -Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. - -Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested applying to a small, representative part of your production population (~10%). - -Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). - -Critical: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only - -If you disable or don't configure this policy, the device will stay up to date automatically during the gradual release cycle. Suitable for most devices. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 0: Not configured (Default) -- 2: Beta Channel - Prerelease -- 3: Current Channel (Preview) -- 4: Current Channel (Staged) -- 5: Current Channel (Broad) -- 6: Critical- Time Delay - -More details: - -- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) -- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) - -**Configuration/SecurityIntelligenceUpdatesChannel** -Enable this policy to specify when devices receive daily Microsoft Defender security intelligence (definition) updates during the daily gradual rollout. - -Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). - -Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). - -If you disable or don't configure this policy, the device will stay up to date automatically during the daily release cycle. Suitable for most devices. - -The data type is integer. -Supported operations are Add, Delete, Get, and Replace. - -Valid Values are: -- 0: Not configured (Default) -- 4: Current Channel (Staged) -- 5: Current Channel (Broad) - -More details: - -- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) -- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) - -**Configuration/DisableGradualRelease** -Enable this policy to disable gradual rollout of monthly and daily Microsoft Defender updates. -Devices will be offered all Microsoft Defender updates after the gradual release cycle completes. This facility for devices is best for datacenters that only receive limited updates. - -> [!NOTE] -> This setting applies to both monthly as well as daily Microsoft Defender updates and will override any previously configured channel selections for platform and engine updates. - -If you disable or don't configure this policy, the device will remain in Current Channel (Default) unless specified otherwise in specific channels for platform and engine updates. Stay up to date automatically during the gradual release cycle. Suitable for most devices. - -The data type is integer. - -Supported operations are Add, Delete, Get, and Replace. - -Valid values are: -- 1 – Enabled. -- 0 (default) – Not Configured. - -More details: - -- [Manage the gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/manage-gradual-rollout) -- [Create a custom gradual rollout process for Microsoft Defender updates](/microsoft-365/security/defender-endpoint/configure-updates) - -**Configuration/PassiveRemediation** -This policy setting enables or disables EDR in block mode (recommended for devices running Microsoft Defender Antivirus in passive mode). For more information, see Endpoint detection and response in block mode | Microsoft Docs. Available with platform release: 4.18.2202.X - -The data type is integer - -Supported values: -- 1: Turn EDR in block mode on -- 0: Turn EDR in block mode off - - -**Scan** + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/QuickScanTime + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/QuickScanTime +``` + + + +Time of the last Windows Defender quick scan of the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/RebootRequired + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/RebootRequired +``` + + + +Indicates whether a device reboot is needed. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/RtpEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/RtpEnabled +``` + + + +Indicates whether real-time protection is running. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/SignatureOutOfDate + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/SignatureOutOfDate +``` + + + +Indicates whether the Windows Defender signature is outdated. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +### Health/SignatureVersion + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/SignatureVersion +``` + + + +Version number of the current Windows Defender signatures on the device. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Get | + + + + + + + + + +### Health/TamperProtectionEnabled + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Health/TamperProtectionEnabled +``` + + + +Indicates whether the Windows Defender tamper protection feature is enabled. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | bool | +| Access Type | Get | + + + + + + + + + +## OfflineScan + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/OfflineScan +``` + + + +OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Exec, Get | +| Reboot Behavior | ServerInitiated | + + + + + + + + + +## RollbackEngine + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/RollbackEngine +``` + + + +RollbackEngine action rolls back Microsoft Defender engine to it's last known good saved version on the computer where you run the command. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Exec, Get | +| Reboot Behavior | ServerInitiated | + + + + + + + + + +## RollbackPlatform + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/RollbackPlatform +``` + + + +RollbackPlatform action rolls back Microsoft Defender to it's last known good installation location on the computer where you run the command. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Exec, Get | +| Reboot Behavior | ServerInitiated | + + + + + + + + + +## Scan + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/Scan +``` + + + Node that can be used to start a Windows Defender scan on a device. + -Valid values are: -- 1 - quick scan -- 2 - full scan + + + -Supported operations are Get and Execute. + +**Description framework properties**: -**UpdateSignature** +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Exec, Get | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 1 | quick scan | +| 2 | full scan | + + + + + + + + + +## UpdateSignature + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1511 [10.0.10586] and later | + + + +```Device +./Device/Vendor/MSFT/Defender/UpdateSignature +``` + + + Node that can be used to perform signature updates for Windows Defender. + -Supported operations are Get and Execute. + + + -**OfflineScan** -Added in Windows 10, version 1803. OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan. + +**Description framework properties**: -Supported operations are Get and Execute. +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Exec, Get | + -## See also + + + -[Configuration service provider reference](index.yml) + + + + + + + + +## Related articles + +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index b7851e330b..661c491b22 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -1,35 +1,748 @@ --- title: Defender DDF file -description: Learn how the OMA DM device description framework (DDF) for the Defender configuration service provider is used. -ms.reviewer: +description: View the XML file containing the device description framework (DDF) for the Defender configuration service provider. +author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: vinaypamnani-msft +ms.date: 11/02/2022 ms.localizationpriority: medium -ms.date: 07/23/2021 +ms.prod: windows-client +ms.technology: itpro-manage +ms.topic: reference --- + + # Defender DDF file -This article shows the OMA DM device description framework (DDF) for the Defender configuration service provider. DDF files are used only with OMA DM provisioning XML. - -Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-ddf.md). - -The XML below is the current version for this CSP. +The following XML file contains the device description framework (DDF) for the Defender configuration service provider. ```xml -]> +]> 1.2 + + + + Defender + ./Device/Vendor/MSFT + + + + + + + + + + + + + + + + + + 10.0.10586 + 1.0 + 0x4;0x1B;0x30;0x31;0x48;0x54;0x62;0x63;0x64;0x65;0x77;0x79;0x7A;0x7D;0x7E;0x81;0x82;0x8A;0x8B;0xA1;0xA2;0xA4;0xA5;0xAB;0xAC;0xAF;0xB4;0xBC;0xBD;0xBF;0xCA;0xCB; + + + + Detections + + + + + An interior node to group all threats detected by Windows Defender. + + + + + + + + + + + + + - Defender - ./Vendor/MSFT + + + + + + + The ID of a threat that has been detected by Windows Defender. + + + + + + + + + + ThreatId + + + + + + + + + Name + + + + + The name of the specific threat. + + + + + + + + + + + + + + + + URL + + + + + URL link for additional threat information. + + + + + + + + + + + + + + + + Severity + + + + + Threat severity ID. The following list shows the supported values: 0 = Unknown; 1 = Low; 2 = Moderate; 4 = High; 5 = Severe; + + + + + + + + + + + + + + + + Category + + + + + Threat category ID. Supported values: 0-Invalid; 1-Adware; 2-Spyware; 3-Password stealer; 4-Trojan downloader; 5-Worm; 6-Backdoor; 7-Remote access Trojan; 8-Trojan; 9-Email flooder; 10-Keylogger; 11-Dialer; 12-Monitoring software; 13-Browser modifier; 14-Cookie; 15-Browser plugin; 16-AOL exploit; 17-Nuker; 18-Security disabler; 19-Joke program; 20-Hostile ActiveX control; 21-Software bundler; 22-Stealth modifier; 23-Settings modifier; 24-Toolbar; 25-Remote control software; 26-Trojan FTP; 27-Potential unwanted software; 28-ICQ exploit; 29-Trojan telnet; 30-Exploit; 31-File sharing program; 32-Malware creation tool; 33-Remote control software; 34-Tool; 36-Trojan denial of service; 37-Trojan dropper; 38-Trojan mass mailer; 39-Trojan monitoring software; 40-Trojan proxy server; 42-Virus; 43-Known; 44-Unknown; 45-SPP; 46-Behavior; 47-Vulnerability; 48-Policy; 49-EUS (Enterprise Unwanted Software); 50-Ransomware; 51-ASR Rule + + + + + + + + + + + + + + + + CurrentStatus + + + + + Information about the current status of the threat. The following list shows the supported values: 0 = Active; 1 = Action failed; 2 = Manual steps required; 3 = Full scan required; 4 = Reboot required; 5 = Remediated with noncritical failures; 6 = Quarantined; 7 = Removed; 8 = Cleaned; 9 = Allowed; 10 = No Status ( Cleared) + + + + + + + + + + + + + + + + ExecutionStatus + + + + + Information about the execution status of the threat. + + + + + + + + + + + + + + + + InitialDetectionTime + + + + + The first time this particular threat was detected. + + + + + + + + + + + + + + + + LastThreatStatusChangeTime + + + + + The last time this particular threat was changed. + + + + + + + + + + + + + + + + NumberOfDetections + + + + + Number of times this threat has been detected on a particular client. + + + + + + + + + + + + + + + + + + Health + + + + + An interior node to group information about Windows Defender health status. + + + + + + + + + + + + + + + ProductStatus + + + + + + + + + + + + + + + + + + + 10.0.17763 + 1.2 + + + + + ComputerState + + + + + Provide the current state of the device. The following list shows the supported values: 0 = Clean; 1 = Pending full scan; 2 = Pending reboot; 4 = Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan); 8 = Pending offline scan; 16 = Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) + + + + + + + + + + + + + + + + DefenderEnabled + + + + + Indicates whether the Windows Defender service is running. + + + + + + + + + + + + + + + + RtpEnabled + + + + + Indicates whether real-time protection is running. + + + + + + + + + + + + + + + + NisEnabled + + + + + Indicates whether network protection is running. + + + + + + + + + + + + + + + + QuickScanOverdue + + + + + Indicates whether a Windows Defender quick scan is overdue for the device. A Quick scan is overdue when a scheduled Quick scan did not complete successfully for 2 weeks and catchup Quick scans are disabled (default). + + + + + + + + + + + + + + + + FullScanOverdue + + + + + Indicates whether a Windows Defender full scan is overdue for the device. A Full scan is overdue when a scheduled Full scan did not complete successfully for 2 weeks and catchup Full scans are disabled (default). + + + + + + + + + + + + + + + + SignatureOutOfDate + + + + + Indicates whether the Windows Defender signature is outdated. + + + + + + + + + + + + + + + + RebootRequired + + + + + Indicates whether a device reboot is needed. + + + + + + + + + + + + + + + + FullScanRequired + + + + + Indicates whether a Windows Defender full scan is required. + + + + + + + + + + + + + + + + EngineVersion + + + + + Version number of the current Windows Defender engine on the device. + + + + + + + + + + + + + + + + SignatureVersion + + + + + Version number of the current Windows Defender signatures on the device. + + + + + + + + + + + + + + + + DefenderVersion + + + + + Version number of Windows Defender on the device. + + + + + + + + + + + + + + + + QuickScanTime + + + + + Time of the last Windows Defender quick scan of the device. + + + + + + + + + + + + + + + + FullScanTime + + + + + Time of the last Windows Defender full scan of the device. + + + + + + + + + + + + + + + + QuickScanSigVersion + + + + + Signature version used for the last quick scan of the device. + + + + + + + + + + + + + + + + FullScanSigVersion + + + + + Signature version used for the last full scan of the device. + + + + + + + + + + + + + + + + TamperProtectionEnabled + + + + + Indicates whether the Windows Defender tamper protection feature is enabled. + + + + + + + + + + + + + + 10.0.18362 + 1.3 + + + + + IsVirtualMachine + + + + + Indicates whether the device is a virtual machine. + + + + + + + + + + + + + + 10.0.18362 + 1.3 + + + + + + Configuration + + + + + An interior node to group Windows Defender configuration information. + + + + + + + + + + + + + + 10.0.18362 + 1.3 + + + + DeviceControl @@ -41,14 +754,18 @@ The XML below is the current version for this CSP. - + - com.microsoft/1.3/MDM/Defender + + + 10.0.17763 + 1.3 + - Detections + PolicyGroups @@ -63,14 +780,18 @@ The XML below is the current version for this CSP. - + - + + + + + @@ -81,16 +802,19 @@ The XML below is the current version for this CSP. - ThreatId + GroupId - + - Name + GroupData + + + @@ -102,174 +826,14 @@ The XML below is the current version for this CSP. - text/plain - - - - - URL - - - - - - - - - - - - - - - text/plain - - - - - Severity - - - - - - - - - - - - - - - text/plain - - - - - Category - - - - - - - - - - - - - - - text/plain - - - - - CurrentStatus - - - - - - - - - - - - - - - text/plain - - - - - ExecutionStatus - - - - - - - - - - - - - - - text/plain - - - - - InitialDetectionTime - - - - - - - - - - - - - - - text/plain - - - - - LastThreatStatusChangeTime - - - - - - - - - - - - - - - text/plain - - - - - NumberOfDetections - - - - - - - - - - - - - - - text/plain + - Health + PolicyRules @@ -284,480 +848,61 @@ The XML below is the current version for this CSP. - + - ProductStatus + + + + + - + - + + RuleId - text/plain - - - - - ComputerState - - - - - - - - - - - - - - - text/plain - - - - - DefenderEnabled - - - - - - - - - - - - - - - text/plain - - - - - RtpEnabled - - - - - - - - - - - - - - - text/plain - - - - - NisEnabled - - - - - - - - - - - - - - - text/plain - - - - - QuickScanOverdue - - - - - - - - - - - - - - - text/plain - - - - - FullScanOverdue - - - - - - - - - - - - - - - text/plain - - - - - SignatureOutOfDate - - - - - - - - - - - - - - - text/plain - - - - - RebootRequired - - - - - - - - - - - - - - - text/plain - - - - - FullScanRequired - - - - - - - - - - - - - - - text/plain - - - - - EngineVersion - - - - - - - - - - - - - - - text/plain - - - - - SignatureVersion - - - - - - - - - - - - - - - text/plain - - - - - DefenderVersion - - - - - - - - - - - - - - - text/plain - - - - - QuickScanTime - - - - - - - - - - - - - - - text/plain - - - - - FullScanTime - - - - - - - - - - - - - - - text/plain - - - - - QuickScanSigVersion - - - - - - - - - - - - - - - text/plain - - - - - FullScanSigVersion - - - - - - - - - - - - - - - text/plain - - - - - TamperProtectionEnabled - - - - - - - - - - - - - - - text/plain - - - - - IsVirtualMachine - - - - - - - - - - - - - - - text/plain + + + RuleData + + + + + + + + + + + + + + + + + + + + + - - Configuration - - - - - - - - - - - - - - - - - - - TamperProtection - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableFileHashComputation - - - - - - - - - - - - - - - - - - text/plain - - - - - SupportLogLocation - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableGradualRelease + + + TamperProtection @@ -765,7 +910,34 @@ The XML below is the current version for this CSP. - Enable this policy to disable gradual rollout of Defender updates. + Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. The data type is a Signed blob. + + + + + + + + + + + + + + + + + + EnableFileHashComputation + + + + + + + + 0 + Enables or disables file hash computation feature. When this feature is enabled Windows defender will compute hashes for files it scans. @@ -776,26 +948,22 @@ The XML below is the current version for this CSP. - text/plain + - - 99.9.99999 - 1.3 - - - - 1 - Gradual release is disabled - - - 0 - Gradual release is enabled - - + + + 0 + Disable + + + 1 + Enable + + - - DefinitionUpdatesChannel + + MeteredConnectionUpdates @@ -803,7 +971,8 @@ The XML below is the current version for this CSP. - Enable this policy to specify when devices receive daily Microsoft Defender definition updates during the daily gradual rollout. + 0 + Allow managed devices to update through metered connections. Default is 0 - not allowed, 1 - allowed @@ -814,30 +983,25 @@ The XML below is the current version for this CSP. - text/plain + - - 99.9.99999 - 1.3 - - - - 0 - Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. - - - 4 - Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). - - - 5 - Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). - - + + 10.0.14393 + + + + 1 + Allowed + + + 0 + Not Allowed + + - - EngineUpdatesChannel + + SupportLogLocation @@ -845,7 +1009,38 @@ The XML below is the current version for this CSP. - Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. + The support log location setting allows the administrator to specify where the Microsoft Defender Antivirus diagnostic data collection tool (MpCmdRun.exe) will save the resulting log files. This setting is configured with an MDM solution, such as Intune, and is available for Windows 10 Enterprise. + + + + + + + + + + + + + + 10.0.14393 + 9.9 + + + + + + + AllowNetworkProtectionOnWinServer + + + + + + + + 1 + This settings controls whether Network Protection is allowed to be configured into block or audit mode on Windows Server. If false, the value of EnableNetworkProtection will be ignored. @@ -856,37 +1051,399 @@ The XML below is the current version for this CSP. - text/plain + - - 99.9.99999 - 1.3 - - - - 0 - Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. - - - 2 - Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. - - - 3 - Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. - - - 4 - Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). - - - 5 - Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). - - + + 10.0.16299 + 1.3 + + + + 1 + Allow + + + 0 + Disallow + + - + + ExcludedIpAddresses + + + + + + + + This node contains a list of values specifying any IP addresses that wdnisdrv will ignore when intercepting traffic. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + + + + + DisableCpuThrottleOnIdleScans + + + + + + + + 1 + Indicates whether the CPU will be throttled for scheduled scans while the device is idle. This feature is enabled by default and will not throttle the CPU for scheduled scans performed when the device is otherwise idle, regardless of what ScanAvgCPULoadFactor is set to. For all other scheduled scans this flag will have no impact and normal throttling will occur. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Disable CPU Throttle on idle scans + + + 0 + Enable CPU Throttle on idle scans + + + + + + DisableLocalAdminMerge + + + + + + + + When this value is set to false, it allows a local admin the ability to specify some settings for complex list type that will then merge /override the Preference settings with the Policy settings + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Disable Local Admin Merge + + + 0 + Enable Local Admin Merge + + + + + + SchedulerRandomizationTime + + + + + + + + 4 + This setting allows you to configure the scheduler randomization in hours. The randomization interval is [1 - 23] hours. For more information on the randomization effect please check the RandomizeScheduleTaskTimes setting. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + [1-23] + + + + + DisableTlsParsing + + + + + + + + 0 + This setting disables TLS Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + TLS parsing is disabled + + + 0 + TLS parsing is enabled + + + + + + DisableFtpParsing + + + + + + + + 0 + This setting disables FTP Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + FTP parsing is disabled + + + 0 + FTP parsing is enabled + + + + + + DisableHttpParsing + + + + + + + + 0 + This setting disables HTTP Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + HTTP parsing is disabled + + + 0 + HTTP parsing is enabled + + + + + + DisableDnsParsing + + + + + + + + 0 + This setting disables DNS Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + DNS parsing is disabled + + + 0 + DNS parsing is enabled + + + + + + DisableDnsOverTcpParsing + + + + + + + + 0 + This setting disables DNS over TCP Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + DNS over TCP parsing is disabled + + + 0 + DNS over TCP parsing is enabled + + + + + + DisableSshParsing + + + + + + + + 0 + This setting disables SSH Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + SSH parsing is disabled + + + 0 + SSH parsing is enabled + + + + + PlatformUpdatesChannel @@ -906,104 +1463,966 @@ The XML below is the current version for this CSP. - text/plain + - - 99.9.99999 - 1.3 - - - - 0 - Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. - - - 2 - Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. - - - 3 - Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. - - - 4 - Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). - - - 5 - Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). - - + + 10.0.14393 + 1.3 + + + + 0 + Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. + + + 2 + Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. + + + 3 + Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. + + + 4 + Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). + + + 5 + Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + + + 6 + Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. + + - - - Scan - - - - - - - - - - - - - - - - text/plain - - - - - UpdateSignature - - - - - - - - - - - - - - - - text/plain - - - - - OfflineScan - - - - - - - - - - - - - - - - text/plain - - - + + EngineUpdatesChannel + + + + + + + + Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. + + + 2 + Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. + + + 3 + Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. + + + 4 + Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). + + + 5 + Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + + + 6 + Critical - Time delay: Devices will be offered updates with a 48-hour delay. Suggested for critical environments only. + + + + + SecurityIntelligenceUpdatesChannel + + + + + + + + Enable this policy to specify when devices receive Microsoft Defender security intelligence updates during the daily gradual rollout. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Not configured (Default). The device will stay up to date automatically during the gradual release cycle. Suitable for most devices. + + + 4 + Current Channel (Staged): Devices will be offered updates after the release cycle. Suggested to apply to a small, representative part of production population (~10%). + + + 5 + Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + + + + + + DisableGradualRelease + + + + + + + + Enable this policy to disable gradual rollout of Defender updates. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Gradual release is disabled + + + 0 + Gradual release is enabled + + + + + + AllowNetworkProtectionDownLevel + + + + + + + + This settings controls whether Network Protection is allowed to be configured into block or audit mode on windows downlevel of RS3. If false, the value of EnableNetworkProtection will be ignored. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Network protection will be enabled downlevel. + + + 0 + Network protection will be disabled downlevel. + + + + + + EnableDnsSinkhole + + + + + + + + This setting enables the DNS Sinkhole feature for Network Protection, respecting the value of EnableNetworkProtection for block vs audit, does nothing in inspect mode. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + DNS Sinkhole is disabled + + + 0 + DNS Sinkhole is enabled + + + + + + DisableInboundConnectionFiltering + + + + + + + + This setting disables Inbound connection filtering for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Inbound connection filtering is disabled + + + 0 + Inbound connection filtering is enabled + + + + + + DisableRdpParsing + + + + + + + + This setting disables RDP Parsing for Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + RDP Parsing is disabled + + + 0 + RDP Parsing is enabled + + + + + + AllowDatagramProcessingOnWinServer + + + + + + + + This settings controls whether Network Protection is allowed to enable datagram processing on Windows Server. If false, the value of DisableDatagramProcessing will be ignored and default to disabling Datagram inspection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Datagram processing on Windows Server is enabled. + + + 0 + Datagram processing on Windows Server is disabled. + + + + + + DisableNetworkProtectionPerfTelemetry + + + + + + + + This setting disables the gathering and send of performance telemetry from Network Protection. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + Network protection telemetry is disabled + + + 0 + Network protection telemetry is enabled + + + + + + HideExclusionsFromLocalAdmins + + + + + + + + This policy setting controls whether or not exclusions are visible to local admins. For end users (that are not local admins) exclusions are not visible, whether or not this setting is enabled. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + 1 + If you enable this setting, local admins will no longer be able to see the exclusion list in Windows Security App or via PowerShell. + + + 0 + If you disable or do not configure this setting, local admins will be able to see exclusions in the Windows Security App and via PowerShell. + + + + + + ThrottleForScheduledScanOnly + + + + + + + + 1 + A CPU usage limit can be applied to scheduled scans only, or to scheduled and custom scans. The default value applies a CPU usage limit to scheduled scans only. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 1 + If you enable this setting, CPU throttling will apply only to scheduled scans. + + + 0 + If you disable this setting, CPU throttling will apply to scheduled and custom scans. + + + + + + ASROnlyPerRuleExclusions + + + + + + + + Apply ASR only per rule exclusions. + + + + + + + + + + + + + + 10.0.16299 + 1.3 + + + + + + + DataDuplicationDirectory + + + + + + + + Define data duplication directory for device control. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + + + + DataDuplicationRemoteLocation + + + + + + + + Define data duplication remote location for device control. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + + + + DeviceControlEnabled + + + + + + + + Control Device Control feature. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + 1 + + + + + 0 + + + + + + + + DefaultEnforcement + + + + + + + + Control Device Control default enforcement. This is the enforcement applied if there are no policy rules present or at the end of the policy rules evaluation none were matched. + + + + + + + + + + + + + + 10.0.17763 + 1.3 + + + + 1 + Default Allow Enforcement + + + 2 + Default Deny Enforcement + + + + + + PassiveRemediation + + + + + + + + Setting to control automatic remediation for Sense scans. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0x1 + PASSIVE_REMEDIATION_FLAG_SENSE_AUTO_REMEDIATION: Passive Remediation Sense AutoRemediation + + + 0x2 + PASSIVE_REMEDIATION_FLAG_RTP_AUDIT: Passive Remediation Realtime Protection Audit + + + 0x4 + PASSIVE_REMEDIATION_FLAG_RTP_REMEDIATION: Passive Remediation Realtime Protection Remediation + + + + + + PauseUpdateStartTime + + + + + + + + Pause update from the UTC time in ISO string format without milliseconds, for example, 2022-02-24T00:03:59Z. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + + + + PauseUpdateExpirationTime + + + + + + + + Pause update until the UTC time in ISO string format without milliseconds, for example, 2022-02-24T00:03:59Z. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + + + + PauseUpdateFlag + + + + + + + + Setting to control automatic remediation for Sense scans. + + + + + + + + + + + + + + 10.0.14393 + 1.3 + + + + 0 + Update not paused + + + 1 + Update paused + + + + + + TDTFeatureEnabled + + + + + + + + 0 + This policy setting configures the integration level for Intel TDT integration for Intel TDT-capable devices. + + + + + + + + + + + + + + 10.0.19041 + 1.3 + + + + 0 + If you do not configure this setting, the default value will be applied. The default value is set to control by signatures. TDT will be enabled based on particular signatures that are released by Microsoft. + + + 2 + If you configure this setting to disabled, Intel TDT integration will be turned off. + + + + + + + Scan + + + + + + Node that can be used to start a Windows Defender scan on a device. + + + + + + + + + + + + + + + 1 + quick scan + + + 2 + full scan + + + + + + UpdateSignature + + + + + + Node that can be used to perform signature updates for Windows Defender. + + + + + + + + + + + + + + + + OfflineScan + + + + + + OfflineScan action starts a Microsoft Defender Offline scan on the computer where you run the command. After the next OS reboot, the device will start in Microsoft Defender Offline mode to begin the scan. + + + + + + + + + + + + + + 10.0.17134 + 1.1 + + ServerInitiated + + + + RollbackPlatform + + + + + + RollbackPlatform action rolls back Microsoft Defender to it's last known good installation location on the computer where you run the command. + + + + + + + + + + + + + + 10.0.17134 + 1.1 + + ServerInitiated + + + + RollbackEngine + + + + + + RollbackEngine action rolls back Microsoft Defender engine to it's last known good saved version on the computer where you run the command. + + + + + + + + + + + + + + 10.0.17134 + 1.1 + + ServerInitiated + + + ``` -## See also +## Related articles -[Defender configuration service provider](defender-csp.md) +[Defender configuration service provider reference](defender-csp.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index c9f905bcab..3b3a19e7b1 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -4,12 +4,11 @@ description: Learn about the ADMX-backed policies in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 43d727892e..0b6dede6bb 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,12 +4,11 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 43dbef71be..785642dd8c 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4,12 +4,11 @@ description: Learn more about the Policy CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md index 9fd3985c30..659f7439ea 100644 --- a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -4,12 +4,11 @@ description: Learn more about the ADMX_MSS-legacy CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md index 7d57c3d4a1..4a48f0aa3d 100644 --- a/windows/client-management/mdm/policy-csp-admx-qos.md +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -4,12 +4,11 @@ description: Learn more about the ADMX_QOS CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index 3525bf6adf..eb3e792143 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -4,12 +4,11 @@ description: Learn more about the ADMX_sam CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md index 66267fea76..6a7a995b0c 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -4,12 +4,11 @@ description: Learn more about the ADMX_TabletPCInputPanel CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-cloudpc.md b/windows/client-management/mdm/policy-csp-cloudpc.md index 64eba24f5e..77359405e7 100644 --- a/windows/client-management/mdm/policy-csp-cloudpc.md +++ b/windows/client-management/mdm/policy-csp-cloudpc.md @@ -4,12 +4,11 @@ description: Learn more about the CloudPC CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index e76be954c3..93e20497c1 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -4,12 +4,11 @@ description: Learn more about the Defender CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index 43921b19b7..de29173242 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -4,12 +4,11 @@ description: Learn more about the MSSLegacy CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index dd6e6688f3..30d73f4662 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -4,12 +4,11 @@ description: Learn more about the SettingsSync CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index 3a1d8fa452..04d51e25af 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -4,12 +4,11 @@ description: Learn more about the Stickers CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md index 9ff31f2a3c..09894ac916 100644 --- a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md +++ b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md @@ -4,12 +4,11 @@ description: Learn more about the TenantDefinedTelemetry CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md index dc23e0f9a1..d9959e1e0b 100644 --- a/windows/client-management/mdm/policy-csp-tenantrestrictions.md +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -4,12 +4,11 @@ description: Learn more about the TenantRestrictions CSP Policy author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/01/2022 +ms.date: 11/02/2022 ms.localizationpriority: medium ms.prod: windows-client -ms.reviewer: ms.technology: itpro-manage -ms.topic: article +ms.topic: reference --- From 3a107af97ccacd93c3c2aa04fe63ca4de0a7ec48 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 2 Nov 2022 13:32:06 -0400 Subject: [PATCH 007/324] Update metadata description --- windows/client-management/mdm/defender-csp.md | 2 +- .../mdm/policy-configuration-service-provider.md | 2 +- windows/client-management/mdm/policy-csp-admx-mss-legacy.md | 2 +- windows/client-management/mdm/policy-csp-admx-qos.md | 2 +- windows/client-management/mdm/policy-csp-admx-sam.md | 2 +- .../client-management/mdm/policy-csp-admx-tabletpcinputpanel.md | 2 +- windows/client-management/mdm/policy-csp-cloudpc.md | 2 +- windows/client-management/mdm/policy-csp-defender.md | 2 +- windows/client-management/mdm/policy-csp-msslegacy.md | 2 +- windows/client-management/mdm/policy-csp-settingssync.md | 2 +- windows/client-management/mdm/policy-csp-stickers.md | 2 +- .../client-management/mdm/policy-csp-tenantdefinedtelemetry.md | 2 +- windows/client-management/mdm/policy-csp-tenantrestrictions.md | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index d6cf51c3ac..dd6034f807 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -1,6 +1,6 @@ --- title: Defender CSP -description: Learn more about the Defender CSP Policy +description: Learn more about the Defender CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 785642dd8c..fa72136ceb 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1,6 +1,6 @@ --- title: Policy CSP -description: Learn more about the Policy CSP Policy +description: Learn more about the Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md index 659f7439ea..431042dcfc 100644 --- a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -1,6 +1,6 @@ --- title: ADMX_MSS-legacy Policy CSP -description: Learn more about the ADMX_MSS-legacy CSP Policy +description: Learn more about the ADMX_MSS-legacy Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md index 4a48f0aa3d..16de0b24d3 100644 --- a/windows/client-management/mdm/policy-csp-admx-qos.md +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -1,6 +1,6 @@ --- title: ADMX_QOS Policy CSP -description: Learn more about the ADMX_QOS CSP Policy +description: Learn more about the ADMX_QOS Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index eb3e792143..1b323dbf05 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -1,6 +1,6 @@ --- title: ADMX_sam Policy CSP -description: Learn more about the ADMX_sam CSP Policy +description: Learn more about the ADMX_sam Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md index 6a7a995b0c..57873e933e 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -1,6 +1,6 @@ --- title: ADMX_TabletPCInputPanel Policy CSP -description: Learn more about the ADMX_TabletPCInputPanel CSP Policy +description: Learn more about the ADMX_TabletPCInputPanel Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-cloudpc.md b/windows/client-management/mdm/policy-csp-cloudpc.md index 77359405e7..0c497a0c4e 100644 --- a/windows/client-management/mdm/policy-csp-cloudpc.md +++ b/windows/client-management/mdm/policy-csp-cloudpc.md @@ -1,6 +1,6 @@ --- title: CloudPC Policy CSP -description: Learn more about the CloudPC CSP Policy +description: Learn more about the CloudPC Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 93e20497c1..efc7a8a312 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,6 +1,6 @@ --- title: Defender Policy CSP -description: Learn more about the Defender CSP Policy +description: Learn more about the Defender Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index de29173242..d12e7e99bd 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,6 +1,6 @@ --- title: MSSLegacy Policy CSP -description: Learn more about the MSSLegacy CSP Policy +description: Learn more about the MSSLegacy Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index 30d73f4662..add8ac2252 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -1,6 +1,6 @@ --- title: SettingsSync Policy CSP -description: Learn more about the SettingsSync CSP Policy +description: Learn more about the SettingsSync Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-stickers.md b/windows/client-management/mdm/policy-csp-stickers.md index 04d51e25af..9b2eeee68c 100644 --- a/windows/client-management/mdm/policy-csp-stickers.md +++ b/windows/client-management/mdm/policy-csp-stickers.md @@ -1,6 +1,6 @@ --- title: Stickers Policy CSP -description: Learn more about the Stickers CSP Policy +description: Learn more about the Stickers Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md index 09894ac916..0ab6c560aa 100644 --- a/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md +++ b/windows/client-management/mdm/policy-csp-tenantdefinedtelemetry.md @@ -1,6 +1,6 @@ --- title: TenantDefinedTelemetry Policy CSP -description: Learn more about the TenantDefinedTelemetry CSP Policy +description: Learn more about the TenantDefinedTelemetry Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md index d9959e1e0b..053642d032 100644 --- a/windows/client-management/mdm/policy-csp-tenantrestrictions.md +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -1,6 +1,6 @@ --- title: TenantRestrictions Policy CSP -description: Learn more about the TenantRestrictions CSP Policy +description: Learn more about the TenantRestrictions Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa From ffc8a034c9d47006c3621ec2f201f16748318817 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 22:10:21 +0530 Subject: [PATCH 008/324] Update windows-10-subscription-activation.md added a note about excluding the Universal Store Service APIs and Web Application in the device compliance policy reference - https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device Per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10972 --- windows/deployment/windows-10-subscription-activation.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 29d62e08fa..81e56f7074 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -40,6 +40,9 @@ This article covers the following information: For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md). +> [!NOTE] +> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to “step-up” from one version of Windows to another, may want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f from their device compliance policy. + ## Subscription activation for Enterprise Windows Enterprise E3 and E5 are available as online services via subscription. You can deploy Windows Enterprise in your organization without keys and reboots. From 25da8c447f81b6a397eff89b336c46435744d480 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 22:29:24 +0530 Subject: [PATCH 009/324] Update wds-boot-support.md Updated the document to represent OS deployed vs boot image version as per the table Per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10973 --- windows/deployment/wds-boot-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index dfab934f9d..8685f727fd 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -26,7 +26,7 @@ When you PXE-boot from a WDS server that uses the **boot.wim** file from install ## Deployment scenarios affected -The table below provides support details for specific deployment scenarios (Boot Image Version). +The table below provides support details for specific deployment scenarios (The table represents OS Deployed (vertical) and Boot Image Version(Horizontal) ). ||Windows 10|Windows Server 2016|Windows Server 2019|Windows Server 2022|Windows 11| |--- |--- |--- |--- |--- |--- | From 89be3fd385c05e2662114425f7450d618bd2c771 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 9 Nov 2022 11:19:44 +0530 Subject: [PATCH 010/324] Update windows/deployment/wds-boot-support.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/wds-boot-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 8685f727fd..55b2a11be1 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -26,7 +26,7 @@ When you PXE-boot from a WDS server that uses the **boot.wim** file from install ## Deployment scenarios affected -The table below provides support details for specific deployment scenarios (The table represents OS Deployed (vertical) and Boot Image Version(Horizontal) ). +The table below provides support details for specific deployment scenarios. The table represents OS Deployed (vertical) and Boot Image Version (horizontal). ||Windows 10|Windows Server 2016|Windows Server 2019|Windows Server 2022|Windows 11| |--- |--- |--- |--- |--- |--- | From b64fa615d60109386c36adaf8f33215a3b37af8c Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 9 Nov 2022 11:20:05 +0530 Subject: [PATCH 011/324] Update windows/deployment/windows-10-subscription-activation.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/windows-10-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 81e56f7074..cf64d2e2d1 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -41,7 +41,7 @@ This article covers the following information: For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md). > [!NOTE] -> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to “step-up” from one version of Windows to another, may want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f from their device compliance policy. +> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to upgrade from one version of Windows to another might want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f, from their device compliance policy. ## Subscription activation for Enterprise From e2cebd1778f275daa8fad9e2e70c2253270b248b Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Fri, 11 Nov 2022 10:01:22 -0800 Subject: [PATCH 012/324] table change --- windows/deployment/do/mcc-isp-create-provision-deploy.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/deployment/do/mcc-isp-create-provision-deploy.md b/windows/deployment/do/mcc-isp-create-provision-deploy.md index 8781385544..f6afcf07ca 100644 --- a/windows/deployment/do/mcc-isp-create-provision-deploy.md +++ b/windows/deployment/do/mcc-isp-create-provision-deploy.md @@ -98,9 +98,8 @@ There are five IDs that the device provisioning script takes as input in order t |---|---| | Customer ID | The Azure subscription ID that the cache node is created in. | | Cache node ID | The unique alphanumeric ID of the cache node being provisioned. | -| Customer Key | The unique alphanumeric ID that provides secure authentication of the cache node to Delivery Optimization services. | -| Cache node name | The name of the cache node. | -| Tenant ID | The unique ID associated with the Azure account. | +| Customer key | The unique alphanumeric ID that provides secure authentication of the cache node to Delivery Optimization services. | +| Registration key | Single use device registration key used by Microsoft Delivery Optimization services. | :::image type="content" source="images/mcc-isp-deploy-cache-node-numbered.png" alt-text="Screenshot of the server provisioning tab within cache node configuration in Azure portal."::: From ad27987db623774c1cb5bdf36905caf3e6f63d54 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 15 Nov 2022 19:22:46 +0530 Subject: [PATCH 013/324] Update volume-activation-management-tool.md Updated the versions of OS and Office that is supported by VAMT Reference -https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md and https://github.com/MicrosoftDocs/OfficeDocs-DeployOffice/blob/live/DeployOffice/vlactivation/tools-to-manage-volume-activation-of-office.md Fixes #https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10994 --- .../volume-activation/volume-activation-management-tool.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index 9771f187cd..ec9a12e153 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -16,7 +16,7 @@ ms.custom: seo-marvel-apr2020 The Volume Activation Management Tool (VAMT) lets you automate and centrally manage the Windows, Office, and select other Microsoft products volume and retail-activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in. VAMT can be installed on any computer that has a supported Windows OS version. > [!IMPORTANT] -> VAMT is designed to manage volume activation for supported versions of Windows, Windows Server, and Office. +> VAMT is designed to manage volume activation for Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Office LTSC 2021, Office 2019, and Office 2016 (including Project and Visio). VAMT is only available in an EN-US (x86) package. From 505c4e24b68c501e95ad1b4c4adebaaeaa1312b8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 16 Nov 2022 15:11:30 -0500 Subject: [PATCH 014/324] MSGraph POST sample --- education/windows/edu-stickers.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index dc25c4e817..cb2e43478e 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -41,6 +41,12 @@ Stickers aren't enabled by default. Follow the instructions below to configure y [!INCLUDE [intune-custom-settings-2](includes/intune-custom-settings-2.md)] [!INCLUDE [intune-custom-settings-info](includes/intune-custom-settings-info.md)] +Alternatively, try using the following MSGraph call to automatically create the custom policy in your tenant: + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} +``` + #### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) To configure devices using a provisioning package, [create a provisioning package][WIN-1] using Windows Configuration Designer (WCD) with the following settings: From 81323d8fc891865f0d0615db0c48594388babcbb Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 16 Nov 2022 17:23:39 -0500 Subject: [PATCH 015/324] updates --- education/windows/edu-stickers.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index cb2e43478e..7333c0734e 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -41,7 +41,8 @@ Stickers aren't enabled by default. Follow the instructions below to configure y [!INCLUDE [intune-custom-settings-2](includes/intune-custom-settings-2.md)] [!INCLUDE [intune-custom-settings-info](includes/intune-custom-settings-info.md)] -Alternatively, try using the following MSGraph call to automatically create the custom policy in your tenant: +> [!TIP] +> Try using the following MSGraph call to automatically create the custom policy in your tenant. ```msgraph-interactive POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} From 0fa2580163f0527cf782c626fa4e10e34a0c0909 Mon Sep 17 00:00:00 2001 From: Shota Kunishige <63525615+ShotaKunishige@users.noreply.github.com> Date: Thu, 17 Nov 2022 17:24:06 +0900 Subject: [PATCH 016/324] Added the new policy, Recently added the new policy, but Recommended section can't be customized any policy, any CSP. --- .../configuration/device-restrictions-windows-10 | 0 .../customize-start-menu-layout-windows-11.md | 11 ++--------- 2 files changed, 2 insertions(+), 9 deletions(-) create mode 100644 mem/intune/configuration/device-restrictions-windows-10 diff --git a/mem/intune/configuration/device-restrictions-windows-10 b/mem/intune/configuration/device-restrictions-windows-10 new file mode 100644 index 0000000000..e69de29bb2 diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md index 7aea595911..2a73e177cc 100644 --- a/windows/configuration/customize-start-menu-layout-windows-11.md +++ b/windows/configuration/customize-start-menu-layout-windows-11.md @@ -62,16 +62,9 @@ Start has the following areas: - `Computer Configuration\Administrative Templates\Start Menu and Taskbar` - `User Configuration\Administrative Templates\Start Menu and Taskbar` -- **Recommended**: Shows recently opened files and recently installed apps. This section can't be customized using the JSON file. +- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows SE using the following policy. - The [Start/HideRecentJumplists CSP](/windows/client-management/mdm/policy-csp-start#start-hiderecentjumplists) exposes settings that prevent files from showing in this section. This CSP also hides recent files that show from the taskbar. - - In **Intune**, you can configure this feature, and more. For more information on the Start menu settings you can configure in an Intune policy, see [Windows 10/11 device settings to allow or restrict features](/mem/intune/configuration/device-restrictions-windows-10#start). - - In **Group Policy**, there are policies that include settings that control the Start menu layout. Some policies may not work as expected. Be sure to test your policies before broadly deploying them across your devices: - - - `Computer Configuration\Administrative Templates\Start Menu and Taskbar` - - `User Configuration\Administrative Templates\Start Menu and Taskbar` +- `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu` ## Create the JSON file From 83b050cf83070055359cdb44bc0e051b5c414b22 Mon Sep 17 00:00:00 2001 From: Shota Kunishige <63525615+ShotaKunishige@users.noreply.github.com> Date: Thu, 17 Nov 2022 17:39:31 +0900 Subject: [PATCH 017/324] Update customize-start-menu-layout-windows-11.md --- windows/configuration/customize-start-menu-layout-windows-11.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md index 2a73e177cc..8b09a7a7de 100644 --- a/windows/configuration/customize-start-menu-layout-windows-11.md +++ b/windows/configuration/customize-start-menu-layout-windows-11.md @@ -64,7 +64,7 @@ Start has the following areas: - **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows SE using the following policy. -- `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu` + - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu` ## Create the JSON file From 36efd58b07a1727f6a607e7c21ef728ef03882c9 Mon Sep 17 00:00:00 2001 From: Shota Kunishige <63525615+ShotaKunishige@users.noreply.github.com> Date: Thu, 17 Nov 2022 17:45:14 +0900 Subject: [PATCH 018/324] Update customize-start-menu-layout-windows-11.md --- windows/configuration/customize-start-menu-layout-windows-11.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md index 8b09a7a7de..00570b40da 100644 --- a/windows/configuration/customize-start-menu-layout-windows-11.md +++ b/windows/configuration/customize-start-menu-layout-windows-11.md @@ -62,7 +62,7 @@ Start has the following areas: - `Computer Configuration\Administrative Templates\Start Menu and Taskbar` - `User Configuration\Administrative Templates\Start Menu and Taskbar` -- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows SE using the following policy. +- **Recommended**: Shows recently opened files and recently installed apps. This section can only be customized in Windows 11 SE using the following policy. - `Computer Configuration\Administrative Templates\Start Menu and Taskbar\Remove Recommended section from Start Menu` From 878812525e2e058920f3e58ecdebb909087e5559 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:50:51 +0530 Subject: [PATCH 019/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-policies.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-policies.md b/windows/security/threat-protection/security-policy-settings/account-policies.md index ba2d477909..8d3cbc340d 100644 --- a/windows/security/threat-protection/security-policy-settings/account-policies.md +++ b/windows/security/threat-protection/security-policy-settings/account-policies.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Account Policies **Applies to** +- Windows 11 - Windows 10 An overview of account policies in Windows and provides links to policy descriptions. From 68b63b26a609464981e75e353da2a47456708375 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:52:08 +0530 Subject: [PATCH 020/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/password-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/password-policy.md b/windows/security/threat-protection/security-policy-settings/password-policy.md index 7ecb04ce32..05a4e8abfe 100644 --- a/windows/security/threat-protection/security-policy-settings/password-policy.md +++ b/windows/security/threat-protection/security-policy-settings/password-policy.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Password Policy **Applies to** +- Windows 11 - Windows 10 An overview of password policies for Windows and links to information for each policy setting. From 022cbeaaea2e150011d5ddfc211525af879af567 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:53:26 +0530 Subject: [PATCH 021/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/enforce-password-history.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md index 4bb6c855cc..ea44c5fc56 100644 --- a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md +++ b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Enforce password history **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting. From 2e2221a9f3871aac65c485f7f749a0a4daabc3ca Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:54:34 +0530 Subject: [PATCH 022/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/maximum-password-age.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index c0b7aae124..db96bc95de 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Maximum password age **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting. From 1504c4c1bc4bd86385245807b3ca0436b85c3ee0 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:55:36 +0530 Subject: [PATCH 023/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/minimum-password-age.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md index f6ce6b41e1..2683c0cbf9 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md @@ -18,6 +18,7 @@ ms.technology: itpro-security # Minimum password age **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting. @@ -89,4 +90,4 @@ If you set a password for a user but want that user to change the password when ## Related topics -- [Password Policy](password-policy.md) \ No newline at end of file +- [Password Policy](password-policy.md) From ec830936ee5cf96c697992fb991864148d092ad0 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:56:50 +0530 Subject: [PATCH 024/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/minimum-password-length.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md index 14a19ec3af..61170f8f54 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Minimum password length **Applies to** +- Windows 11 - Windows 10 This article describes the recommended practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting. From 937597b380c002c6ec521eb0e4b3c480467c4f80 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:57:54 +0530 Subject: [PATCH 025/324] added windows 11 added windows 11 to this article --- .../password-must-meet-complexity-requirements.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index 3781352906..0608e32e81 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -22,6 +22,7 @@ ms.technology: itpro-security # Password must meet complexity requirements **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting. From d45daf6c18761d13f1de5bec8708d1f2d93d035b Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:59:01 +0530 Subject: [PATCH 026/324] added windows 11 added windows 11 to this article --- .../store-passwords-using-reversible-encryption.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md index 7e2d99c5ca..51f69e849e 100644 --- a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md +++ b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Store passwords using reversible encryption **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting. From 905d5f8e0623ad88bf8af12e80d8eee38364349d Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:00:14 +0530 Subject: [PATCH 027/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-lockout-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md index a53b0258c1..bc5e2d96ce 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Account Lockout Policy **Applies to** +- Windows 11 - Windows 10 Describes the Account Lockout Policy settings and links to information about each policy setting. From 8ec70f2cbe745173407dfaa3f2840cedd3a86f11 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:01:07 +0530 Subject: [PATCH 028/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-lockout-duration.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md index 559a82704b..bbbad9fba3 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Account lockout duration **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. From 5ca873262b28bacffc4ef01f2376e8a8594a11ad Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:02:02 +0530 Subject: [PATCH 029/324] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-lockout-threshold.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md index 0b41931636..1032bd39b6 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Account lockout threshold **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Account lockout threshold** security policy setting. From eddee1bfa47e807d8baef5c268c43ef2087a29ca Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:03:05 +0530 Subject: [PATCH 030/324] added windows 11 added windows 11 to this article --- .../reset-account-lockout-counter-after.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md index 900b66a6fe..dc385a80e1 100644 --- a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md +++ b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Reset account lockout counter after **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. @@ -77,4 +78,4 @@ If you don't configure this policy setting or if the value is configured to an i ## Related topics -- [Account Lockout Policy](account-lockout-policy.md) \ No newline at end of file +- [Account Lockout Policy](account-lockout-policy.md) From f0abcd176333926b6b90111c6091b9ffad26bf84 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:16:49 +0530 Subject: [PATCH 031/324] added windows 11 added windows 11 to this article --- .../threat-protection/security-policy-settings/audit-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/audit-policy.md b/windows/security/threat-protection/security-policy-settings/audit-policy.md index 9f1e6cd0c6..0553dc3df2 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-policy.md +++ b/windows/security/threat-protection/security-policy-settings/audit-policy.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Audit Policy **Applies to** +- Windows 11 - Windows 10 Provides information about basic audit policies that are available in Windows and links to information about each setting. From edced08cedeff4208a57df54539fb4fc0d3ed3e7 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:19:54 +0530 Subject: [PATCH 032/324] added windows 11 added windows 11 to this article --- .../secpol-advanced-security-audit-policy-settings.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md index a620908a28..5b2eced41d 100644 --- a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Advanced security audit policy settings for Windows 10 **Applies to** +- Windows 11 - Windows 10 Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. From c1c2b55b9feaadc645470cee43bc775a09d757fb Mon Sep 17 00:00:00 2001 From: rlianmsft <112862018+rlianmsft@users.noreply.github.com> Date: Mon, 21 Nov 2022 16:18:41 +0000 Subject: [PATCH 033/324] Update windows-autopatch-changes-to-tenant.md @hathin - suggest we remove this note now that enterprise app auth is GA and migrations have taken place (or are underway). @tiaraquan FYI --- .../references/windows-autopatch-changes-to-tenant.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md index b2ac14cb00..f14ae95741 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-changes-to-tenant.md @@ -29,9 +29,6 @@ Windows Autopatch creates an enterprise application in your tenant. This enterpr | ----- | ------ | ----- | | Modern Workplace Management | This enterprise application is a limited first party enterprise application with elevated privileges. This application is used to manage the service, publish baseline configuration updates, and maintain overall service health. |
  • DeviceManagementApps.ReadWrite.All
  • DeviceManagementConfiguration.ReadWrite.All
  • DeviceManagementManagedDevices.PriviligedOperation.All
  • DeviceManagementManagedDevices.ReadWrite.All
  • DeviceManagementRBAC.ReadWrite.All
  • DeviceManagementServiceConfig.ReadWrite.All
  • Directory.Read.All
  • Group.Create
  • Policy.Read.All
  • WindowsUpdates.Read.Write.All
| -> [!NOTE] -> Enterprise application authentication is only available on tenants enrolled after July 9th, 2022. For tenants enrolled before this date, Enterprise Application authentication will be made available for enrollment soon. - ### Service principal Windows Autopatch will create a service principal in your tenant allowing the service to establish an identity and restrict access to what resources the service has access to within the tenant. For more information, see [Application and service principal objects in Azure Active Directory](/azure/active-directory/develop/app-objects-and-service-principals#service-principal-object). The service principal created by Windows Autopatch is: From e0e0894b46b3402266e7e9733830434e19c3bfdb Mon Sep 17 00:00:00 2001 From: andrewgiese <47120943+andrewgiese@users.noreply.github.com> Date: Mon, 21 Nov 2022 17:25:04 -0800 Subject: [PATCH 034/324] Updating all ScheduledInstall* policies to be more explicit There has been some confusion in the past around why the following policies were not being honored on a device. This update explicitly adds a note to each policy that the AllowAutoUpdate policy must first be configured for scheduled installation before they have any effect. * ScheduledInstallDay * ScheduledInstallEveryWeek * ScheduledInstallFirstWeek * ScheduledInstallFourthWeek * ScheduledInstallSecondWeek * ScheduledInstallThirdWeek * ScheduledInstallTime --- .../mdm/policy-csp-update.md | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 91113eec51..7c1858edb3 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -2988,6 +2988,9 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the day of the update installation. Supported data type is an integer. @@ -3049,6 +3052,9 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the update installation on every week. Supported Value type is integer. @@ -3100,6 +3106,9 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the update installation on the first week of the month. Supported value type is integer. @@ -3151,6 +3160,9 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the update installation on the fourth week of the month. Supported value type is integer. @@ -3202,9 +3214,12 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the update installation on the second week of the month. -Supported vlue type is integer. +Supported value type is integer. Supported values: @@ -3254,6 +3269,9 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the update installation on the third week of the month. Supported value type is integer. @@ -3305,6 +3323,9 @@ The table below shows the applicability of Windows: +> [!NOTE] +> This policy will only take effect if Update/AllowAutoUpdate has been configured to option 3 or 4 for scheduled installation. + Enables the IT admin to schedule the time of the update installation. Note that there is a window of approximately 30 minutes to allow for higher success rates of installation. The supported data type is an integer. From 2b46bfd25189e965fc5e4019b8232acc107ba85a Mon Sep 17 00:00:00 2001 From: Bas de Koning Date: Tue, 22 Nov 2022 08:12:05 +0100 Subject: [PATCH 035/324] Clarification changing .cip to .bin Just a little clarification what to do with the .cip file. You first need to change it to .bin. This is not stated on the page. --- ...indows-defender-application-control-policies-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md index 6f8d77a67f..8592cad258 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md @@ -61,7 +61,7 @@ The steps to use Intune's custom OMA-URI functionality are: 2. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings: - **OMA-URI**: `./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy` - **Data type**: Base64 (file) - - **Certificate file**: upload your binary format policy file. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. + - **Certificate file**: upload your binary format policy file. Todo this change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. > [!div class="mx-imgBorder"] > ![Configure custom WDAC.](../images/wdac-intune-custom-oma-uri.png) From 17f39f2893ac62235e02e82d52c7eccfde0eb324 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 22 Nov 2022 12:49:14 -0500 Subject: [PATCH 036/324] Add 2 CSPs --- .../mdm/policies-in-policy-csp-admx-backed.md | 2 +- ...in-policy-csp-supported-by-group-policy.md | 2 +- .../policy-configuration-service-provider.md | 3 +- .../mdm/policy-csp-clouddesktop.md | 79 ++ .../mdm/policy-csp-windowslogon.md | 841 +++++++++--------- windows/client-management/mdm/toc.yml | 2 + 6 files changed, 530 insertions(+), 399 deletions(-) create mode 100644 windows/client-management/mdm/policy-csp-clouddesktop.md diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 3b3a19e7b1..5270d3eb1d 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/22/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index 0b6dede6bb..f1cfc9181d 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/22/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index fa72136ceb..283417da87 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4,7 +4,7 @@ description: Learn more about the Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/22/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -1073,6 +1073,7 @@ Specifies the name/value pair used in the policy. See the individual Area DDFs f - [Browser](policy-csp-browser.md) - [Camera](policy-csp-camera.md) - [Cellular](policy-csp-cellular.md) +- [CloudDesktop](policy-csp-clouddesktop.md) - [CloudPC](policy-csp-cloudpc.md) - [Connectivity](policy-csp-connectivity.md) - [ControlPolicyConflict](policy-csp-controlpolicyconflict.md) diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md new file mode 100644 index 0000000000..c31ce3ba2a --- /dev/null +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -0,0 +1,79 @@ +--- +title: CloudDesktop Policy CSP +description: Learn more about the CloudDesktop Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz +ms.author: vinpa +ms.date: 11/22/2022 +ms.localizationpriority: medium +ms.prod: windows-client +ms.technology: itpro-manage +ms.topic: reference +--- + + + + +# Policy CSP - CloudDesktop + + + + + + +## BootToCloudMode + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:x: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/CloudDesktop/BootToCloudMode +``` + + + +This policy is used by IT admin to set the configuration mode of cloud PC. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not Configured | +| 1 | Enable Boot to Cloud Desktop | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 7af2d1affc..95902680cc 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,522 +1,571 @@ --- -title: Policy CSP - WindowsLogon -description: Use the Policy CSP - WindowsLogon setting to control whether a device automatically signs in and locks the last interactive user after the system restarts. +title: WindowsLogon Policy CSP +description: Learn more about the WindowsLogon Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa -ms.topic: article +ms.date: 11/22/2022 +ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.localizationpriority: medium -ms.date: 09/27/2019 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - WindowsLogon -
- - -## WindowsLogon policies - -
-
- WindowsLogon/AllowAutomaticRestartSignOn -
-
- WindowsLogon/ConfigAutomaticRestartSignOn -
-
- WindowsLogon/DisableLockScreenAppNotifications -
-
- WindowsLogon/DontDisplayNetworkSelectionUI -
-
- WindowsLogon/EnableFirstLogonAnimation -
-
- WindowsLogon/EnableMPRNotifications -
-
- WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers -
-
- WindowsLogon/HideFastUserSwitching -
-
- > [!TIP] -> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
+ + + - -**WindowsLogon/AllowAutomaticRestartSignOn** + +## AllowAutomaticRestartSignOn - -The table below shows the applicability of Windows: + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/AllowAutomaticRestartSignOn +``` + - -
+ +This policy setting controls whether a device will automatically sign in and lock the last interactive user after the system restarts or after a shutdown and cold boot. - -[Scope](./policy-configuration-service-provider.md#policy-scope): +This only occurs if the last interactive user didn’t sign out before the restart or shutdown.​ -> [!div class = "checklist"] -> * Device +If the device is joined to Active Directory or Azure Active Directory, this policy only applies to Windows Update restarts. Otherwise, this will apply to both Windows Update restarts and user-initiated restarts and shutdowns.​ -
+If you don’t configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​ - - -This policy setting controls whether a device automatically signs in and locks the last interactive user after the system restarts or after a shutdown and cold boot. +After enabling this policy, you can configure its settings through the ConfigAutomaticRestartSignOn policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​. -This scenario occurs only if the last interactive user didn't sign out before the restart or shutdown.​ +If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts. + -If the device is joined to Active Directory or Azure Active Directory, this policy applies only to Windows Update restarts. Otherwise, this policy applies to both Windows Update restarts and user-initiated restarts and shutdowns.​ + + + -If you don't configure this policy setting, it's enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​ + +**Description framework properties**: -After enabling this policy, you can configure its settings through the [ConfigAutomaticRestartSignOn](#windowslogon-configautomaticrestartsignon) policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​. +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -If you disable this policy setting, the device doesn't configure automatic sign in. The user’s lock screen apps aren't restarted after the system restarts. + +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | AutomaticRestartSignOnDescription | +| Friendly Name | Sign-in and lock last interactive user automatically after a restart | +| Location | Computer Configuration | +| Path | Windows Components > Windows Logon Options | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| Registry Value Name | DisableAutomaticRestartSignOn | +| ADMX File Name | WinLogon.admx | + - -ADMX Info: -- GP Friendly name: *Sign-in and lock last interactive user automatically after a restart* -- GP name: *AutomaticRestartSignOn* -- GP path: *Windows Components/Windows Logon Options* -- GP ADMX file name: *WinLogon.admx* + + + - - + - - + +## ConfigAutomaticRestartSignOn - - + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + - - + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/ConfigAutomaticRestartSignOn +``` + -
- - -**WindowsLogon/ConfigAutomaticRestartSignOn** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -This policy setting controls the configuration under which an automatic restart, sign in, and lock occurs after a restart or cold boot. If you chose “Disabled” in the [AllowAutomaticRestartSignOn](#windowslogon-allowautomaticrestartsignon) policy, then automatic sign in doesn't occur and this policy need not be configured. + +This policy setting controls the configuration under which an automatic restart and sign on and lock occurs after a restart or cold boot. If you chose “Disabled” in the “Sign-in and lock last interactive user automatically after a restart” policy, then automatic sign on will not occur and this policy does not need to be configured. If you enable this policy setting, you can choose one of the following two options: -- Enabled if BitLocker is on and not suspended: Specifies that automatic sign in and lock occurs only if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker isn't on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. +1. “Enabled if BitLocker is on and not suspended” specifies that automatic sign on and lock will only occur if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. BitLocker is suspended during updates if: - - The device doesn't have TPM 2.0 and PCR7 - - The device doesn't use a TPM-only protector -- Always Enabled: Specifies that automatic sign in happens even if BitLocker is off or suspended during reboot or shutdown. When BitLocker isn't enabled, personal data is accessible on the hard drive. Automatic restart and sign in should only be run under this condition if you're confident that the configured device is in a secure physical location. +- The device doesn’t have TPM 2.0 and PCR7, or +- The device doesn’t use a TPM-only protector +2. “Always Enabled” specifies that automatic sign on will happen even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location. -If you disable or don't configure this setting, automatic sign in defaults to the “Enabled if BitLocker is on and not suspended” behavior. +If you disable or don’t configure this setting, automatic sign on will default to the “Enabled if BitLocker is on and not suspended” behavior. + - + + + - -ADMX Info: -- GP Friendly name: *Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot* -- GP name: *ConfigAutomaticRestartSignOn* -- GP path: *Windows Components/Windows Logon Options* -- GP ADMX file name: *WinLogon.admx* + +**Description framework properties**: - - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - + +**ADMX mapping**: - - +| Name | Value | +|:--|:--| +| Name | ConfigAutomaticRestartSignOnDescription | +| Friendly Name | Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot | +| Location | Computer Configuration | +| Path | Windows Components > Windows Logon Options | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| ADMX File Name | WinLogon.admx | + - - + + + -
+ - -**WindowsLogon/DisableLockScreenAppNotifications** + +## DisableLockScreenAppNotifications - -The table below shows the applicability of Windows: + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DisableLockScreenAppNotifications +``` + - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + This policy setting allows you to prevent app notifications from appearing on the lock screen. If you enable this policy setting, no app notifications are displayed on the lock screen. -If you disable or don't configure this policy setting, users can choose which apps display notifications on the lock screen. +If you disable or do not configure this policy setting, users can choose which apps display notifications on the lock screen. + - + + + - -ADMX Info: -- GP Friendly name: *Turn off app notifications on the lock screen* -- GP name: *DisableLockScreenAppNotifications* -- GP path: *System/Logon* -- GP ADMX file name: *logon.admx* + +**Description framework properties**: - - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -
+ +**ADMX mapping**: - -**WindowsLogon/DontDisplayNetworkSelectionUI** +| Name | Value | +|:--|:--| +| Name | DisableLockScreenAppNotifications | +| Friendly Name | Turn off app notifications on the lock screen | +| Location | Computer Configuration | +| Path | System > Logon | +| Registry Key Name | Software\Policies\Microsoft\Windows\System | +| Registry Value Name | DisableLockScreenAppNotifications | +| ADMX File Name | Logon.admx | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## DontDisplayNetworkSelectionUI - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI +``` + -
+ +This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen. - - -This policy setting allows you to control whether anyone can interact with available networks UI on the sign-in screen. - -If you enable this policy setting, the PC's network connectivity state can't be changed without signing into Windows. +If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows. If you disable or don't configure this policy setting, any user can disconnect the PC from the network or can connect the PC to other available networks without signing into Windows. + -Here's an example to enable this policy: + + + -```xml - - - - 300 - - 301 - - - ./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI - - - chr - - ]]> - - - - - - + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | DontDisplayNetworkSelectionUI | +| Friendly Name | Do not display network selection UI | +| Location | Computer Configuration | +| Path | System > Logon | +| Registry Key Name | Software\Policies\Microsoft\Windows\System | +| Registry Value Name | DontDisplayNetworkSelectionUI | +| ADMX File Name | Logon.admx | + + + + + + + + + +## EnableFirstLogonAnimation + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1903 [10.0.18362] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/EnableFirstLogonAnimation ``` + - + +This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. - -ADMX Info: -- GP Friendly name: *Do not display network selection UI* -- GP name: *DontDisplayNetworkSelectionUI* -- GP path: *System/Logon* -- GP ADMX file name: *logon.admx* +If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. - - +If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. -
+If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. - -**WindowsLogon/EnableFirstLogonAnimation** +Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|Yes|Yes| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**Description framework properties**: - -
+| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 1 | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +**Allowed values**: -> [!div class = "checklist"] -> * Device +| Value | Description | +|:--|:--| +| 0 | Disabled. | +| 1 (Default) | Enabled. | + -
+ +**Group policy mapping**: - - -This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This view applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users are offered the opt-in prompt for services during their first sign-in. +| Name | Value | +|:--|:--| +| Name | EnableFirstLogonAnimation | +| Friendly Name | Show first sign-in animation | +| Location | Computer Configuration | +| Path | System > Logon | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| Registry Value Name | EnableFirstLogonAnimation | +| ADMX File Name | Logon.admx | + -If you enable this policy setting, Microsoft account users see the opt-in prompt for services, and users with other accounts see the sign-in animation. + + + -If you disable this policy setting, users don't see the animation and Microsoft account users don't see the opt-in prompt for services. + -If you don't configure this policy setting, the user who completes the initial Windows setup see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting isn't configured, users new to this computer don't see the animation. + +## EnableMPRNotifications -> [!NOTE] -> The first sign-in animation isn't displayed on Server, so this policy has no effect. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 11, version 22H2 [10.0.22621] and later | + - - -ADMX Info: -- GP Friendly name: *Show first sign-in animation* -- GP name: *EnableFirstLogonAnimation* -- GP path: *System/Logon* -- GP ADMX file name: *Logon.admx* + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/EnableMPRNotifications +``` + - - -Supported values: -- 0 - disabled -- 1 - enabled - - + +This policy controls the configuration under which winlogon sends MPR notifications in the system. - - +If you enable this setting or do not configure it, winlogon sends MPR notifications if a credential manager is configured. - - +If you disable this setting, winlogon does not send MPR notifications. + -
+ + + - -**WindowsLogon/EnableMPRNotifications** + +**Description framework properties**: - -The table below shows the applicability of Windows: +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +**ADMX mapping**: - -
+| Name | Value | +|:--|:--| +| Name | EnableMPRNotifications | +| Friendly Name | Enable MPR notifications for the system | +| Location | Computer Configuration | +| Path | Windows Components > Windows Logon Options | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| Registry Value Name | EnableMPR | +| ADMX File Name | WinLogon.admx | + - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+ +## EnumerateLocalUsersOnDomainJoinedComputers - - -This policy allows winlogon to send MPR notifications in the system if a credential manager is configured. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1803 [10.0.17134] and later | + -If you disable (0), MPR notifications will not be sent by winlogon. + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers +``` + -If you enable (1) or do not configure this policy setting this policy, MPR notifications will be sent by winlogon. - - - -Supported values: - -- 0 - disabled -- 1 (default)- enabled - - - - -
- - -**WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers** - - -The table below shows the applicability of Windows: - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + This policy setting allows local users to be enumerated on domain-joined computers. If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers. -If you disable or don't configure this policy setting, the Logon UI won't enumerate local users on domain-joined computers. +If you disable or do not configure this policy setting, the Logon UI will not enumerate local users on domain-joined computers. + - + + + - -ADMX Info: -- GP Friendly name: *Enumerate local users on domain-joined computers* -- GP name: *EnumerateLocalUsers* -- GP path: *System/Logon* -- GP ADMX file name: *logon.admx* + +**Description framework properties**: - - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -
+ +**ADMX mapping**: - -**WindowsLogon/HideFastUserSwitching** +| Name | Value | +|:--|:--| +| Name | EnumerateLocalUsers | +| Friendly Name | Enumerate local users on domain-joined computers | +| Location | Computer Configuration | +| Path | System > Logon | +| Registry Key Name | Software\Policies\Microsoft\Windows\System | +| Registry Value Name | EnumerateLocalUsers | +| ADMX File Name | Logon.admx | + - -The table below shows the applicability of Windows: + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## HideFastUserSwitching - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 1703 [10.0.15063] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/HideFastUserSwitching +``` + -
+ +This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager. - - -This policy setting allows you to hide the Switch account button on the sign-in screen, Start, and the Task Manager. If you enable this policy setting, the Switch account button is hidden from the user who is attempting to sign-in or is signed in to the computer that has this policy applied. If you disable or don't configure this policy setting, the Switch account button is accessible to the user in the three locations. +If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied. - - -ADMX Info: -- GP Friendly name: *Hide entry points for Fast User Switching* -- GP name: *HideFastUserSwitching* -- GP path: *System/Logon* -- GP ADMX file name: *Logon.admx* +The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager. - - -The following list shows the supported values: +If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations. + -- 0 (default) - Disabled (visible). -- 1 - Enabled (hidden). + + + - - -To validate on Desktop, do the following steps: + +**Description framework properties**: -1. Enable policy. -2. Verify that the Switch account button in Start is hidden. +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + - - -
+ +**Allowed values**: - +| Value | Description | +|:--|:--| +| 0 (Default) | Disabled (visible). | +| 1 | Enabled (hidden). | + -## Related topics + +**Group policy mapping**: -[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file +| Name | Value | +|:--|:--| +| Name | HideFastUserSwitching | +| Friendly Name | Hide entry points for Fast User Switching | +| Location | Computer Configuration | +| Path | System > Logon | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System | +| Registry Value Name | HideFastUserSwitching | +| ADMX File Name | Logon.admx | + + + + + + + + + +## OverrideShellProgram + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows Insider Preview | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/WindowsLogon/OverrideShellProgram +``` + + + +This policy is used by IT admin to override the registry based shell program. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | int | +| Access Type | Add, Delete, Get, Replace | +| Default Value | 0 | + + + +**Allowed values**: + +| Value | Description | +|:--|:--| +| 0 (Default) | Not Configured | +| 1 | Apply Lightweight shell | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/toc.yml b/windows/client-management/mdm/toc.yml index 9ff945c474..d1d4e1f569 100644 --- a/windows/client-management/mdm/toc.yml +++ b/windows/client-management/mdm/toc.yml @@ -366,6 +366,8 @@ items: href: policy-csp-camera.md - name: Cellular href: policy-csp-cellular.md + - name: CloudDesktop + href: policy-csp-clouddesktop.md - name: CloudPC href: policy-csp-cloudpc.md - name: Connectivity From 6a3a65072f93f4f0ac295dc6195244255b4e9eb9 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 22 Nov 2022 13:31:42 -0500 Subject: [PATCH 037/324] Add DependencyGroup --- windows/client-management/mdm/policy-csp-clouddesktop.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index c31ce3ba2a..c0907eacb8 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -51,6 +51,7 @@ This policy is used by IT admin to set the configuration mode of cloud PC. | Format | int | | Access Type | Add, Delete, Get, Replace | | Default Value | 0 | +| Dependency [OverrideShellProgramDependencyGroup] | Dependency Type: `DependsOn`
Dependency URI: `Device/Vendor/MSFT/Policy/Config/WindowsLogon/OverrideShellProgram`
Dependency Allowed Value: `[1]`
Dependency Allowed Value Type: `Range`
| From 3032b04c2567878417e4890ae7260557a0a4d1a5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 22 Nov 2022 14:28:02 -0500 Subject: [PATCH 038/324] updates --- windows/security/docfx.json | 8 +- .../access-control/access-control.md | 104 +++---- .../access-control/local-accounts.md | 253 +++++++----------- .../additional-mitigations.md | 13 +- .../credential-guard-considerations.md | 16 +- .../credential-guard-how-it-works.md | 16 +- .../credential-guard-known-issues.md | 16 +- .../credential-guard-manage.md | 19 +- ...redential-guard-not-protected-scenarios.md | 17 +- .../credential-guard-protection-limits.md | 45 ++-- .../credential-guard-requirements.md | 22 +- .../credential-guard-scripts.md | 33 +-- .../credential-guard/credential-guard.md | 21 +- .../credential-guard/dg-readiness-tool.md | 20 +- 14 files changed, 210 insertions(+), 393 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index b923e0d70f..bb2804df03 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -65,13 +65,15 @@ }, "fileMetadata": { "author":{ - "/identity-protection/hello-for-business/*.md": "paolomatarazzo" + "identity-protection/**/*.md": "paolomatarazzo" }, "ms.author":{ - "/identity-protection/hello-for-business/*.md": "paoloma" + "identity-protection/**/*.md": "paoloma" }, "ms.reviewer":{ - "/identity-protection/hello-for-business/*.md": "erikdau" + "identity-protection/hello-for-business/*.md": "erikdau", + "identity-protection/credential-guard/*.md": "zwhittington", + "identity-protection/access-control/*.md": "sulahiri" } }, "template": [], diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index f900a31aa3..deea4c3766 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -1,19 +1,12 @@ --- -title: Access Control Overview (Windows 10) -description: Access Control Overview +title: Access Control Overview +description: Description of the access controls in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: sulahiri -manager: aaroncz -ms.collection: - - M365-identity-device-management ms.topic: article -ms.localizationpriority: medium -ms.date: 07/18/2017 +ms.date: 11/22/2022 appliesto: - - ✅ Windows 10 - - ✅ Windows Server 2016 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- @@ -21,89 +14,66 @@ ms.technology: itpro-security This topic for the IT professional describes access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. Key concepts that make up access control are permissions, ownership of objects, inheritance of permissions, user rights, and object auditing. -## Feature description - +## Feature description Computers that are running a supported version of Windows can control the use of system and network resources through the interrelated mechanisms of authentication and authorization. After a user is authenticated, the Windows operating system uses built-in authorization and access control technologies to implement the second phase of protecting resources: determining if an authenticated user has the correct permissions to access a resource. -Shared resources are available to users and groups other than the resource’s owner, and they need to be protected from unauthorized use. In the access control model, users and groups (also referred to as security principals) are represented by unique security identifiers (SIDs). They are assigned rights and permissions that inform the operating system what each user and group can do. Each resource has an owner who grants permissions to security principals. During the access control check, these permissions are examined to determine which security principals can access the resource and how they can access it. +Shared resources are available to users and groups other than the resource's owner, and they need to be protected from unauthorized use. In the access control model, users and groups (also referred to as security principals) are represented by unique security identifiers (SIDs). They are assigned rights and permissions that inform the operating system what each user and group can do. Each resource has an owner who grants permissions to security principals. During the access control check, these permissions are examined to determine which security principals can access the resource and how they can access it. Security principals perform actions (which include Read, Write, Modify, or Full control) on objects. Objects include files, folders, printers, registry keys, and Active Directory Domain Services (AD DS) objects. Shared resources use access control lists (ACLs) to assign permissions. This enables resource managers to enforce access control in the following ways: -- Deny access to unauthorized users and groups - -- Set well-defined limits on the access that is provided to authorized users and groups +- Deny access to unauthorized users and groups +- Set well-defined limits on the access that is provided to authorized users and groups Object owners generally grant permissions to security groups rather than to individual users. Users and computers that are added to existing groups assume the permissions of that group. If an object (such as a folder) can hold other objects (such as subfolders and files), it is called a container. In a hierarchy of objects, the relationship between a container and its content is expressed by referring to the container as the parent. An object in the container is referred to as the child, and the child inherits the access control settings of the parent. Object owners often define permissions for container objects, rather than individual child objects, to ease access control management. This content set contains: -- [Dynamic Access Control Overview](dynamic-access-control.md) - -- [Security identifiers](security-identifiers.md) - -- [Security Principals](security-principals.md) - - - [Local Accounts](local-accounts.md) - - - [Active Directory Accounts](active-directory-accounts.md) - - - [Microsoft Accounts](microsoft-accounts.md) - - - [Service Accounts](service-accounts.md) - - - [Active Directory Security Groups](active-directory-security-groups.md) - -## Practical applications +- [Dynamic Access Control Overview](dynamic-access-control.md) +- [Security identifiers](security-identifiers.md) +- [Security Principals](security-principals.md) + - [Local Accounts](local-accounts.md) + - [Active Directory Accounts](active-directory-accounts.md) + - [Microsoft Accounts](microsoft-accounts.md) + - [Service Accounts](service-accounts.md) + - [Active Directory Security Groups](active-directory-security-groups.md) +## Practical applications Administrators who use the supported version of Windows can refine the application and management of access control to objects and subjects to provide the following security: -- Protect a greater number and variety of network resources from misuse. - -- Provision users to access resources in a manner that is consistent with organizational policies and the requirements of their jobs. - -- Enable users to access resources from a variety of devices in numerous locations. - -- Update users’ ability to access resources on a regular basis as an organization’s policies change or as users’ jobs change. - -- Account for a growing number of use scenarios (such as access from remote locations or from a rapidly expanding variety of devices, such as tablet computers and mobile phones). - -- Identify and resolve access issues when legitimate users are unable to access resources that they need to perform their jobs. +- Protect a greater number and variety of network resources from misuse. +- Provision users to access resources in a manner that is consistent with organizational policies and the requirements of their jobs. +- Enable users to access resources from a variety of devices in numerous locations. +- Update users' ability to access resources on a regular basis as an organization's policies change or as users' jobs change. +- Account for a growing number of use scenarios (such as access from remote locations or from a rapidly expanding variety of devices, such as tablet computers and mobile phones). +- Identify and resolve access issues when legitimate users are unable to access resources that they need to perform their jobs. ## Permissions - Permissions define the type of access that is granted to a user or group for an object or object property. For example, the Finance group can be granted Read and Write permissions for a file named Payroll.dat. By using the access control user interface, you can set NTFS permissions for objects such as files, Active Directory objects, registry objects, or system objects such as processes. Permissions can be granted to any user, group, or computer. It is a good practice to assign permissions to groups because it improves system performance when verifying access to an object. For any object, you can grant permissions to: -- Groups, users, and other objects with security identifiers in the domain. - -- Groups and users in that domain and any trusted domains. - -- Local groups and users on the computer where the object resides. +- Groups, users, and other objects with security identifiers in the domain. +- Groups and users in that domain and any trusted domains. +- Local groups and users on the computer where the object resides. The permissions attached to an object depend on the type of object. For example, the permissions that can be attached to a file are different from those that can be attached to a registry key. Some permissions, however, are common to most types of objects. These common permissions are: -- Read - -- Modify - -- Change owner - -- Delete +- Read +- Modify +- Change owner +- Delete When you set permissions, you specify the level of access for groups and users. For example, you can let one user read the contents of a file, let another user make changes to the file, and prevent all other users from accessing the file. You can set similar permissions on printers so that certain users can configure the printer and other users can only print. When you need to change the permissions on a file, you can run Windows Explorer, right-click the file name, and click **Properties**. On the **Security** tab, you can change permissions on the file. For more information, see [Managing Permissions](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770962(v=ws.11)). -**Note**   -Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754178(v=ws.11)). - - +> [!NOTE] +> Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754178(v=ws.11)). ### Ownership of objects @@ -115,7 +85,6 @@ Inheritance allows administrators to easily assign and manage permissions. This ## User rights - User rights grant specific privileges and sign-in rights to users and groups in your computing environment. Administrators can assign specific rights to group accounts or to individual user accounts. These rights authorize users to perform specific actions, such as signing in to a system interactively or backing up files and directories. User rights are different from permissions because user rights apply to user accounts, and permissions are associated with objects. Although user rights can apply to individual user accounts, user rights are best administered on a group account basis. There is no support in the access control user interface to grant user rights. However, user rights assignment can be administered through **Local Security Settings**. @@ -124,15 +93,10 @@ For more information about user rights, see [User Rights Assignment](/windows/de ## Object auditing - With administrator's rights, you can audit users' successful or failed access to objects. You can select which object access to audit by using the access control user interface, but first you must enable the audit policy by selecting **Audit object access** under **Local Policies** in **Local Security Settings**. You can then view these security-related events in the Security log in Event Viewer. For more information about auditing, see [Security Auditing Overview](../../threat-protection/auditing/security-auditing-overview.md). ## See also -- For more information about access control and authorization, see [Access Control and Authorization Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/jj134043(v=ws.11)). - - - - +- For more information about access control and authorization, see [Access Control and Authorization Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/jj134043(v=ws.11)). diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 6d48d39a9a..7fa46f2d3f 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,71 +1,35 @@ --- -title: Local Accounts (Windows 10) +title: Local Accounts description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: sulahiri -manager: aaroncz +ms.date: 22/11/2022 ms.collection: - - M365-identity-device-management - highpri ms.topic: article -ms.localizationpriority: medium -ms.date: 06/17/2022 appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- # Local Accounts -This reference article for IT professionals describes the default local user accounts for servers, including how to manage these built-in accounts on a member or standalone server. +This article describes the default local user accounts for Windows operating systems, and how to manage the built-in accounts on a member or standalone workstation/server. -## About local user accounts +## About local user accounts -Local user accounts are stored locally on the server. These accounts can be assigned rights and permissions on a particular server, but on that server only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users. +Local user accounts are stored locally on the device. These accounts can be assigned rights and permissions on a particular device, but on that device only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users. -This article describes the following: +## Default local user accounts -- [Default local user accounts](#sec-default-accounts) +The *default local user accounts* are built-in accounts that are created automatically when the operating system is installed. The default local user accounts can't be removed or deleted and don't provide access to network resources. - - [Administrator account](#sec-administrator) +Default local user accounts are used to manage access to the local device's resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the *Users* folder. The Users folder is located in the Local Users and Groups folder in the local *Computer Management* Microsoft Management Console (MMC). *Computer Management* is a collection of administrative tools that you can use to manage a single local or remote device. - - [Guest Account](#sec-guest) +Default local user accounts are described in the following sections. Expand each section for more information. - - [HelpAssistant account (installed by using a Remote Assistance session)](#sec-helpassistant) - - - [DefaultAccount](#defaultaccount) - -- [Default local system accounts](#sec-localsystem) - -- [How to manage local accounts](#sec-manage-accounts) - - - [Restrict and protect local accounts with administrative rights](#sec-restrict-protect-accounts) - - - [Enforce local account restrictions for remote access](#sec-enforce-account-restrictions) - - - [Deny network logon to all local Administrator accounts](#sec-deny-network-logon) - - - [Create unique passwords for local accounts with administrative rights](#sec-create-unique-passwords) - -For information about security principals, see [Security Principals](security-principals.md). - -## Default local user accounts - -The default local user accounts are built-in accounts that are created automatically when you install Windows. - -After Windows is installed, the default local user accounts can't be removed or deleted. In addition, default local user accounts don't provide access to network resources. - -Default local user accounts are used to manage access to the local server’s resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC). Computer Management is a collection of administrative tools that you can use to manage a single local or remote computer. For more information, see [How to manage local accounts](#sec-manage-accounts) later in this article. - -Default local user accounts are described in the following sections. - -### Administrator account +
+
+Administrator The default local Administrator account is a user account for the system administrator. Every computer has an Administrator account (SID S-1-5-*domain*-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation. @@ -99,7 +63,10 @@ In this case, Group Policy can be used to enable secure settings that can contro > > - Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. -### Guest account +
+
+
+Guest The Guest account is disabled by default on installation. The Guest account lets occasional or one-time users, who don't have an account on the computer, temporarily sign in to the local server or client computer with limited user rights. By default, the Guest account has a blank password. Because the Guest account can provide anonymous access, it's a security risk. For this reason, it's a best practice to leave the Guest account disabled, unless its use is entirely necessary. @@ -113,8 +80,11 @@ When enabling the Guest account, only grant limited rights and permissions. For In addition, the guest user in the Guest account shouldn't be able to view the event logs. After the Guest account is enabled, it's a best practice to monitor the Guest account frequently to ensure that other users can't use services and other resources. This includes resources that were unintentionally left available by a previous user. -## HelpAssistant account (installed with a Remote Assistance session) +
+
+
+HelpAssistant The HelpAssistant account is a default local account that is enabled when a Remote Assistance session is run. This account is automatically disabled when no Remote Assistance requests are pending. @@ -124,9 +94,9 @@ HelpAssistant is the primary account that is used to establish a Remote Assistan The SIDs that pertain to the default HelpAssistant account include: -- SID: S-1-5-<domain>-13, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note: In Windows Server 2008, Remote Desktop Services is called Terminal Services. +- SID: `S-1-5--13`, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note: In Windows Server 2008, Remote Desktop Services is called Terminal Services. -- SID: S-1-5-<domain>-14, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. +- SID: `S-1-5--14`, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. For the Windows Server operating system, Remote Assistance is an optional component that isn't installed by default. You must install Remote Assistance before it can be used. @@ -145,7 +115,11 @@ For details about the HelpAssistant account attributes, see the following table. |Safe to move out of default container?|Can be moved out, but we don't recommend it.| |Safe to delegate management of this group to non-Service admins?|No| -### DefaultAccount +
+ +
+
+DefaultAccount The DefaultAccount, also known as the Default System Managed Account (DSMA), is a built-in account introduced in Windows 10 version 1607 and Windows Server 2016. The DSMA is a well-known user account type. @@ -169,10 +143,10 @@ Today, Xbox automatically signs in as Guest account and all apps run in this con All the apps are multi-user-aware and respond to events fired by user manager. The apps run as the Guest account. -Similarly, Phone auto logs in as a “DefApps” account, which is akin to the standard user account in Windows but with a few extra privileges. Brokers, some services and apps run as this account. +Similarly, Phone auto logs in as a *DefApps* account, which is akin to the standard user account in Windows but with a few extra privileges. Brokers, some services and apps run as this account. In the converged user model, the multi-user-aware apps and multi-user-aware brokers will need to run in a context different from that of the users. -For this purpose, the system creates DSMA. +For this purpose, the system creates DSMA. #### How the DefaultAccount gets created on domain controllers @@ -182,25 +156,37 @@ If the domain was created with domain controllers running an earlier version of #### Recommendations for managing the Default Account (DSMA) Microsoft doesn't recommend changing the default configuration, where the account is disabled. There's no security risk with having the account in the disabled state. Changing the default configuration could hinder future scenarios that rely on this account. +
-## Default local system accounts +## Default local system accounts -### SYSTEM -The SYSTEM account is used by the operating system and by services running under Windows. There are many services and processes in the Windows operating system that need the capability to sign in internally, such as during a Windows installation. The SYSTEM account was designed for that purpose, and Windows manages the SYSTEM account’s user rights. It's an internal account that doesn't show up in User Manager, and it can't be added to any groups. +
+
+SYSTEM + + +The *SYSTEM* account is used by the operating system and by services running under Windows. There are many services and processes in the Windows operating system that need the capability to sign in internally, such as during a Windows installation. The SYSTEM account was designed for that purpose, and Windows manages the SYSTEM account's user rights. It's an internal account that doesn't show up in User Manager, and it can't be added to any groups. On the other hand, the SYSTEM account does appear on an NTFS file system volume in File Manager in the **Permissions** portion of the **Security** menu. By default, the SYSTEM account is granted Full Control permissions to all files on an NTFS volume. Here the SYSTEM account has the same functional rights and permissions as the Administrator account. > [!NOTE] > To grant the account Administrators group file permissions does not implicitly give permission to the SYSTEM account. The SYSTEM account's permissions can be removed from a file, but we do not recommend removing them. -### NETWORK SERVICE +
+
+
+NETWORK SERVICE + The NETWORK SERVICE account is a predefined local account used by the service control manager (SCM). A service that runs in the context of the NETWORK SERVICE account presents the computer's credentials to remote servers. For more information, see [NetworkService Account](/windows/desktop/services/networkservice-account). +
+
+
+LOCAL SERVICE -### LOCAL SERVICE The LOCAL SERVICE account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and presents anonymous credentials on the network. For more information, see [LocalService Account](/windows/desktop/services/localservice-account). +
-## How to manage local user accounts - +## How to manage local user accounts The default local user accounts, and the local user accounts you create, are located in the Users folder. The Users folder is located in Local Users and Groups. For more information about creating and managing local user accounts, see [Manage Local Users](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731899(v=ws.11)). @@ -221,11 +207,11 @@ The simplest approach is to sign in to your computer with a standard user accoun The other approaches that can be used to restrict and protect user accounts with administrative rights include: -- Enforce local account restrictions for remote access. +- Enforce local account restrictions for remote access. -- Deny network logon to all local Administrator accounts. +- Deny network logon to all local Administrator accounts. -- Create unique passwords for local accounts with administrative rights. +- Create unique passwords for local accounts with administrative rights. Each of these approaches is described in the following sections. @@ -274,57 +260,57 @@ The following table shows the Group Policy and registry settings that are used t 3. In the console tree, right-click **Group Policy Objects**, and > **New**. - ![local accounts 1.](images/localaccounts-proc1-sample1.png) + ![local accounts 1.](images/localaccounts-proc1-sample1.png) 4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. - ![local accounts 2.](images/localaccounts-proc1-sample2.png) + ![local accounts 2.](images/localaccounts-proc1-sample2.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 3.](images/localaccounts-proc1-sample3.png) + ![local accounts 3.](images/localaccounts-proc1-sample3.png) 6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: - 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**. + 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**. - 2. Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**. + 2. Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**. - 3. Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**. + 3. Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**. 7. Ensure that the local account restrictions are applied to network interfaces by following these steps: - 1. Navigate to Computer Configuration\\Preferences and Windows Settings, and > **Registry**. + 1. Navigate to Computer Configuration\\Preferences and Windows Settings, and > **Registry**. - 2. Right-click **Registry**, and > **New** > **Registry Item**. + 2. Right-click **Registry**, and > **New** > **Registry Item**. - ![local accounts 4.](images/localaccounts-proc1-sample4.png) + ![local accounts 4.](images/localaccounts-proc1-sample4.png) - 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. + 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. - 4. Ensure that the **Hive** box is set to **HKEY\_LOCAL\_MACHINE**. + 4. Ensure that the **Hive** box is set to **HKEY\_LOCAL\_MACHINE**. - 5. Select (**…**), browse to the following location for **Key Path** > **Select** for: **SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System**. + 5. Select (**…**), browse to the following location for **Key Path** > **Select** for: **SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System**. - 6. In the **Value name** area, type **LocalAccountTokenFilterPolicy**. + 6. In the **Value name** area, type **LocalAccountTokenFilterPolicy**. - 7. In the **Value type** box, from the drop-down list, select **REG\_DWORD** to change the value. + 7. In the **Value type** box, from the drop-down list, select **REG\_DWORD** to change the value. - 8. In the **Value data** box, ensure that the value is set to **0**. + 8. In the **Value data** box, ensure that the value is set to **0**. - 9. Verify this configuration, and > **OK**. + 9. Verify this configuration, and > **OK**. - ![local accounts 5.](images/localaccounts-proc1-sample5.png) + ![local accounts 5.](images/localaccounts-proc1-sample5.png) 8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: - 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. + 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. - 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. + 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - ![local accounts 6.](images/localaccounts-proc1-sample6.png) + ![local accounts 6.](images/localaccounts-proc1-sample6.png) - 3. Select the GPO that you created, and > **OK**. + 3. Select the GPO that you created, and > **OK**. 9. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. @@ -354,55 +340,33 @@ The following table shows the Group Policy settings that are used to deny networ #### To deny network logon to all local administrator accounts -1. Start the **Group Policy Management** Console (GPMC). +1. Start the **Group Policy Management** Console (GPMC) +1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). +1. In the console tree, right-click **Group Policy Objects**, and > **New**. +1. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer + ![local accounts 7.](images/localaccounts-proc2-sample1.png) +1. In the details pane, right-click <**gpo\_name**>, and > **Edit** + ![local accounts 8.](images/localaccounts-proc2-sample2.png) +1. Configure the user rights to deny network logons for administrative local accounts as follows: +1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment** +1. Double-click **Deny access to this computer from the network** +1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK** +1. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows: +1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment** +1. Double-click **Deny log on through Remote Desktop Services** +1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK** +1. Link the GPO to the first **Workstations** OU as follows: + - Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path + - Right-click the **Workstations** OU, and > **Link an existing GPO** + - Select the GPO that you created, and > **OK** +1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. +1. Create links to all other OUs that contain workstations. +1. Create links to all other OUs that contain servers. -2. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). + > [!NOTE] + > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. -3. In the console tree, right-click **Group Policy Objects**, and > **New**. - -4. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer. - - ![local accounts 7.](images/localaccounts-proc2-sample1.png) - -5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - - ![local accounts 8.](images/localaccounts-proc2-sample2.png) - -6. Configure the user rights to deny network logons for administrative local accounts as follows: - - 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment**. - - 2. Double-click **Deny access to this computer from the network**. - - 3. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**. - -7. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows: - - 1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment**. - - 2. Double-click **Deny log on through Remote Desktop Services**. - - 3. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**. - -8. Link the GPO to the first **Workstations** OU as follows: - - 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. - - 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - - 3. Select the GPO that you created, and > **OK**. - -9. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. - -10. Create links to all other OUs that contain workstations. - -11. Create links to all other OUs that contain servers. - - > [!NOTE] - > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. - - -### Create unique passwords for local accounts with administrative rights +### Create unique passwords for local accounts with administrative rights Passwords should be unique per individual account. While it's true for individual user accounts, many enterprises have identical passwords for common local accounts, such as the default Administrator account. This also occurs when the same passwords are used for local accounts during operating system deployments. @@ -410,19 +374,6 @@ Passwords that are left unchanged or changed synchronously to keep them identica Passwords can be randomized by: -- Purchasing and implementing an enterprise tool to accomplish this task. These tools are commonly referred to as "privileged password management" tools. - -- Configuring [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) to accomplish this task. - -- Creating and implementing a custom script or solution to randomize local account passwords. - -## See also - - -The following resources provide additional information about technologies that are related to local accounts. - -- [Security Principals](security-principals.md) - -- [Security Identifiers](security-identifiers.md) - -- [Access Control Overview](access-control.md) +- Purchasing and implementing an enterprise tool to accomplish this task. These tools are commonly referred to as "privileged password management" tools +- Configuring [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) to accomplish this task +- Creating and implementing a custom script or solution to randomize local account passwords diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 92b3296a71..62fc73012c 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,16 +1,11 @@ --- title: Additional mitigations description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 -ms.technology: itpro-security +ms.topic: article +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Additional mitigations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 69d69300a1..729349823b 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,21 +1,11 @@ --- title: Advice while using Windows Defender Credential Guard (Windows) description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard in Windows. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/31/2017 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 55fe9628bb..a44d84d5f4 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,21 +1,11 @@ --- title: How Windows Defender Credential Guard works description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 +ms.topic: conceptual appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 2c5fe11327..0407517885 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -1,21 +1,11 @@ --- title: Windows Defender Credential Guard - Known issues (Windows) description: Windows Defender Credential Guard - Known issues in Windows Enterprise -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 01/26/2022 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- # Windows Defender Credential Guard: Known issues diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 33cab5403d..1a956703ff 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -1,25 +1,12 @@ --- title: Manage Windows Defender Credential Guard (Windows) description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: zwhittington -manager: aaroncz -ms.collection: - - M365-identity-device-management +ms.collection: - highpri ms.topic: article -ms.custom: - - CI 120967 - - CSSTroubleshooting appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- # Manage Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 5ff4d5dadc..ae48c7a815 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -1,22 +1,11 @@ --- title: Windows Defender Credential Guard protection limits & mitigations (Windows) description: Scenarios not protected by Windows Defender Credential Guard in Windows, and additional mitigations you can use. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard protection limits and mitigations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 6444af7ea5..79de8e7f00 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -1,41 +1,30 @@ --- title: Windows Defender Credential Guard protection limits (Windows) description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows. Learn more with this guide. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard protection limits Some ways to store credentials are not protected by Windows Defender Credential Guard, including: -- Software that manages credentials outside of Windows feature protection -- Local accounts and Microsoft Accounts -- Windows Defender Credential Guard doesn't protect the Active Directory database running on Windows Server 2016 domain controllers. It also doesn't protect credential input pipelines, such as Windows Server 2016 servers running Remote Desktop Gateway. If you're using a Windows Server 2016 server as a client PC, it will get the same protection as it would when running Windows 10 Enterprise. -- Key loggers -- Physical attacks -- Doesn't prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization. -- Third-party security packages -- Digest and CredSSP credentials - - When Windows Defender Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. -- Supplied credentials for NTLM authentication aren't protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. These same credentials are vulnerable to key loggers as well.- -- Kerberos service tickets aren't protected by Credential Guard, but the Kerberos Ticket Granting Ticket (TGT) is. -- When Windows Defender Credential Guard is deployed on a VM, Windows Defender Credential Guard protects secrets from attacks inside the VM. However, it doesn't provide additional protection from privileged system attacks originating from the host. -- Windows logon cached password verifiers (commonly called "cached credentials") -don't qualify as credentials because they can't be presented to another computer for authentication, and can only be used locally to verify credentials. They're stored in the registry on the local computer and provide validation for credentials when a domain-joined computer can't connect to AD DS during user logon. These “cached logons”, or more specifically, cached domain account information, can be managed using the security policy setting **Interactive logon: Number of previous logons to cache** if a domain controller isn't available. +- Software that manages credentials outside of Windows feature protection +- Local accounts and Microsoft Accounts +- Windows Defender Credential Guard doesn't protect the Active Directory database running on Windows Server domain controllers. It also doesn't protect credential input pipelines, such as Windows Server running Remote Desktop Gateway. If you're using a Windows Server OS as a client PC, it will get the same protection as it would when running a Windows client OS. +- Key loggers +- Physical attacks +- Doesn't prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization. +- Third-party security packages +- Digest and CredSSP credentials + - When Windows Defender Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. +- Supplied credentials for NTLM authentication aren't protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. These same credentials are vulnerable to key loggers as well.- +- Kerberos service tickets aren't protected by Credential Guard, but the Kerberos Ticket Granting Ticket (TGT) is. +- When Windows Defender Credential Guard is deployed on a VM, Windows Defender Credential Guard protects secrets from attacks inside the VM. However, it doesn't provide additional protection from privileged system attacks originating from the host. +- Windows logon cached password verifiers (commonly called "cached credentials") +don't qualify as credentials because they can't be presented to another computer for authentication, and can only be used locally to verify credentials. They're stored in the registry on the local computer and provide validation for credentials when a domain-joined computer can't connect to AD DS during user logon. These *cached logons*, or more specifically, *cached domain account information*, can be managed using the security policy setting **Interactive logon: Number of previous logons to cache** if a domain controller isn't available. ## See also diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 2e2a82219b..6112d90366 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -1,26 +1,14 @@ --- -title: Windows Defender Credential Guard Requirements (Windows) +title: Windows Defender Credential Guard requirements description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: zwhittington -manager: aaroncz -ms.collection: - - M365-identity-device-management -ms.topic: article ms.date: 12/27/2021 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- -# Windows Defender Credential Guard: Requirements +# Windows Defender Credential Guard requirements For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements, which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to these requirements as [Application requirements](#application-requirements). Beyond these requirements, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index 8b39b99573..867ad14148 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -1,23 +1,20 @@ --- title: Scripts for Certificate Issuance Policies in Windows Defender Credential Guard (Windows) description: Obtain issuance policies from the certificate authority for Windows Defender Credential Guard on Windows. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article -ms.date: 08/17/2017 -ms.technology: itpro-security +ms.date: 11/22/2022 +ms.topic: reference +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- -# Windows Defender Credential Guard: Scripts for Certificate Authority Issuance Policies +# Windows Defender Credential Guard: scripts for certificate authority issuance policies -Here is a list of scripts mentioned in this topic. +Expand each section to see the PowerShell scripts: -## Get the available issuance policies on the certificate authority +
+
+Get the available issuance policies on the certificate authority Save this script file as get-IssuancePolicy.ps1. @@ -207,8 +204,12 @@ write-host "There are no issuance policies which are not mapped to groups" ``` > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. -  -## Link an issuance policy to a group + +
+ +
+
+Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. @@ -489,3 +490,5 @@ write-host $tmp -Foreground Red > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. + +
diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 950eb3a95c..fe35c4ca75 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -1,24 +1,13 @@ --- title: Protect derived domain credentials with Windows Defender Credential Guard (Windows) description: Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: - - M365-identity-device-management - - highpri +ms.date: 11/22/2022 ms.topic: article -ms.date: 03/10/2022 +ms.collection: + - highpri appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Protect derived domain credentials with Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index bfb971ef4f..b4e156aa00 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -1,21 +1,11 @@ --- title: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool description: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool script -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +ms.date: 11/22/2022 +ms.topic: reference +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool From 232b954a954a867348a388d045384059564ff4d6 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Tue, 22 Nov 2022 12:28:21 -0800 Subject: [PATCH 039/324] Added 22H2 Known Issues Section Bulk of 22H2 update, added a unified 22H2 SSO breakage section to the "Known Issues" page, which can be linked to by other comms. --- .../credential-guard-known-issues.md | 115 +++++++++++++----- 1 file changed, 84 insertions(+), 31 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 2c5fe11327..517b038409 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article @@ -22,45 +22,56 @@ ms.technology: itpro-security Windows Defender Credential Guard has certain application requirements. Windows Defender Credential Guard blocks specific authentication capabilities. So applications that require such capabilities won't function when it's enabled. For more information, see [Application requirements](credential-guard-requirements.md#application-requirements). -The following known issues have been fixed in the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4): +## Known Issue: Single Sign-On (SSO) for Network services breaks after upgrading to **Windows 11, version 22H2** -- Scheduled tasks with domain user-stored credentials fail to run when Credential Guard is enabled. The task fails and reports Event ID 104 with the following message: +### Affected devices: +Any device that enables Windows Defender Credential Guard may encounter this issue. As part of the Windows 11, version 22H2 update, eligible devices which had not previously explicitly disabled Windows Defender Credential Guard had it enabled by default. This affected all devices on Enterprise (E3 and E5) and Education licenses, as well as some Pro licenses*, as long as they met the [minimum hardware requirements](credential-guard-requirements.md#hardware-and-software-requirements). + +\* All Pro devices which previously ran Windows Defender Credential Guard on an eligible license and later downgraded to Pro, and which still meet the [minimum hardware requirements](credential-guard-requirements.md#hardware-and-software-requirements), will receive default enablement. - ```console - Task Scheduler failed to log on '\Test'. - Failure occurred in 'LogonUserExEx'. - User Action: Ensure the credentials for the task are correctly specified. - Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect). - ``` +> [!TIP] +> To determine if your Pro device will receive default enablement when upgraded to **Windows 11, version 22H2**, do the following **before** upgrading: +> Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage#disable-windows-defender-credential-guard). -- When you enable NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4625 with error 0xC0000064 on the machine itself. For example: +### Symptoms of the issue: +Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication will be unable to use SSO to login and will be forced to manually re-authenticate in every new Windows session. - ```console - Log Name: Microsoft-Windows-NTLM/Operational - Source: Microsoft-Windows-Security-Netlogon - Event ID: 8004 - Task Category: Auditing NTLM - Level: Information - Description: - Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller. - Secure Channel name: - User name: - @@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAgDA2AQQAMEAwAANAgDA1AQLAIEADBQRAADAtAANAYEA1AwQA0CA5AAOAMEAyAQLAYDAxAwQAEDAEBwMAMEAwAgMAMDACBgRA0HA - Domain name: NULL - ``` +### Why this is happening: +Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. Affected procols include: + - Kerberos unconstrained delegation (both SSO and supplied credentials are blocked) + - Kerberos when PKINIT uses RSA encryption instead of Diffie-Hellman (both SSO and supplied credentials are blocked) + - WDigest (only SSO is blocked) + - NTLM v1 (only SSO is blocked) + - MS-CHAP (only SSO is blocked) - - This event stems from a scheduled task running under local user context with the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4) or later and happens when Credential Guard is enabled. - - The username appears in an unusual format because local accounts aren't protected by Credential Guard. The task also fails to execute. - - As a workaround, run the scheduled task under a domain user or the computer's SYSTEM account. +### Options to fix the issue: -The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: +Microsoft recommends that organizations move away from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. Windows Defender Credential Guard will not block certificate-based authentication. -- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows machines](https://support.microsoft.com/topic/april-11-2017-kb4015217-os-build-14393-1066-and-14393-1083-b5f79067-98bd-b4ec-8b81-5d858d7dc722) +For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. - This issue can potentially lead to unexpected account lockouts. For more information, see the following support articles: +> [!TIP] +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before installing the Windows 11, version 22H2 update. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. - - [KB4015219](https://support.microsoft.com/topic/april-11-2017-kb4015219-os-build-10586-873-68b8e379-aafa-ea6c-6b29-56d19785e657) - - [KB4015221](https://support.microsoft.com/topic/april-11-2017-kb4015221-os-build-10240-17354-743f52bc-a484-d23f-71f5-b9957cbae0e6) +> [!NOTE] +> MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: + > + > **Event ID 4013** (Warning) + > ``` + > id="NTLMv1BlockedByCredGuard" + > value="Attempt to use NTLMv1 failed. + > Target server: %1%nSupplied user: %2%nSupplied domain: %3%nPID of client process: %4%nName of client process: %5%nLUID of client process: %6%nUser identity of client process: %7%nDomain name of user identity of client process: %8%nMechanism OID: %9%n%nThis device does not support NTLMv1. For more information, see https://go.microsoft.com/fwlink/?linkid=856826." + > /> + > ``` + > + > **Event ID 4014** (Error) + > ``` + > id="NTLMGetCredentialKeyBlockedByCredGuard" + > value="Attempt to get credential key by call package blocked by Credential Guard.%n%nCalling Process Name: %1%nService Host Tag: %2" + > /> + > ``` ## Known issues involving third-party applications @@ -112,3 +123,45 @@ Windows Defender Credential Guard isn't supported by the following products, pro This list isn't comprehensive. Check whether your product vendor, product version, or computer system supports Windows Defender Credential Guard on systems that run Windows or specific versions of Windows. Specific computer system models may be incompatible with Windows Defender Credential Guard. Microsoft encourages third-party vendors to contribute to this page by providing relevant product support information and by adding links to their own product support statements. + +## Previous known issues that have been fixed + +The following known issues have been fixed in the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4): + +- Scheduled tasks with domain user-stored credentials fail to run when Credential Guard is enabled. The task fails and reports Event ID 104 with the following message: + + ```console + Task Scheduler failed to log on '\Test'. + Failure occurred in 'LogonUserExEx'. + User Action: Ensure the credentials for the task are correctly specified. + Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect). + ``` + +- When you enable NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4625 with error 0xC0000064 on the machine itself. For example: + + ```console + Log Name: Microsoft-Windows-NTLM/Operational + Source: Microsoft-Windows-Security-Netlogon + Event ID: 8004 + Task Category: Auditing NTLM + Level: Information + Description: + Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller. + Secure Channel name: + User name: + @@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAgDA2AQQAMEAwAANAgDA1AQLAIEADBQRAADAtAANAYEA1AwQA0CA5AAOAMEAyAQLAYDAxAwQAEDAEBwMAMEAwAgMAMDACBgRA0HA + Domain name: NULL + ``` + + - This event stems from a scheduled task running under local user context with the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4) or later and happens when Credential Guard is enabled. + - The username appears in an unusual format because local accounts aren't protected by Credential Guard. The task also fails to execute. + - As a workaround, run the scheduled task under a domain user or the computer's SYSTEM account. + +The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: + +- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows machines](https://support.microsoft.com/topic/april-11-2017-kb4015217-os-build-14393-1066-and-14393-1083-b5f79067-98bd-b4ec-8b81-5d858d7dc722) + + This issue can potentially lead to unexpected account lockouts. For more information, see the following support articles: + + - [KB4015219](https://support.microsoft.com/topic/april-11-2017-kb4015219-os-build-10586-873-68b8e379-aafa-ea6c-6b29-56d19785e657) + - [KB4015221](https://support.microsoft.com/topic/april-11-2017-kb4015221-os-build-10240-17354-743f52bc-a484-d23f-71f5-b9957cbae0e6) From 85adbbf1d386724387a5d98356bde23886598d37 Mon Sep 17 00:00:00 2001 From: Raffy <48763181+ErrorRaffyline0@users.noreply.github.com> Date: Wed, 23 Nov 2022 00:36:03 +0100 Subject: [PATCH 040/324] Related topics fix Basic settings are related to advanced settings of the same category --- .../auditing/basic-security-audit-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index bbc3b39ae8..977eb2065d 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -39,6 +39,6 @@ Basic security audit policy settings are found under Computer Configuration\\Win ## Related topics -- [Basic security audit policy settings](basic-security-audit-policy-settings.md) +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) From f4d70bc8188b1951041913664297112a73a993d1 Mon Sep 17 00:00:00 2001 From: Raffy <48763181+ErrorRaffyline0@users.noreply.github.com> Date: Wed, 23 Nov 2022 00:42:22 +0100 Subject: [PATCH 041/324] Add related topic Basic security settings added as related to advanced --- .../auditing/advanced-security-audit-policy-settings.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index 54ddd26b54..64098b1b13 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -172,4 +172,8 @@ Resource SACLs are also useful for diagnostic scenarios. For example, administra This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) -- [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) \ No newline at end of file +- [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) + +## Related topics + +- [Basic security audit policy settings](basic-security-audit-policy-settings.md) From a20e6c7196c6234a1286a0084dd061ca4527eabf Mon Sep 17 00:00:00 2001 From: Bas de Koning Date: Wed, 23 Nov 2022 08:58:31 +0100 Subject: [PATCH 042/324] Update windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md Pushed Suggested changes. :) Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- ...indows-defender-application-control-policies-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md index 8592cad258..f4b43a2558 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-windows-defender-application-control-policies-using-intune.md @@ -61,7 +61,7 @@ The steps to use Intune's custom OMA-URI functionality are: 2. Specify a **Name** and **Description** and use the following values for the remaining custom OMA-URI settings: - **OMA-URI**: `./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy` - **Data type**: Base64 (file) - - **Certificate file**: upload your binary format policy file. Todo this change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. + - **Certificate file**: Upload your binary format policy file. To do this, change your {GUID}.cip file to {GUID}.bin. You don't need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. > [!div class="mx-imgBorder"] > ![Configure custom WDAC.](../images/wdac-intune-custom-oma-uri.png) From a0d3f024380c65878885339837e35b5054a3b174 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 23 Nov 2022 10:37:22 -0500 Subject: [PATCH 043/324] updates --- windows/security/TOC.yml | 238 +++++++++--------- .../access-control/local-accounts.md | 111 ++++---- 2 files changed, 166 insertions(+), 183 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index c364767760..d0acdd1a6d 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -45,45 +45,45 @@ href: /windows-hardware/design/device-experiences/oem-highly-secure - name: Operating system security items: - - name: Overview - href: operating-system.md - - name: System security - items: - - name: Secure the Windows boot process - href: information-protection/secure-the-windows-10-boot-process.md - - name: Trusted Boot - href: trusted-boot.md - - name: Cryptography and certificate management - href: cryptography-certificate-mgmt.md - - name: The Windows Security app - href: threat-protection/windows-defender-security-center/windows-defender-security-center.md - items: - - name: Virus & threat protection - href: threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md - - name: Account protection - href: threat-protection\windows-defender-security-center\wdsc-account-protection.md - - name: Firewall & network protection - href: threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md - - name: App & browser control - href: threat-protection\windows-defender-security-center\wdsc-app-browser-control.md - - name: Device security - href: threat-protection\windows-defender-security-center\wdsc-device-security.md - - name: Device performance & health - href: threat-protection\windows-defender-security-center\wdsc-device-performance-health.md - - name: Family options - href: threat-protection\windows-defender-security-center\wdsc-family-options.md - - name: Security policy settings - href: threat-protection/security-policy-settings/security-policy-settings.md - - name: Security auditing - href: threat-protection/auditing/security-auditing-overview.md - - name: Encryption and data protection - href: encryption-data-protection.md - items: - - name: Encrypted Hard Drive - href: information-protection/encrypted-hard-drive.md - - name: BitLocker - href: information-protection/bitlocker/bitlocker-overview.md - items: + - name: Overview + href: operating-system.md + - name: System security + items: + - name: Secure the Windows boot process + href: information-protection/secure-the-windows-10-boot-process.md + - name: Trusted Boot + href: trusted-boot.md + - name: Cryptography and certificate management + href: cryptography-certificate-mgmt.md + - name: The Windows Security app + href: threat-protection/windows-defender-security-center/windows-defender-security-center.md + items: + - name: Virus & threat protection + href: threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md + - name: Account protection + href: threat-protection\windows-defender-security-center\wdsc-account-protection.md + - name: Firewall & network protection + href: threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md + - name: App & browser control + href: threat-protection\windows-defender-security-center\wdsc-app-browser-control.md + - name: Device security + href: threat-protection\windows-defender-security-center\wdsc-device-security.md + - name: Device performance & health + href: threat-protection\windows-defender-security-center\wdsc-device-performance-health.md + - name: Family options + href: threat-protection\windows-defender-security-center\wdsc-family-options.md + - name: Security policy settings + href: threat-protection/security-policy-settings/security-policy-settings.md + - name: Security auditing + href: threat-protection/auditing/security-auditing-overview.md + - name: Encryption and data protection + href: encryption-data-protection.md + items: + - name: Encrypted Hard Drive + href: information-protection/encrypted-hard-drive.md + - name: BitLocker + href: information-protection/bitlocker/bitlocker-overview.md + items: - name: Overview of BitLocker Device Encryption in Windows href: information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md - name: BitLocker frequently asked questions (FAQ) @@ -155,21 +155,21 @@ href: information-protection/bitlocker/ts-bitlocker-tpm-issues.md - name: Decode Measured Boot logs to track PCR changes href: information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md - - name: Personal Data Encryption (PDE) - items: - - name: Personal Data Encryption (PDE) overview - href: information-protection/personal-data-encryption/overview-pde.md - - name: Personal Data Encryption (PDE) frequently asked questions (FAQ) - href: information-protection/personal-data-encryption/faq-pde.yml - - name: Configure Personal Data Encryption (PDE) in Intune - href: information-protection/personal-data-encryption/configure-pde-in-intune.md - - name: Configure S/MIME for Windows - href: identity-protection/configure-s-mime.md - - name: Network security - items: - - name: VPN technical guide - href: identity-protection/vpn/vpn-guide.md - items: + - name: Personal Data Encryption (PDE) + items: + - name: Personal Data Encryption (PDE) overview + href: information-protection/personal-data-encryption/overview-pde.md + - name: Personal Data Encryption (PDE) frequently asked questions (FAQ) + href: information-protection/personal-data-encryption/faq-pde.yml + - name: Configure Personal Data Encryption (PDE) in Intune + href: information-protection/personal-data-encryption/configure-pde-in-intune.md + - name: Configure S/MIME for Windows + href: identity-protection/configure-s-mime.md + - name: Network security + items: + - name: VPN technical guide + href: identity-protection/vpn/vpn-guide.md + items: - name: VPN connection types href: identity-protection/vpn/vpn-connection-type.md - name: VPN routing decisions @@ -192,17 +192,17 @@ href: identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md - name: Optimizing Office 365 traffic with the Windows VPN client href: identity-protection/vpn/vpn-office-365-optimization.md - - name: Windows Defender Firewall - href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md - - name: Windows security baselines - href: threat-protection/windows-security-configuration-framework/windows-security-baselines.md - items: + - name: Windows Defender Firewall + href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md + - name: Windows security baselines + href: threat-protection/windows-security-configuration-framework/windows-security-baselines.md + items: - name: Security Compliance Toolkit href: threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md - name: Get support href: threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md - - name: Virus & threat protection - items: + - name: Virus & threat protection + items: - name: Overview href: threat-protection/index.md - name: Microsoft Defender Antivirus @@ -219,8 +219,8 @@ href: /microsoft-365/security/defender-endpoint/exploit-protection - name: Microsoft Defender for Endpoint href: /microsoft-365/security/defender-endpoint - - name: More Windows security - items: + - name: More Windows security + items: - name: Override Process Mitigation Options to help enforce app-related security policies href: threat-protection/override-mitigation-options-for-app-related-security-policies.md - name: Use Windows Event Forwarding to help with intrusion detection @@ -230,9 +230,9 @@ - name: Windows Information Protection (WIP) href: information-protection/windows-information-protection/protect-enterprise-data-using-wip.md items: - - name: Create a WIP policy using Microsoft Intune - href: information-protection/windows-information-protection/overview-create-wip-policy.md - items: + - name: Create a WIP policy using Microsoft Intune + href: information-protection/windows-information-protection/overview-create-wip-policy.md + items: - name: Create a WIP policy in Microsoft Intune href: information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md items: @@ -244,26 +244,26 @@ href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md - name: Determine the enterprise context of an app running in WIP href: information-protection/windows-information-protection/wip-app-enterprise-context.md - - name: Create a WIP policy using Microsoft Configuration Manager - href: information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md - items: + - name: Create a WIP policy using Microsoft Configuration Manager + href: information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md + items: - name: Create and deploy a WIP policy in Configuration Manager href: information-protection/windows-information-protection/create-wip-policy-using-configmgr.md - name: Create and verify an EFS Data Recovery Agent (DRA) certificate href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md - name: Determine the enterprise context of an app running in WIP href: information-protection/windows-information-protection/wip-app-enterprise-context.md - - name: Mandatory tasks and settings required to turn on WIP - href: information-protection/windows-information-protection/mandatory-settings-for-wip.md - - name: Testing scenarios for WIP - href: information-protection/windows-information-protection/testing-scenarios-for-wip.md - - name: Limitations while using WIP - href: information-protection/windows-information-protection/limitations-with-wip.md - - name: How to collect WIP audit event logs - href: information-protection/windows-information-protection/collect-wip-audit-event-logs.md - - name: General guidance and best practices for WIP - href: information-protection/windows-information-protection/guidance-and-best-practices-wip.md - items: + - name: Mandatory tasks and settings required to turn on WIP + href: information-protection/windows-information-protection/mandatory-settings-for-wip.md + - name: Testing scenarios for WIP + href: information-protection/windows-information-protection/testing-scenarios-for-wip.md + - name: Limitations while using WIP + href: information-protection/windows-information-protection/limitations-with-wip.md + - name: How to collect WIP audit event logs + href: information-protection/windows-information-protection/collect-wip-audit-event-logs.md + - name: General guidance and best practices for WIP + href: information-protection/windows-information-protection/guidance-and-best-practices-wip.md + items: - name: Enlightened apps for use with WIP href: information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md - name: Unenlightened and enlightened app behavior while using WIP @@ -272,36 +272,36 @@ href: information-protection/windows-information-protection/recommended-network-definitions-for-wip.md - name: Using Outlook Web Access with WIP href: information-protection/windows-information-protection/using-owa-with-wip.md - - name: Fine-tune WIP Learning - href: information-protection/windows-information-protection/wip-learning.md - - name: Disable WIP - href: information-protection/windows-information-protection/how-to-disable-wip.md + - name: Fine-tune WIP Learning + href: information-protection/windows-information-protection/wip-learning.md + - name: Disable WIP + href: information-protection/windows-information-protection/how-to-disable-wip.md - name: Application security items: - - name: Overview - href: apps.md - - name: Windows Defender Application Control and virtualization-based protection of code integrity - href: threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md - - name: Windows Defender Application Control - href: threat-protection\windows-defender-application-control\windows-defender-application-control.md - - name: Microsoft Defender Application Guard - href: threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md - - name: Windows Sandbox - href: threat-protection/windows-sandbox/windows-sandbox-overview.md - items: + - name: Overview + href: apps.md + - name: Windows Defender Application Control and virtualization-based protection of code integrity + href: threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md + - name: Windows Defender Application Control + href: threat-protection\windows-defender-application-control\windows-defender-application-control.md + - name: Microsoft Defender Application Guard + href: threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md + - name: Windows Sandbox + href: threat-protection/windows-sandbox/windows-sandbox-overview.md + items: - name: Windows Sandbox architecture href: threat-protection/windows-sandbox/windows-sandbox-architecture.md - name: Windows Sandbox configuration href: threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md - - name: Microsoft Defender SmartScreen overview - href: threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md - items: + - name: Microsoft Defender SmartScreen overview + href: threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md + items: - name: Enhanced Phishing Protection in Microsoft Defender SmartScreen href: threat-protection\microsoft-defender-smartscreen\phishing-protection-microsoft-defender-smartscreen.md - - name: Configure S/MIME for Windows - href: identity-protection\configure-s-mime.md - - name: Windows Credential Theft Mitigation Guide Abstract - href: identity-protection\windows-credential-theft-mitigation-guide-abstract.md + - name: Configure S/MIME for Windows + href: identity-protection\configure-s-mime.md + - name: Windows Credential Theft Mitigation Guide Abstract + href: identity-protection\windows-credential-theft-mitigation-guide-abstract.md - name: User security and secured identity items: - name: Overview @@ -342,15 +342,15 @@ items: - name: Local Accounts href: identity-protection/access-control/local-accounts.md - - name: User Account Control - href: identity-protection/user-account-control/user-account-control-overview.md - items: - - name: How User Account Control works - href: identity-protection/user-account-control/how-user-account-control-works.md - - name: User Account Control security policy settings - href: identity-protection/user-account-control/user-account-control-security-policy-settings.md - - name: User Account Control Group Policy and registry key settings - href: identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md + - name: User Account Control + href: identity-protection/user-account-control/user-account-control-overview.md + items: + - name: How User Account Control works + href: identity-protection/user-account-control/how-user-account-control-works.md + - name: User Account Control security policy settings + href: identity-protection/user-account-control/user-account-control-security-policy-settings.md + - name: User Account Control Group Policy and registry key settings + href: identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md - name: Smart Cards href: identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md items: @@ -396,14 +396,14 @@ href: identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md - name: Cloud services items: - - name: Overview - href: cloud.md - - name: Mobile device management - href: /windows/client-management/mdm/ - - name: Windows 365 Cloud PCs - href: /windows-365/overview - - name: Azure Virtual Desktop - href: /azure/virtual-desktop/ + - name: Overview + href: cloud.md + - name: Mobile device management + href: /windows/client-management/mdm/ + - name: Windows 365 Cloud PCs + href: /windows-365/overview + - name: Azure Virtual Desktop + href: /azure/virtual-desktop/ - name: Security foundations items: - name: Overview diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 7fa46f2d3f..85c1d02be5 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,7 +1,7 @@ --- title: Local Accounts description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.date: 22/11/2022 +ms.date: 11/22/2022 ms.collection: - highpri ms.topic: article @@ -222,7 +222,7 @@ Each of these approaches is described in the following sections. ### Enforce local account restrictions for remote access -The User Account Control (UAC) is a security feature in Windows that has been in use in Windows Server 2008 and in Windows Vista, and the operating systems to which the **Applies To** list refers. UAC enables you to stay in control of your computer by informing you when a program makes a change that requires administrator-level permission. UAC works by adjusting the permission level of your user account. By default, UAC is set to notify you when applications try to make changes to your computer, but you can change how often UAC notifies you. +User Account Control (UAC) is a security feature that informs you when a program makes a change that requires administrative permissions. UAC works by adjusting the permission level of your user account. By default, UAC is set to notify you when applications try to make changes to your computer, but you can change when UAC notifies you. UAC makes it possible for an account with administrative rights to be treated as a standard user non-administrator account until full rights, also called elevation, is requested and approved. For example, UAC lets an administrator enter credentials during a non-administrator's user session to perform occasional administrative tasks without having to switch users, sign out, or use the **Run as** command. @@ -254,70 +254,49 @@ The following table shows the Group Policy and registry settings that are used t #### To enforce local account restrictions for remote access -1. Start the **Group Policy Management** Console (GPMC). +1. Start the **Group Policy Management** Console (GPMC) +1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO) +1. In the console tree, right-click **Group Policy Objects > New** + :::image type="content" source="images/localaccounts-proc1-sample1.png" alt-text="local accounts"::: +1. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer + :::image type="content" source="images/localaccounts-proc1-sample2.png" alt-text="local accounts"::: +1. In the details pane, right-click <**gpo\_name**>, and > **Edit** + :::image type="content" source="images/localaccounts-proc1-sample3.png" alt-text="local accounts"::: +1. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: -2. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). + - Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options** + - Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK** + - Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK** -3. In the console tree, right-click **Group Policy Objects**, and > **New**. +1. Ensure that the local account restrictions are applied to network interfaces by following these steps: - ![local accounts 1.](images/localaccounts-proc1-sample1.png) + - Navigate to *Computer Configuration\Preferences and Windows Settings*, and > **Registry** + - Right-click **Registry**, and > **New** > **Registry Item** -4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. + :::image type="content" source="images/localaccounts-proc1-sample4.png" alt-text="local accounts"::: - ![local accounts 2.](images/localaccounts-proc1-sample2.png) + - In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace** + - Ensure that the **Hive** box is set to **HKEY_LOCAL_MACHINE** + - Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System` + - In the **Value name** area, type `LocalAccountTokenFilterPolicy` + - In the **Value type** box, from the drop-down list, select **REG_DWORD** to change the value + - In the **Value data** box, ensure that the value is set to **0** + - Verify this configuration, and > **OK** -5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. + :::image type="content" source="images/localaccounts-proc1-sample5.png" alt-text="local accounts"::: - ![local accounts 3.](images/localaccounts-proc1-sample3.png) +1. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: -6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: + - Navigate to the `*Forest*\\*Domain*\*OU*` path + - Right-click the **Workstations > Link an existing GPO** - 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**. + :::image type="content" source="images/localaccounts-proc1-sample6.png" alt-text="local accounts"::: - 2. Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**. - - 3. Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**. - -7. Ensure that the local account restrictions are applied to network interfaces by following these steps: - - 1. Navigate to Computer Configuration\\Preferences and Windows Settings, and > **Registry**. - - 2. Right-click **Registry**, and > **New** > **Registry Item**. - - ![local accounts 4.](images/localaccounts-proc1-sample4.png) - - 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. - - 4. Ensure that the **Hive** box is set to **HKEY\_LOCAL\_MACHINE**. - - 5. Select (**…**), browse to the following location for **Key Path** > **Select** for: **SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System**. - - 6. In the **Value name** area, type **LocalAccountTokenFilterPolicy**. - - 7. In the **Value type** box, from the drop-down list, select **REG\_DWORD** to change the value. - - 8. In the **Value data** box, ensure that the value is set to **0**. - - 9. Verify this configuration, and > **OK**. - - ![local accounts 5.](images/localaccounts-proc1-sample5.png) - -8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: - - 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. - - 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - - ![local accounts 6.](images/localaccounts-proc1-sample6.png) - - 3. Select the GPO that you created, and > **OK**. - -9. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. - -10. Create links to all other OUs that contain workstations. - -11. Create links to all other OUs that contain servers. + - Select the GPO that you created, and > **OK** +1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy +1. Create links to all other OUs that contain workstations +1. Create links to all other OUs that contain servers ### Deny network logon to all local Administrator accounts Denying local accounts the ability to perform network logons can help prevent a local account password hash from being reused in a malicious attack. This procedure helps to prevent lateral movement by ensuring that stolen credentials for local accounts from a compromised operating system can't be used to compromise other computers that use the same credentials. @@ -325,8 +304,6 @@ Denying local accounts the ability to perform network logons can help prevent a > [!NOTE] > To perform this procedure, you must first identify the name of the local, default Administrator account, which might not be the default user name "Administrator", and any other accounts that are members of the local Administrators group. - - The following table shows the Group Policy settings that are used to deny network logon for all local Administrator accounts. |No.|Setting|Detailed Description| @@ -341,12 +318,16 @@ The following table shows the Group Policy settings that are used to deny networ #### To deny network logon to all local administrator accounts 1. Start the **Group Policy Management** Console (GPMC) -1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). -1. In the console tree, right-click **Group Policy Objects**, and > **New**. +1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO) +1. In the console tree, right-click **Group Policy Objects**, and > **New** 1. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer + ![local accounts 7.](images/localaccounts-proc2-sample1.png) + 1. In the details pane, right-click <**gpo\_name**>, and > **Edit** + ![local accounts 8.](images/localaccounts-proc2-sample2.png) + 1. Configure the user rights to deny network logons for administrative local accounts as follows: 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment** 1. Double-click **Deny access to this computer from the network** @@ -356,15 +337,17 @@ The following table shows the Group Policy settings that are used to deny networ 1. Double-click **Deny log on through Remote Desktop Services** 1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK** 1. Link the GPO to the first **Workstations** OU as follows: + - Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path - Right-click the **Workstations** OU, and > **Link an existing GPO** - Select the GPO that you created, and > **OK** -1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. -1. Create links to all other OUs that contain workstations. -1. Create links to all other OUs that contain servers. - > [!NOTE] - > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. +1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy +1. Create links to all other OUs that contain workstations +1. Create links to all other OUs that contain servers + +> [!NOTE] +> You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. ### Create unique passwords for local accounts with administrative rights From 26737a9399b46bd8cfd268caf91618c8d8264294 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 23 Nov 2022 16:29:54 -0500 Subject: [PATCH 044/324] Deploy root code block standarization plus style updates --- windows/deployment/add-store-apps-to-image.md | 57 ++-- ...nfigure-a-pxe-server-to-load-windows-pe.md | 147 +++++---- .../deployment/deploy-enterprise-licenses.md | 8 +- windows/deployment/deploy-m365.md | 22 +- windows/deployment/deploy-whats-new.md | 9 +- windows/deployment/deploy-windows-to-go.md | 284 ++++++++++-------- windows/deployment/mbr-to-gpt.md | 20 +- .../deployment/vda-subscription-activation.md | 4 +- windows/deployment/windows-10-poc-mdt.md | 34 +-- .../windows-10-poc-sc-config-mgr.md | 69 +++-- windows/deployment/windows-10-poc.md | 78 ++--- .../windows-deployment-scenarios-and-tools.md | 6 +- 12 files changed, 413 insertions(+), 325 deletions(-) diff --git a/windows/deployment/add-store-apps-to-image.md b/windows/deployment/add-store-apps-to-image.md index ac883e80a0..a91e078d81 100644 --- a/windows/deployment/add-store-apps-to-image.md +++ b/windows/deployment/add-store-apps-to-image.md @@ -9,72 +9,83 @@ ms.reviewer: manager: aaroncz ms.topic: article ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # Add Microsoft Store for Business applications to a Windows 10 image -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 This article describes the correct way to add Microsoft Store for Business applications to a Windows 10 image. Adding Microsoft Store for Business applications to a Windows 10 image will enable you to deploy Windows 10 with pre-installed Microsoft Store for Business apps. ->[!IMPORTANT] ->In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. +> [!IMPORTANT] +> In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. ## Prerequisites -* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) for the tools required to mount and edit Windows images. +- [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) for the tools required to mount and edit Windows images. -* Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app). -* A Windows Image. For instructions on image creation, see [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md). +- Download an offline signed app package and license of the application you would like to add through [Microsoft Store for Business](/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app). +- A Windows Image. For instructions on image creation, see [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md). ->[!NOTE] +> [!NOTE] > If you'd like to add an internal LOB Microsoft Store application, please follow the instructions on **[Sideload line of business (LOB) apps in Windows client devices](/windows/application-management/sideload-apps-in-windows-10)**. ## Adding a Store application to your image On a machine where your image file is accessible: + 1. Open Windows PowerShell with administrator privileges. + 2. Mount the image. At the Windows PowerShell prompt, type: `Mount-WindowsImage -ImagePath c:\images\myimage.wim -Index 1 -Path C:\test` + 3. Use the Add-AppxProvisionedPackage cmdlet in Windows PowerShell to preinstall the app. Use the /PackagePath option to specify the location of the Store package and /LicensePath to specify the location of the license .xml file. In Windows PowerShell, type: `Add-AppxProvisionedPackage -Path C:\test -PackagePath C:\downloads\appxpackage -LicensePath C:\downloads\appxpackage\license.xml` ->[!NOTE] ->Paths and file names are examples. Use your paths and file names where appropriate. +> [!NOTE] +> Paths and file names are examples. Use your paths and file names where appropriate. > ->Do not dismount the image, as you will return to it later. +> Do not dismount the image, as you will return to it later. ## Editing the Start Layout In order for Microsoft Store for Business applications to persist after image deployment, these applications need to be pinned to Start prior to image deployment. On a test machine: + 1. **Install the Microsoft Store for Business application you previously added** to your image. + 2. **Pin these apps to the Start screen**, by typing the name of the app, right-clicking and selecting **Pin to Start**. + 3. Open Windows PowerShell with administrator privileges. + 4. Use `Export-StartLayout -path .xml` where *\\* is the path and name of the xml file your will later import into your Windows Image. + 5. Copy the XML file you created to a location accessible by the machine you previously used to add Store applications to your image. Now, on the machine where your image file is accessible: -1. Import the Start layout. At the Windows PowerShell prompt, type: + +1. Import the Start layout. At the Windows PowerShell prompt, type: `Import-StartLayout -LayoutPath ".xml" -MountPath "C:\test\"` + 2. Save changes and dismount the image. At the Windows PowerShell prompt, type: `Dismount-WindowsImage -Path c:\test -Save` ->[!NOTE] ->Paths and file names are examples. Use your paths and file names where appropriate. +> [!NOTE] +> Paths and file names are examples. Use your paths and file names where appropriate. > ->For more information on Start customization, see [Windows 10 Start Layout Customization](/archive/blogs/deploymentguys/windows-10-start-layout-customization) +> For more information on Start customization, see [Windows 10 Start Layout Customization](/archive/blogs/deploymentguys/windows-10-start-layout-customization) ## Related articles -* [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout) -* [Export-StartLayout](/powershell/module/startlayout/export-startlayout) -* [Import-StartLayout](/powershell/module/startlayout/import-startlayout) -* [Sideload line of business (LOB) apps in Windows client devices](/windows/application-management/sideload-apps-in-windows-10) -* [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) -* [Deploy Windows 10 with the Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) -* [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) + +- [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout) +- [Export-StartLayout](/powershell/module/startlayout/export-startlayout) +- [Import-StartLayout](/powershell/module/startlayout/import-startlayout) +- [Sideload line of business (LOB) apps in Windows client devices](/windows/application-management/sideload-apps-in-windows-10) +- [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md) +- [Deploy Windows 10 with the Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) +- [Windows Assessment and Deployment Kit (Windows ADK)](windows-adk-scenarios-for-it-pros.md) diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md index 0ee1248e7e..07bb63b78d 100644 --- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md +++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md @@ -8,15 +8,15 @@ manager: aaroncz ms.author: frankroj ms.topic: article ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # Configure a PXE server to load Windows PE -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 This walkthrough describes how to configure a PXE server to load Windows PE by booting a client computer from the network. Using the Windows PE tools and a Windows 10 image file, you can install Windows 10 from the network. @@ -37,107 +37,119 @@ All four of the roles specified above can be hosted on the same computer or each 3. Run the following command to copy the base Windows PE files into a new folder. The script requires two arguments: hardware architecture and destination location. The value of **<architecture>** can be **x86**, **amd64**, or **arm** and **<destination>** is a path to a local directory. If the directory doesn't already exist, it will be created. - ``` + ```cmd copype.cmd ``` For example, the following command copies **amd64** architecture files to the **C:\winpe_amd64** directory: - ``` + ```cmd copype.cmd amd64 C:\winpe_amd64 ``` The script creates the destination directory structure and copies all the necessary files for that architecture. In the previous example, the following directories are created: - - ``` + + ```cmd C:\winpe_amd64 C:\winpe_amd64\fwfiles C:\winpe_amd64\media C:\winpe_amd64\mount ``` + 4. Mount the base Windows PE image (winpe.wim) to the \mount directory using the DISM tool. Mounting an image file unpacks the file contents into a folder so that you can make changes directly or by using tools such as DISM. See the following example. + ```cmd + dism.exe /mount-image /imagefile:c:\winpe_amd64\media\sources\boot.wim /index:1 /mountdir:C:\winpe_amd64\mount ``` - Dism /mount-image /imagefile:c:\winpe_amd64\media\sources\boot.wim /index:1 /mountdir:C:\winpe_amd64\mount - ``` - Verify that "The operation completed successfully" is displayed. Note: To view currently mounted images, type **dism /get-MountedWiminfo**. + + Verify that "The operation completed successfully" is displayed. Note: To view currently mounted images, type **dism /get-MountedWiminfo**. 5. Map a network share to the root TFTP directory on the PXE/TFTP server and create a \Boot folder. Consult your TFTP server documentation to determine the root TFTP server directory, then enable sharing for this directory, and verify it can be accessed on the network. In the following example, the PXE server name is PXE-1 and the TFTP root directory is shared using a network path of **\\\PXE-1\TFTPRoot**: - ``` - net use y: \\PXE-1\TFTPRoot + ```cmd + net.exe use y: \\PXE-1\TFTPRoot y: md Boot ``` + 6. Copy the PXE boot files from the mounted directory to the \boot folder. For example: - ``` + ```cmd copy c:\winpe_amd64\mount\windows\boot\pxe\*.* y:\Boot ``` -7. Copy the boot.sdi file to the PXE/TFTP server. - ``` +7. Copy the boot.sdi file to the PXE/TFTP server. + + ```cmd copy C:\winpe_amd64\media\boot\boot.sdi y:\Boot ``` -8. Copy the bootable Windows PE image (boot.wim) to the \boot folder. - ``` +8. Copy the bootable Windows PE image (boot.wim) to the \boot folder. + + ```cmd copy C:\winpe_amd64\media\sources\boot.wim y:\Boot ``` + 9. (Optional) Copy true type fonts to the \boot folder - ``` + ```cmd copy C:\winpe_amd64\media\Boot\Fonts y:\Boot\Fonts ``` ## Step 2: Configure boot settings and copy the BCD file -1. Create a BCD store using bcdedit.exe: +1. Create a BCD store using bcdedit.exe: + ```cmd + bcdedit.exe /createstore c:\BCD ``` - bcdedit /createstore c:\BCD - ``` -2. Configure RAMDISK settings: +2. Configure RAMDISK settings: + + ```cmd + bcdedit.exe /store c:\BCD /create {ramdiskoptions} /d "Ramdisk options" + bcdedit.exe /store c:\BCD /set {ramdiskoptions} ramdisksdidevice boot + bcdedit.exe /store c:\BCD /set {ramdiskoptions} ramdisksdipath \Boot\boot.sdi + bcdedit.exe /store c:\BCD /create /d "winpe boot image" /application osloader ``` - bcdedit /store c:\BCD /create {ramdiskoptions} /d "Ramdisk options" - bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdidevice boot - bcdedit /store c:\BCD /set {ramdiskoptions} ramdisksdipath \Boot\boot.sdi - bcdedit /store c:\BCD /create /d "winpe boot image" /application osloader - ``` + The last command will return a GUID, for example: - ``` + + ```console The entry {a4f89c62-2142-11e6-80b6-00155da04110} was successfully created. ``` + Copy this GUID for use in the next set of commands. In each command shown, replace "GUID1" with your GUID. -3. Create a new boot application entry for the Windows PE image: +3. Create a new boot application entry for the Windows PE image: + ```cmd + bcdedit.exe /store c:\BCD /set {GUID1} device ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} + bcdedit.exe /store c:\BCD /set {GUID1} path \windows\system32\winload.exe + bcdedit.exe /store c:\BCD /set {GUID1} osdevice ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} + bcdedit.exe /store c:\BCD /set {GUID1} systemroot \windows + bcdedit.exe /store c:\BCD /set {GUID1} detecthal Yes + bcdedit.exe /store c:\BCD /set {GUID1} winpe Yes ``` - bcdedit /store c:\BCD /set {GUID1} device ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} - bcdedit /store c:\BCD /set {GUID1} path \windows\system32\winload.exe - bcdedit /store c:\BCD /set {GUID1} osdevice ramdisk=[boot]\Boot\boot.wim,{ramdiskoptions} - bcdedit /store c:\BCD /set {GUID1} systemroot \windows - bcdedit /store c:\BCD /set {GUID1} detecthal Yes - bcdedit /store c:\BCD /set {GUID1} winpe Yes - ``` -4. Configure BOOTMGR settings (remember to replace GUID1 in the third command with your GUID): - ``` - bcdedit /store c:\BCD /create {bootmgr} /d "boot manager" - bcdedit /store c:\BCD /set {bootmgr} timeout 30 - bcdedit /store c:\BCD -displayorder {GUID1} -addlast - ``` -5. Copy the BCD file to your TFTP server: +4. Configure BOOTMGR settings (remember to replace GUID1 in the third command with your GUID): + ```cmd + bcdedit.exe /store c:\BCD /create {bootmgr} /d "boot manager" + bcdedit.exe /store c:\BCD /set {bootmgr} timeout 30 + bcdedit.exe /store c:\BCD -displayorder {GUID1} -addlast ``` + +5. Copy the BCD file to your TFTP server: + + ```cmd copy c:\BCD \\PXE-1\TFTPRoot\Boot\BCD ``` -Your PXE/TFTP server is now configured. You can view the BCD settings that have been configured using the command bcdedit /store <BCD file location> /enum all. See the following example. Note: Your GUID will be different than the one shown below. +Your PXE/TFTP server is now configured. You can view the BCD settings that have been configured using the command bcdedit.exe /store <BCD file location> /enum all. See the following example. Note: Your GUID will be different than the one shown below. -``` -C:\>bcdedit /store C:\BCD /enum all +```cmd +C:\>bcdedit.exe /store C:\BCD /enum all Windows Boot Manager -------------------- identifier {bootmgr} @@ -164,24 +176,45 @@ ramdisksdipath \Boot\boot.sdi ``` >[!TIP] ->If you start the PXE boot process, but receive the error that "The boot configuration data for your PC is missing or contains errors" then verify that \\boot directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different. +>If you start the PXE boot process, but receive the error **The boot configuration data for your PC is missing or contains error**, then verify that `\boot` directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different. ## PXE boot process summary The following process summarizes the PXE client boot. ->The following assumes that you have configured DHCP option 67 (Bootfile Name) to "boot\PXEboot.n12" which enables direct boot to PXE with no user interaction. For more information about DHCP options for network boot, see [Managing Network Boot Programs](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732351(v=ws.10)). + + +> [!NOTE] +> The following assumes that the client and PXE server are on the same network/subnet/vlan or that PXE requests have been appropriately forwarded from the client to the PXE server using IP helpers configured in the router or switch. For more information about IP helpers, see [Configuring Your Router to Forward Broadcasts](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732351(v=ws.10)#configuring-your-router-to-forward-broadcasts-recommended). + +1. A client contacts the PXE server. When the client is on a different network/subnet/vlan as the PXE server, the client is routed to the PXE server using the IP helpers. + +2. The PXE server sends DHCP options 060 (client identifier **PXEClient**), 066 (boot server host name) and 067 (boot file name) to the client. + +3. The client downloads `boot\PXEboot.n12` from the TFTP server based on DHCP option 067 boot file name value received from the PXE server. + +4. `PXEboot.n12` immediately begins a network boot. + +5. The client downloads `boot\bootmgr.exe` and the `boot\BCD` file from the TFTP server. + + > [!NOTE] + > The BCD store must reside in the `\boot` directory on the TFTP server and must be named BCD. + +6. `Bootmgr.exe` reads the BCD operating system entries and downloads `boot\boot.sdi` and the Windows PE image (`boot\boot.wim`). Optional files that can also be downloaded include true type fonts (`boot\Fonts\wgl4_boot.ttf`) and the hibernation state file (`\hiberfil.sys`) if these files are present. + +7. `Bootmgr.exe` starts Windows PE by calling `winload.exe` within the Windows PE image. + +8. Windows PE loads, a command prompt opens and `wpeinit.exe` is run to initialize Windows PE. + +9. The Windows PE client provides access to tools like `imagex.exe`, `diskpart.exe`, and `bcdboot.exe` using the Windows PE command prompt. With the help of these tools accompanied by a Windows 10 image file, the destination computer can be formatted properly to load a full Windows 10 operating system. + +### Related articles [Windows PE Walkthroughs](/previous-versions/windows/it-pro/windows-vista/cc748899(v=ws.10)) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index b3dd2899ed..cc2f4777f2 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -10,9 +10,9 @@ ms.localizationpriority: medium ms.topic: how-to ms.collection: highpri appliesto: - - ✅ Windows 10 - - ✅ Windows 11 -ms.date: 10/31/2022 + - Windows 10 + - Windows 11 +ms.date: 11/23/2022 --- # Deploy Windows Enterprise licenses @@ -252,7 +252,7 @@ Use the following procedures to review whether a particular device meets these r To determine if the computer has a firmware-embedded activation key, enter the following command at an elevated Windows PowerShell prompt: -```PowerShell +```powershell (Get-CimInstance -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey ``` diff --git a/windows/deployment/deploy-m365.md b/windows/deployment/deploy-m365.md index f7574e0d11..ace17b1b9f 100644 --- a/windows/deployment/deploy-m365.md +++ b/windows/deployment/deploy-m365.md @@ -10,15 +10,15 @@ author: frankroj ms.topic: article ms.collection: M365-modern-desktop ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # Deploy Windows 10 with Microsoft 365 -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 This article provides a brief overview of Microsoft 365 and describes how to use a free 90-day trial account to review some of the benefits of Microsoft 365. @@ -34,38 +34,40 @@ For Windows 10 deployment, Microsoft 365 includes a fantastic deployment advisor ## Free trial account -**If you already have a Microsoft services subscription account and access to the Microsoft 365 Admin Center** +### If you already have a Microsoft services subscription account and access to the Microsoft 365 Admin Center From the [Microsoft 365 Admin Center](https://portal.office.com), go to Billing and then Purchase services. In the Enterprise Suites section of the service offerings, you'll find Microsoft 365 E3 and Microsoft 365 E5 tiles. There are "Start Free Trial" options available for your selection by hovering your mouse over the tiles. -**If you do not already have a Microsoft services subscription** +### If you do not already have a Microsoft services subscription -You can check out the Microsoft 365 deployment advisor and other resources for free! Just follow the steps below. +You can check out the Microsoft 365 deployment advisor and other resources for free! Just follow the steps below. ->[!NOTE] ->If you have not run a setup guide before, you will see the **Prepare your environment** guide first. This is to make sure you have basics covered like domain verification and a method for adding users. At the end of the "Prepare your environment" guide, there will be a **Ready to continue** button that sends you to the original guide that was selected. +> [!NOTE] +> If you have not run a setup guide before, you will see the **Prepare your environment** guide first. This is to make sure you have basics covered like domain verification and a method for adding users. At the end of the "Prepare your environment" guide, there will be a **Ready to continue** button that sends you to the original guide that was selected. 1. [Obtain a free Microsoft 365 trial](/microsoft-365/commerce/try-or-buy-microsoft-365). 2. Check out the [Microsoft 365 deployment advisor](https://aka.ms/microsoft365setupguide). -3. Also check out the [Windows Analytics deployment advisor](/mem/configmgr/desktop-analytics/overview). This advisor will walk you through deploying [Desktop Analytics](/mem/configmgr/desktop-analytics/overview). +3. Also check out the [Windows Analytics deployment advisor](/mem/configmgr/desktop-analytics/overview). This advisor will walk you through deploying [Desktop Analytics](/mem/configmgr/desktop-analytics/overview). Examples of these two deployment advisors are shown below. - [Deploy Windows 10 with Microsoft 365](#deploy-windows-10-with-microsoft-365) - [Free trial account](#free-trial-account) + - [If you already have a Microsoft services subscription account and access to the Microsoft 365 Admin Center](#if-you-already-have-a-microsoft-services-subscription-account-and-access-to-the-microsoft-365-admin-center) + - [If you do not already have a Microsoft services subscription](#if-you-do-not-already-have-a-microsoft-services-subscription) - [Microsoft 365 deployment advisor example](#microsoft-365-deployment-advisor-example) - [Windows Analytics deployment advisor example](#windows-analytics-deployment-advisor-example) - [Microsoft 365 Enterprise poster](#microsoft-365-enterprise-poster) - [Related articles](#related-articles) ## Microsoft 365 deployment advisor example + ![Microsoft 365 deployment advisor.](images/m365da.png) ## Windows Analytics deployment advisor example - ## Microsoft 365 Enterprise poster [![Microsoft 365 Enterprise poster.](images/m365e.png)](https://aka.ms/m365eposter) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 170984a53f..f838e4e172 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -15,7 +15,8 @@ ms.technology: itpro-deploy # What's new in Windows client deployment -**Applies to:** +*Applies to:* + - Windows 10 - Windows 11 @@ -30,13 +31,14 @@ When you deploy Windows 11 with Autopilot, you can enable users to view addition ## Windows 11 Check out the following new articles about Windows 11: + - [Overview of Windows 11](/windows/whats-new/windows-11) - [Plan for Windows 11](/windows/whats-new/windows-11-plan) - [Prepare for Windows 11](/windows/whats-new/windows-11-prepare) The [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is available.
-## Deployment tools +## Deployment tools [SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later, and Windows 11.
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
@@ -51,6 +53,7 @@ The [Modern Desktop Deployment Center](/microsoft-365/enterprise/desktop-deploym ## Microsoft 365 Microsoft 365 is a new offering from Microsoft that combines + - Windows 10 - Office 365 - Enterprise Mobility and Security (EMS). @@ -68,6 +71,7 @@ Windows PowerShell cmdlets for Delivery Optimization have been improved: - **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to help in troubleshooting. Other improvements in [Delivery Optimization](./do/waas-delivery-optimization.md) include: + - Enterprise network [throttling is enhanced](/windows-insider/archive/new-for-business#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling. - Automatic cloud-based congestion detection is available for PCs with cloud service support. - Improved peer efficiency for enterprises and educational institutions with complex networks is enabled with [new policies](/windows/client-management/mdm/policy-csp-deliveryoptimization). These policies now support Microsoft 365 Apps for enterprise updates and Intune content. @@ -84,6 +88,7 @@ The following Delivery Optimization policies are removed in the Windows 10, vers ### Windows Update for Business [Windows Update for Business](./update/waas-manage-updates-wufb.md) enhancements in this release include: + - Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. - Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we've created a new policy that enables admins to opt devices out of the built-in safeguard holds. diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md index 873c456881..52315a8851 100644 --- a/windows/deployment/deploy-windows-to-go.md +++ b/windows/deployment/deploy-windows-to-go.md @@ -13,9 +13,9 @@ ms.date: 10/31/2022 # Deploy Windows To Go in your organization -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 This article helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you've reviewed the articles [Windows To Go: feature overview](planning/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](planning/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this article to start your Windows To Go deployment. @@ -26,15 +26,15 @@ This article helps you to deploy Windows To Go in your organization. Before you The below list is items that you should be aware of before you start the deployment process: -* Only use recommended USB drives for Windows To Go. Use of other drives isn't supported. Check the list at [Windows To Go: feature overview](planning/windows-to-go-overview.md) for the latest USB drives certified for use as Windows To Go drives. +- Only use recommended USB drives for Windows To Go. Use of other drives isn't supported. Check the list at [Windows To Go: feature overview](planning/windows-to-go-overview.md) for the latest USB drives certified for use as Windows To Go drives. -* After you provision a new workspace, always eject a Windows To Go drive using the **Safely Remove Hardware and Eject Media** control that can be found in the notification area or in Windows Explorer. Removing the drive from the USB port without ejecting it first can cause the drive to become corrupted. +- After you provision a new workspace, always eject a Windows To Go drive using the **Safely Remove Hardware and Eject Media** control that can be found in the notification area or in Windows Explorer. Removing the drive from the USB port without ejecting it first can cause the drive to become corrupted. -* When running a Windows To Go workspace, always shut down the workspace before unplugging the drive. +- When running a Windows To Go workspace, always shut down the workspace before unplugging the drive. -* Configuration Manager SP1 and later includes support for user self-provisioning of Windows To Go drives. For more information on this deployment option, see [How to Provision Windows To Go in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/jj651035(v=technet.10)). +- Configuration Manager SP1 and later includes support for user self-provisioning of Windows To Go drives. For more information on this deployment option, see [How to Provision Windows To Go in Configuration Manager](/previous-versions/system-center/system-center-2012-R2/jj651035(v=technet.10)). -* If you're planning on using a USB drive duplicator to duplicate Windows To Go drives, don't configure offline domain join or BitLocker on the drive. +- If you're planning on using a USB drive duplicator to duplicate Windows To Go drives, don't configure offline domain join or BitLocker on the drive. ## Basic deployment steps @@ -42,15 +42,15 @@ Unless you're using a customized operating system image, your initial Windows To Completing these steps will give you a generic Windows To Go drive that can be distributed to your users and then customized for their usage as needed. This drive is also appropriate for use with USB drive duplicators. Your specific deployment scenarios will involve more than just these basic steps but these additional deployment considerations are similar to traditional PC deployment and can be incorporated into your Windows To Go deployment plan. For more information, see [Windows Deployment Options](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825230(v=win.10)). ->[!WARNING] ->If you plan to use the generic Windows To Go drive as the master drive in a USB duplicator, the drive should not be booted. If the drive has been booted inadvertently it should be reprovisioned prior to duplication. +> [!WARNING] +> If you plan to use the generic Windows To Go drive as the master drive in a USB duplicator, the drive should not be booted. If the drive has been booted inadvertently it should be reprovisioned prior to duplication. ### Create the Windows To Go workspace In this step we're creating the operating system image that will be used on the Windows To Go drives. You can use the Windows To Go Creator Wizard or you can [do this manually](/previous-versions/windows/it-pro/windows-8.1-and-8/jj721578(v=ws.11)) using a combination of Windows PowerShell and command-line tools. ->[!WARNING] ->The preferred method to create a single Windows To Go drive is to use the Windows To Go Creator Wizard included in Windows 10 Enterprise and Windows 10 Education. +> [!WARNING] +> The preferred method to create a single Windows To Go drive is to use the Windows To Go Creator Wizard included in Windows 10 Enterprise and Windows 10 Education. #### To create a Windows To Go workspace with the Windows To Go Creator Wizard @@ -58,37 +58,31 @@ In this step we're creating the operating system image that will be used on the 2. Insert the USB drive that you want to use as your Windows To Go drive into your PC. -3. Verify that the .wim file location (which can be a network share, a DVD, or a USB drive) is accessible and that it contains a valid Windows 10 Enterprise or Windows 10 Education image that has been generalized using sysprep. Many environments can use the same image for both Windows To Go and desktop deployments. +3. Verify that the `.wim` file location (which can be a network share, a DVD, or a USB drive) is accessible and that it contains a valid Windows 10 Enterprise or Windows 10 Education image that has been generalized using sysprep. Many environments can use the same image for both Windows To Go and desktop deployments. - >[!NOTE] - >For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824929(v=win.10)). For more information about using sysprep, see [Sysprep Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825209(v=win.10)). + > [!NOTE] + > For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824929(v=win.10)). For more information about using sysprep, see [Sysprep Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825209(v=win.10)). -4. Using Cortana, search for **Windows To Go** and then press **Enter**. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. The **Windows To Go Creator Wizard** opens. +4. Search for **Windows To Go** and then press **Enter**. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. The **Windows To Go Creator Wizard** opens. 5. On the **Choose the drive you want to use** page select the drive that represents the USB drive you inserted previously, then select **Next.** -6. On the **Choose a Windows image** page, select **Add Search Location** and then navigate to the .wim file location and select select folder. The wizard will display the installable images present in the folder; select the Windows 10 Enterprise or Windows 10 Education image you wish to use and then select **Next**. +6. On the **Choose a Windows image** page, select **Add Search Location** and then navigate to the `.wim` file location and select select folder. The wizard will display the installable images present in the folder; select the Windows 10 Enterprise or Windows 10 Education image you wish to use and then select **Next**. -7. (Optional) On the **Set a BitLocker password (optional)** page, you can select **Use BitLocker with my Windows To Go Workspace** to encrypt your Windows To Go drive. If you don't wish to encrypt the drive at this time, select **Skip**. If you decide you want to add BitLocker protection later, see [Enable BitLocker protection for your Windows To Go drive](/previous-versions/windows/it-pro/windows-8.1-and-8/jj721578(v=ws.11)) for instructions. -r +7. (Optional) On the **Set a BitLocker password (optional)** page, you can select **Use BitLocker with my Windows To Go Workspace** to encrypt your Windows To Go drive. If you don't wish to encrypt the drive at this time, select **Skip**. If you decide you want to add BitLocker protection later, for instructions see [Enable BitLocker protection for your Windows To Go drive](/previous-versions/windows/it-pro/windows-8.1-and-8/jj721578(v=ws.11)). - >[!WARNING] - >If you plan to use a USB-Duplicator to create multiple Windows To Go drives, do not enable BitLocker. Drives protected with BitLocker should not be duplicated. + > [!WARNING] + > If you plan to use a USB-Duplicator to create multiple Windows To Go drives, do not enable BitLocker. Drives protected with BitLocker should not be duplicated. - If you choose to encrypt the Windows To Go drive now: + If you choose to encrypt the Windows To Go drive now, enter a password that is at least eight characters long and conforms to your organizations password complexity policy. This password will be provided before the operating system is started so any characters you use must be able to be interpreted by the firmware. Some firmware doesn't support non-ASCII characters. - - Type a password that is at least eight characters long and conforms to your organizations password complexity policy. This password will be provided before the operating system is started so any characters you use must be able to be interpreted by the firmware. Some firmware doesn't support non-ASCII characters. - - -~~~ - >[!IMPORTANT] - >The BitLocker recovery password will be saved in the documents library of the computer used to create the workspace automatically. If your organization is using Active Directory Domain Services (AD DS) to store recovery passwords it will also be saved in AD DS under the computer account of the computer used to create the workspace. This password will be used only if you need to recover access to the drive because the BitLocker password specified in the previous step is not available, such as if a password is lost or forgotten. For more information about BitLocker and AD DS, see [Active Directory Domain Services considerations](/previous-versions/windows/it-pro/windows-8.1-and-8/jj592683(v=ws.11)). -~~~ + > [!IMPORTANT] + > The BitLocker recovery password will be saved in the documents library of the computer used to create the workspace automatically. If your organization is using Active Directory Domain Services (AD DS) to store recovery passwords it will also be saved in AD DS under the computer account of the computer used to create the workspace. This password will be used only if you need to recover access to the drive because the BitLocker password specified in the previous step is not available, such as if a password is lost or forgotten. For more information about BitLocker and AD DS, see [Active Directory Domain Services considerations](/previous-versions/windows/it-pro/windows-8.1-and-8/jj592683(v=ws.11)). 8. Verify that the USB drive inserted is the one you want to provision for Windows To Go and then select **Create** to start the Windows To Go workspace creation process. - >[!WARNING] - >The USB drive identified will be reformatted as part of the Windows To Go provisioning process and any data on the drive will be erased. + > [!WARNING] + > The USB drive identified will be reformatted as part of the Windows To Go provisioning process and any data on the drive will be erased. 9. Wait for the creation process to complete, which can take 20 to 30 minutes. A completion page will be displayed that tells you when your Windows To Go workspace is ready to use. From the completion page, you can configure the Windows To Go startup options to configure the current computer as a Windows To Go host computer. @@ -98,11 +92,15 @@ Your Windows To Go workspace is now ready to be started. You can now [prepare a The following Windows PowerShell cmdlet or cmdlets perform the same function as the preceding procedure. Enter each cmdlet on a single line, even though they may appear word-wrapped across several lines here because of formatting constraints. This procedure can only be used on PCs that are running Windows 10. Before starting, ensure that only the USB drive that you want to provision as a Windows To Go drive is connected to the PC. -1. Using Cortana, search for **powershell**, right-click **Windows PowerShell**, and then select **Run as administrator**. +1. Search for **powershell**, right-click **Windows PowerShell**, and then select **Run as administrator**. -2. In the Windows PowerShell session type, the following commands to partition a master boot record (MBR) disk for use with a FAT32 system partition and an NTFS-formatted operating system partition. This disk layout can support computers that use either UEFI or BIOS firmware: +2. In the Windows PowerShell session, enter the following commands to partition a master boot record (MBR) disk for use with a FAT32 system partition and an NTFS-formatted operating system partition. This disk layout can support computers that use either UEFI or BIOS firmware: - ``` +
+
+ Expand to show PowerShell commands to partition an MBR disk + + ```powershell # The following command will set $Disk to all USB drives with >20 GB of storage $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } @@ -136,27 +134,31 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE ``` +
+ 3. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows) command-line tool (DISM): >[!TIP] - >The index number must be set correctly to a valid Enterprise image in the .WIM file. + >The index number must be set correctly to a valid Enterprise image in the `.WIM` file. - ``` + ```cmd #The WIM file must contain a sysprep generalized image. - dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ + dism.exe /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ ``` -4. Now use the [bcdboot](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824874(v=win.10)) command line tool to move the necessary boot components to the system partition on the disk. This helps ensure that the boot components, operating system versions, and architectures match. The `/f ALL` parameter indicates that boot components for UEFI and BIOS should be placed on the system partition of the disk. The following example illustrates this step: +4. Now use the [bcdboot](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824874(v=win.10)) command line tool to move the necessary boot components to the system partition on the disk. This helps ensure that the boot components, operating system versions, and architectures match. The `/f ALL` parameter indicates that boot components for UEFI and BIOS should be placed on the system partition of the disk. The following example illustrates this step: -~~~ -``` -W:\Windows\System32\bcdboot W:\Windows /f ALL /s S: -``` -~~~ + ```cmd + W:\Windows\System32\bcdboot.exe W:\Windows /f ALL /s S: + ``` 5. Apply SAN policy—OFFLINE\_INTERNAL - "4" to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: - ``` +
+
+ Expand to show example san_policy.xml file + + ```xml @@ -186,15 +188,21 @@ W:\Windows\System32\bcdboot W:\Windows /f ALL /s S: ``` +
+ 6. Place the **san\_policy.xml** file created in the previous step into the root directory of the Windows partition on the Windows To Go drive (W: from the previous examples) and run the following command: - ``` + ```cmd Dism.exe /Image:W:\ /Apply-Unattend:W:\san_policy.xml ``` 7. Create an answer file (unattend.xml) that disables the use of Windows Recovery Environment with Windows To Go. You can use the following code sample to create a new answer file or you can paste it into an existing answer file: - ``` +
+
+ Expand to show example san_policy.xml file + + ```xml @@ -218,10 +226,12 @@ W:\Windows\System32\bcdboot W:\Windows /f ALL /s S: ``` - After the answer file has been saved, copy unattend.xml into the sysprep folder on the Windows To Go drive (for example, W:\\Windows\\System32\\sysprep\) +
+ + After the answer file has been saved, copy `unattend.xml` into the sysprep folder on the Windows To Go drive (for example, `W:\Windows\System32\sysprep\`) >[!IMPORTANT] - >Setup unattend files are processed based on their location. Setup will place a temporary unattend file into the **%systemroot%\\panther** folder which is the first location that setup will check for installation information. You should make sure that folder does not contain a previous version of an unattend.xml file to ensure that the one you just created is used. + >Setup unattend files are processed based on their location. Setup will place a temporary unattend file into the **`%systemroot%\panther`** folder which is the first location that setup will check for installation information. You should make sure that folder does not contain a previous version of an unattend.xml file to ensure that the one you just created is used. If you don't wish to boot your Windows To Go device on this computer and want to remove it to boot it on another PC, be sure to use the **Safely Remove Hardware and Eject Media** option to safely disconnect the drive before physically removing it from the PC. @@ -238,7 +248,7 @@ If you want to use the Windows To Go workspace, shut down the computer, plug in To set the Windows To Go Startup options for host computers running Windows 10: -1. Using Cortana, search for **Windows To Go startup options** and then press **Enter**. +1. Search for **Windows To Go startup options** and then press **Enter**. 2. In the **Windows To Go Startup Options** dialog box, select **Yes**, and then select **Save Changes** to configure the computer to boot from USB @@ -250,7 +260,7 @@ For host computers running Windows 8 or Windows 8.1: You can configure your organization's computers to automatically start from the USB drive by enabling the following Group Policy setting: -**\\\\Computer Configuration\\Administrative Templates\\Windows Components\\Portable Operating System\\Windows To Go Default Startup Options** +**Computer Configuration** > **Administrative Templates** > **Windows Components** > **Portable Operating System** > **Windows To Go Default Startup Options** After this policy setting is enabled, automatic starting of a Windows To Go workspace will be attempted when a USB drive is connected to the computer when it's started. Users won't be able to use the Windows To Go Startup Options to change this behavior. If you disable this policy setting, booting to Windows To Go when a USB drive is connected won't occur unless a user configures the option manually in the firmware. If you don't configure this policy setting, users who are members of the Administrators group can enable or disable booting from a USB drive using the Windows To Go Startup Options. @@ -260,13 +270,13 @@ Your host computer is now ready to boot directly into Windows To Go workspace wh After you've configured your host PC to boot from USB, you can use the following procedure to boot your Windows To Go workspace: -**To boot your workspace** +**To boot your workspace:** -1. Make sure that the host PC isn't in a sleep state. If the computer is in a sleep state, either shut it down or hibernate it. +1. Make sure that the host PC isn't in a sleep state. If the computer is in a sleep state, either shut it down or hibernate it. -2. Insert the Windows To Go USB drive directly into a USB 3.0 or USB 2.0 port on the PC. Don't use a USB hub or extender. +2. Insert the Windows To Go USB drive directly into a USB 3.0 or USB 2.0 port on the PC. Don't use a USB hub or extender. -3. Turn on the PC. If your Windows To Go drive is protected with BitLocker you'll be asked to type the password, otherwise the workspace will boot directly into the Windows To Go workspace. +3. Turn on the PC. If your Windows To Go drive is protected with BitLocker you'll be asked to type the password, otherwise the workspace will boot directly into the Windows To Go workspace. ## Advanced deployment steps @@ -276,26 +286,26 @@ The following steps are used for more advanced deployments where you want to hav Making sure that Windows To Go workspaces are effective when used off premises is essential to a successful deployment. One of the key benefits of Windows To Go is the ability for your users to use the enterprise managed domain joined workspace on an unmanaged computer that is outside your corporate network. To enable this usage, typically you would provision the USB drive as described in the basic deployment instructions and then add the configuration to support domain joining of the workspace, installation of any line-of-business applications, and configuration of your chosen remote connectivity solution such as a virtual private network client or DirectAccess. Once these configurations have been performed the user can work from the workspace using a computer that is off-premises. The following procedure allows you to provision domain joined Windows To Go workspaces for workers that don't have physical access to your corporate network. -**Prerequisites for remote access scenario** +**Prerequisites for remote access scenario:** -- A domain-joined computer running Windows 8 or later and is configured as a Windows To Go host computer +- A domain-joined computer running Windows 8 or later and is configured as a Windows To Go host computer -- A Windows To Go drive that hasn't been booted or joined to the domain using unattend settings. +- A Windows To Go drive that hasn't been booted or joined to the domain using unattend settings. -- A domain user account with rights to add computer accounts to the domain and is a member of the Administrator group on the Windows To Go host computer +- A domain user account with rights to add computer accounts to the domain and is a member of the Administrator group on the Windows To Go host computer -- [DirectAccess](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831539(v=ws.11)) configured on the domain +- [DirectAccess](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831539(v=ws.11)) configured on the domain -**To configure your Windows To Go workspace for remote access** +**To configure your Windows To Go workspace for remote access:** 1. Start the host computer and sign in using a user account with privileges to add workstations to the domain and then run the following command from an elevated command prompt replacing the example placeholder parameters (denoted by <>) with the ones applicable for your environment: - ``` - djoin /provision /domain /machine /certtemplate /policynames /savefile /reuse + ```cmd + djoin.exe /provision /domain /machine /certtemplate /policynames /savefile /reuse ``` - >[!NOTE] - >The **/certtemplate** parameter supports the use of certificate templates for distributing certificates for DirectAccess, if your organization is not using certificate templates you can omit this parameter. Additionally, if are using djoin.exe with Windows Server 2008-based Domain Controllers, append the /downlevel switch during provisioning. For more information, see the [Offline Domain Join Step-by-Step guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd392267(v=ws.10)). + > [!NOTE] + > The **/certtemplate** parameter supports the use of certificate templates for distributing certificates for DirectAccess, if your organization is not using certificate templates you can omit this parameter. Additionally, if are using `djoin.exe` with Windows Server 2008-based Domain Controllers, append the /downlevel switch during provisioning. For more information, see the [Offline Domain Join Step-by-Step guide](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd392267(v=ws.10)). 2. Insert the Windows To Go drive. @@ -303,7 +313,11 @@ Making sure that Windows To Go workspaces are effective when used off premises i 4. From the Windows PowerShell command prompt run: - ``` +
+
+ Expand this section to show PowerShell commands to run + + ```powershell # The following command will set $Disk to all USB drives with >20 GB of storage $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } @@ -337,27 +351,31 @@ Making sure that Windows To Go workspaces are effective when used off premises i Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE ``` +
+ 5. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows) command-line tool (DISM): -~~~ ->[!TIP] ->The index number must be set correctly to a valid Enterprise image in the .WIM file. + ```cmd + #The WIM file must contain a sysprep generalized image. + dism.exe /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ + ``` -``` -#The WIM file must contain a sysprep generalized image. -dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ -``` -~~~ + > [!TIP] + > The index number must be set correctly to a valid Enterprise image in the `.WIM` file. 6. After those commands have completed, run the following command: - ``` - djoin /requestodj /loadfile C:\example\path\domainmetadatafile /windowspath W:\Windows + ```cmd + djoin.exe /requestodj /loadfile C:\example\path\domainmetadatafile /windowspath W:\Windows ``` 7. Next, we'll need to edit the unattend.xml file to configure the first run (OOBE) settings. In this example we're hiding the Microsoft Software License Terms (EULA) page, configuring automatic updates to install important and recommended updates automatically, and identifying this workspace as part of a private office network. You can use other OOBE settings that you've configured for your organization if desired. For more information about the OOBE settings, see [OOBE](/previous-versions/windows/it-pro/windows-8.1-and-8/ff716016(v=win.10)): - ``` +
+
+ Expand this section to show example unattend.xml file + + ```xml @@ -391,16 +409,18 @@ dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /ind ``` +
+ 8. Safely remove the Windows To Go drive. 9. From a host computer, either on or off premises, start the computer and boot the Windows To Go workspace. - * If on premises using a host computer with a direct network connection, sign on using your domain credentials. + - If on premises using a host computer with a direct network connection, sign on using your domain credentials. - * If off premises, join a wired or wireless network with internet access and then sign on again using your domain credentials. + - If off premises, join a wired or wireless network with internet access and then sign on again using your domain credentials. - >[!NOTE] - >Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain. + > [!NOTE] + > Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain. You should now be able to access your organization's network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. @@ -410,17 +430,23 @@ Enabling BitLocker on your Windows To Go drive will help ensure that your data i #### Prerequisites for enabling BitLocker scenario -* A Windows To Go drive that can be successfully provisioned. +- A Windows To Go drive that can be successfully provisioned. -* A computer running Windows 8 configured as a Windows To Go host computer +- A computer running Windows 8 configured as a Windows To Go host computer -* Review the following Group Policy settings for BitLocker Drive Encryption and modify the configuration as necessary: +- Review the following Group Policy settings for BitLocker Drive Encryption and modify the configuration as necessary: - **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Require additional authentication at startup**. This policy allows the use of a password key protector with an operating system drive; this policy must be enabled to configure BitLocker from within the Windows To Go workspace. This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you're using BitLocker with or without a Trusted Platform Module (TPM). You must enable this setting and select the **Allow BitLocker without a compatible TPM** check box and then enable the **Configure use of passwords for operating system drives** setting. + - **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** - **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Configure use of passwords for operating system drives**. This policy setting enables passwords to be used to unlock BitLocker-protected operating system drives and provides the means to configure complexity and length requirements on passwords for Windows To Go workspaces. For the complexity requirement setting to be effective the Group Policy setting **Password must meet complexity requirements** located in **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** must be also enabled. + This policy allows the use of a password key protector with an operating system drive; this policy must be enabled to configure BitLocker from within the Windows To Go workspace. This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you're using BitLocker with or without a Trusted Platform Module (TPM). You must enable this setting and select the **Allow BitLocker without a compatible TPM** check box and then enable the **Configure use of passwords for operating system drives** setting. - **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Enable use of BitLocker authentication requiring preboot keyboard input on slates**. This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. If this setting isn't enabled, passwords can't be used to unlock BitLocker-protected operating system drives. + - **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Configure use of passwords for operating system drives** + + This policy setting enables passwords to be used to unlock BitLocker-protected operating system drives and provides the means to configure complexity and length requirements on passwords for Windows To Go workspaces. For the complexity requirement setting to be effective the Group Policy setting **Password must meet complexity requirements** located in **Computer Configuration** > **Windows Settings** > **ecurity Settings** > **Account Policies** > **Password Policy** must be also enabled. + + - **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Enable use of BitLocker authentication requiring preboot keyboard input on slates** + + This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. If this setting isn't enabled, passwords can't be used to unlock BitLocker-protected operating system drives. You can choose to enable BitLocker protection on Windows To Go drives before distributing them to users as part of your provisioning process or you can allow your end-users to apply BitLocker protection to them after they have taken possession of the drive. A step-by-step procedure is provided for both scenarios. @@ -432,10 +458,12 @@ Enabling BitLocker after distribution requires that your users turn on BitLocker BitLocker recovery keys are the keys that can be used to unlock a BitLocker protected drive if the standard unlock method fails. It's recommended that your BitLocker recovery keys be backed up to Active Directory Domain Services (AD DS). If you don't want to use AD DS to store recovery keys you can save recovery keys to a file or print them. How BitLocker recovery keys are managed differs depending on when BitLocker is enabled. -- If BitLocker protection is enabled during provisioning, the BitLocker recovery keys will be stored under the computer account of the computer used for provisioning the drives. If backing up recovery keys to AD DS isn't used, the recovery keys will need to be printed or saved to a file for each drive. The IT administrator must track which keys were assigned to which Windows To Go drive. +- If BitLocker protection is enabled during provisioning, the BitLocker recovery keys will be stored under the computer account of the computer used for provisioning the drives. If backing up recovery keys to AD DS isn't used, the recovery keys will need to be printed or saved to a file for each drive. The IT administrator must track which keys were assigned to which Windows To Go drive. -- **Warning** - If BitLocker is enabled after distribution, the recovery key will be backed up to AD DS under the computer account of the workspace. If backing up recovery keys to AD DS isn't used, they can be printed or saved to a file by the user. If the IT administrator wants a central record of recovery keys, a process by which the user provides the key to the IT department must be put in place. +- If BitLocker is enabled after distribution, the recovery key will be backed up to AD DS under the computer account of the workspace. If backing up recovery keys to AD DS isn't used, they can be printed or saved to a file by the user. + + > [!WARNING] + > If backing up recovery keys to AD DS isn't used and the IT administrator wants a central record of recovery keys, a process by which the user provides the key to the IT department must be put in place. #### To enable BitLocker during provisioning @@ -447,10 +475,14 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot 4. Provision the Windows To Go drive using the following cmdlets: - >[!NOTE] - >If you used the [manual method for creating a workspace](/previous-versions/windows/it-pro/windows-8.1-and-8/jj721578(v=ws.11)) you should have already provisioned the Windows To Go drive. If so, you can continue on to the next step. + > [!NOTE] + > If you used the [manual method for creating a workspace](/previous-versions/windows/it-pro/windows-8.1-and-8/jj721578(v=ws.11)) you should have already provisioned the Windows To Go drive. If so, you can continue on to the next step. - ``` +
+
+ Expand this section to show PowerShell commands to run + + ```powershell # The following command will set $Disk to all USB drives with >20 GB of storage $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } @@ -484,25 +516,27 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE ``` +
+ Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows) command-line tool (DISM): >[!TIP] >The index number must be set correctly to a valid Enterprise image in the .WIM file. - ``` + ```cmd #The WIM file must contain a sysprep generalized image. - dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ + dism.exe /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ ``` 5. In the same PowerShell session, use the following cmdlet to add a recovery key to the drive: - ``` + ```powershell $BitlockerRecoveryProtector = Add-BitLockerKeyProtector W: -RecoveryPasswordProtector ``` 6. Next, use the following cmdlets to save the recovery key to a file: - ``` + ```powershell #The BitLocker Recovery key is essential if for some reason you forget the BitLocker password #This recovery key can also be backed up into Active Directory using manage-bde.exe or the #PowerShell cmdlet Backup-BitLockerKeyProtector. @@ -512,35 +546,34 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot 7. Then, use the following cmdlets to add the password as a secure string. If you omit the password the cmdlet will prompt you for the password before continuing the operation: - ``` + ```powershell # Create a variable to store the password $spwd = ConvertTo-SecureString -String -AsplainText -Force Enable-BitLocker W: -PasswordProtector $spwd ``` - >[!WARNING] - >To have BitLocker only encrypt used space on the disk append the parameter `-UsedSpaceOnly` to the `Enable-BitLocker` cmdlet. As data is added to the drive BitLocker will encrypt additional space. Using this parameter will speed up the preparation process as a smaller percentage of the disk will require encryption. If you are in a time critical situation where you cannot wait for encryption to complete you can also safely remove the Windows To Go drive during the encryption process. The next time the drive is inserted in a computer it will request the BitLocker password. Once the password is supplied, the encryption process will continue. If you do this, make sure your users know that BitLocker encryption is still in process and that they will be able to use the workspace while the encryption completes in the background. + > [!WARNING] + > To have BitLocker only encrypt used space on the disk append the parameter `-UsedSpaceOnly` to the `Enable-BitLocker` cmdlet. As data is added to the drive BitLocker will encrypt additional space. Using this parameter will speed up the preparation process as a smaller percentage of the disk will require encryption. If you are in a time critical situation where you cannot wait for encryption to complete you can also safely remove the Windows To Go drive during the encryption process. The next time the drive is inserted in a computer it will request the BitLocker password. Once the password is supplied, the encryption process will continue. If you do this, make sure your users know that BitLocker encryption is still in process and that they will be able to use the workspace while the encryption completes in the background. 8. Copy the numerical recovery password and save it to a file in a safe location. The recovery password will be required if the password is lost or forgotten. - >[!WARNING] - >If the **Choose how BitLocker-protected removable data drives can be recovered** Group Policy setting has been configured to back up recovery information to Active Directory Domain Services, the recovery information for the drive will be stored under the account of the host computer used to apply the recovery key. + > [!WARNING] + > If the **Choose how BitLocker-protected removable data drives can be recovered** Group Policy setting has been configured to back up recovery information to Active Directory Domain Services, the recovery information for the drive will be stored under the account of the host computer used to apply the recovery key. - If you want to have the recovery information stored under the account of the Windows To Go workspace, you can turn BitLocker from within the Windows To Go workspace using the BitLocker Setup Wizard from the BitLocker Control Panel item as described in [To enable BitLocker after distribution](#enable-bitlocker). + If you want to have the recovery information stored under the account of the Windows To Go workspace, you can turn BitLocker from within the Windows To Go workspace using the BitLocker Setup Wizard from the BitLocker Control Panel item as described in [To enable BitLocker after distribution](#to-enable-bitlocker-after-distribution). 9. Safely remove the Windows To Go drive. The Windows To Go drives are now ready to be distributed to users and are protected by BitLocker. When you distribute the drives, make sure the users know the following information: -* Initial BitLocker password that they'll need to boot the drives. +- Initial BitLocker password that they'll need to boot the drives. -* Current encryption status. +- Current encryption status. -* Instructions to change the BitLocker password after the initial boot. +- Instructions to change the BitLocker password after the initial boot. -* Instructions for how to retrieve the recovery password if necessary. These instructions may be a help desk process, an automated password retrieval site, or a person to contact. +- Instructions for how to retrieve the recovery password if necessary. These instructions may be a help desk process, an automated password retrieval site, or a person to contact. - #### To enable BitLocker after distribution 1. Insert your Windows To Go drive into your host computer (that is currently shut down) and then turn on the computer and boot into your Windows To Go workspace @@ -551,8 +584,8 @@ The Windows To Go drives are now ready to be distributed to users and are protec 4. Complete the steps in the **BitLocker Setup Wizard** selecting the password protection option. ->[!NOTE] ->If you have not configured the Group Policy setting **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Require additional authentication at startup** to specify **Allow BitLocker without a compatible TPM** you will not be able to enable BitLocker from within the Windows To Go workspace. +> [!NOTE] +> If you have not configured the Group Policy setting **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Require additional authentication at startup** to specify **Allow BitLocker without a compatible TPM** you will not be able to enable BitLocker from within the Windows To Go workspace. ### Advanced deployment sample script @@ -562,11 +595,11 @@ The sample script creates an unattend file that streamlines the deployment proce #### Prerequisites for running the advanced deployment sample script -* To run this sample script, you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. +- To run this sample script, you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. -* Using offline domain join is required by this script, since the script doesn't create a local administrator user account. However, domain membership will automatically put "Domain admins" into the local administrators group. Review your domain policies. If you're using DirectAccess, you'll need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. +- Using offline domain join is required by this script, since the script doesn't create a local administrator user account. However, domain membership will automatically put "Domain admins" into the local administrators group. Review your domain policies. If you're using DirectAccess, you'll need to modify the `djoin.exe` command to include the `policynames` and potentially the `certtemplate` parameters. -* The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. +- The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. #### To run the advanced deployment sample script @@ -576,7 +609,7 @@ The sample script creates an unattend file that streamlines the deployment proce 3. Configure the PowerShell execution policy. By default PowerShell's execution policy is set to Restricted; that means that scripts won't run until you have explicitly given them permission to. To configure PowerShell's execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: - ``` + ```powershell Set-ExecutionPolicy RemoteSigned ``` @@ -584,14 +617,18 @@ The sample script creates an unattend file that streamlines the deployment proce > [!TIP] > To get online help for any Windows PowerShell cmdlet, whether or not it is installed locally type the following cmdlet, replacing <cmdlet-name> with the name of the cmdlet you want to see the help for: - > + > > `Get-Help -Online` - > + > > This command causes Windows PowerShell to open the online version of the help topic in your default Internet browser. #### Windows To Go multiple drive provisioning sample script -``` +
+
+ Expand this section to view Windows To Go multiple drive provisioning sample script + +```powershell <# .SYNOPSIS Windows To Go multiple drive provisioning sample script. @@ -959,22 +996,23 @@ write-output "Provsioning completed in: $elapsedTime (hh:mm:ss.000)" write-output "" "Provisioning script complete." ``` +
+ ## Considerations when using different USB keyboard layouts with Windows To Go In the PowerShell provisioning script, after the image has been applied, you can add the following commands that will correctly set the keyboard settings. The following example uses the Japanese keyboard layout: -``` - reg load HKLM\WTG-Keyboard ${OSDriveLetter}:\Windows\System32\config\SYSTEM > info.log - reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v LayerDriver /d JPN:kbd106dll /t REG_SZ /f - reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardIdentifier /d PCAT_106KEY /t REG_SZ /f - reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardSubtype /d 2 /t REG_DWORD /f - reg add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardType /d 7 /t REG_DWORD /f - reg unload HKLM\WTG-Keyboard +```cmd +reg.exe load HKLM\WTG-Keyboard ${OSDriveLetter}:\Windows\System32\config\SYSTEM > info.log +reg.exe add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v LayerDriver /d JPN:kbd106dll /t REG_SZ /f +reg.exe add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardIdentifier /d PCAT_106KEY /t REG_SZ /f +reg.exe add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardSubtype /d 2 /t REG_DWORD /f +reg.exe add HKLM\WTG-Keyboard\ControlSet001\Services\i8042prt\Parameters /v OverrideKeyboardType /d 7 /t REG_DWORD /f +reg.exe unload HKLM\WTG-Keyboard ``` ## Related articles - [Windows To Go: feature overview](planning/windows-to-go-overview.md) [Windows 10 forums](https://go.microsoft.com/fwlink/p/?LinkId=618949) diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 5bae3977a7..e30fc24235 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -79,8 +79,8 @@ If any of these checks fails, the conversion won't proceed, and an error will be In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location, **%windir%**. -```console -X:\>mbr2gpt /validate /disk:0 +```cmd +X:\>mbr2gpt.exe /validate /disk:0 MBR2GPT: Attempting to validate disk 0 MBR2GPT: Retrieving layout of disk MBR2GPT: Validating layout, disk sector size is: 512 @@ -100,8 +100,8 @@ In the following example: As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. -```console -X:\>DiskPart +```cmd +X:\>DiskPart.exe Microsoft DiskPart version 10.0.15048.0 @@ -306,8 +306,8 @@ To view a list of options available when using the tool, type **mbr2gpt /?** The following text is displayed: -```console -C:\> mbr2gpt /? +```cmd +C:\> mbr2gpt.exe /? Converts a disk from MBR to GPT partitioning without modifying or deleting data on the disk. @@ -381,8 +381,8 @@ You can also view the partition type of a disk by opening the Disk Management to If Windows PowerShell and Disk Management aren't available, such as when you're using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example: -```console -X:\>DiskPart +```cmd +X:\>DiskPart.exe Microsoft DiskPart version 10.0.15048.0 @@ -430,7 +430,7 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from **Command 1:** - ```console + ```cmd copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" ``` @@ -442,7 +442,7 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from **Command 2:** - ```console + ```cmd copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" ``` diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 1316467395..422e304a73 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -64,7 +64,7 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl 2. (Optional) To disable network level authentication, type the following command at an elevated command prompt: ```cmd - REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f + REG.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f ``` 3. At an elevated command prompt, type **sysdm.cpl** and press ENTER. @@ -117,7 +117,7 @@ For Azure AD-joined VMs, follow the same instructions as for [Active Directory-j 1. (Optional) To disable network level authentication, type the following command at an elevated command prompt: ```cmd - REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f + REG.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f ``` 2. At an elevated command prompt, type `sysdm.cpl` and press ENTER. diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index 89f8d25fe4..a33c6b3a90 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -153,7 +153,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 20. Replace the default rules with the following text: - ```text + ```ini [Settings] Priority=Default @@ -188,7 +188,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 21. Select **Apply** and then select **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: - ```text + ```ini [Settings] Priority=Default @@ -297,7 +297,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 3. Select the **Rules** tab and replace the rules with the following text (don't select OK yet): - ```text + ```ini [Settings] Priority=Default @@ -341,13 +341,13 @@ This procedure will demonstrate how to deploy the reference image to the PoC env If desired, edit the following line to include or exclude other users when migrating settings. Currently, the command is set to user exclude (`ue`) all users except for CONTOSO users specified by the user include option (ui): - ```console + ```cmd ScanStateArgs=/ue:*\* /ui:CONTOSO\* ``` For example, to migrate **all** users on the computer, replace this line with the following line: - ```console + ```cmd ScanStateArgs=/all ``` @@ -355,7 +355,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 4. Select **Edit Bootstap.ini** and replace text in the file with the following text: - ```text + ```ini [Settings] Priority=Default @@ -391,9 +391,9 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 1. Initialize Windows Deployment Services (WDS) by typing the following command at an elevated Windows PowerShell prompt on SRV1: - ```powershell - WDSUTIL /Verbose /Progress /Initialize-Server /Server:SRV1 /RemInst:"C:\RemoteInstall" - WDSUTIL /Set-Server /AnswerClients:All + ```cmd + WDSUTIL.exe /Verbose /Progress /Initialize-Server /Server:SRV1 /RemInst:"C:\RemoteInstall" + WDSUTIL.exe /Set-Server /AnswerClients:All ``` 2. Select **Start**, type **Windows Deployment**, and then select **Windows Deployment Services**. @@ -474,8 +474,8 @@ This section will demonstrate how to export user data from an existing client co 4. Open an elevated command prompt on PC1 and type the following command: - ```console - cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs + ```cmd + cscript.exe \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` > [!NOTE] @@ -546,8 +546,8 @@ At a high level, the computer replace process consists of:
1. If you aren't already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt: - ```console - whoami + ```cmd + whoami.exe ``` 2. To ensure a clean environment before running the backup task sequence, type the following commands at an elevated Windows PowerShell prompt on PC1: @@ -558,8 +558,8 @@ At a high level, the computer replace process consists of:
``` 3. Sign in to PC1 using the contoso\administrator account, and then type the following command at an elevated command prompt: - ```console - cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs + ```cmd + cscript.exe \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` 4. Complete the deployment wizard using the following settings: @@ -570,8 +570,8 @@ At a high level, the computer replace process consists of:
6. On PC1, verify that **The user state capture was completed successfully** is displayed, and select **Finish** when the capture is complete. 7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: - ```powershell - PS C:\> dir C:\MigData\PC1\USMT + ```cmd + dir C:\MigData\PC1\USMT Directory: C:\MigData\PC1\USMT diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index f7ecaa8853..276ced6af0 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -79,13 +79,13 @@ The procedures in this guide are summarized in the following table. An estimate 4. Type the following command at an elevated Windows PowerShell prompt on SRV1 to install SQL Server: - ```powershell + ```cmd D:\setup.exe /q /ACTION=Install /ERRORREPORTING="False" /FEATURES=SQLENGINE,RS,IS,SSMS,TOOLS,ADV_SSMS,CONN /INSTANCENAME=MSSQLSERVER /INSTANCEDIR="C:\Program Files\Microsoft SQL Server" /SQLSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /SQLSVCSTARTUPTYPE=Automatic /AGTSVCACCOUNT="NT AUTHORITY\SYSTEM" /AGTSVCSTARTUPTYPE=Automatic /RSSVCACCOUNT="NT AUTHORITY\System" /RSSVCSTARTUPTYPE=Automatic /ISSVCACCOUNT="NT AUTHORITY\System" /ISSVCSTARTUPTYPE=Disabled /ASCOLLATION="Latin1_General_CI_AS" /SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" /TCPENABLED="1" /NPENABLED="1" /IAcceptSQLServerLicenseTerms ``` Installation will take several minutes. When installation is complete, the following output will be displayed: - ```dos + ```console Microsoft (R) SQL Server 2014 12.00.5000.00 Copyright (c) Microsoft Corporation. All rights reserved. @@ -99,7 +99,6 @@ The procedures in this guide are summarized in the following table. An estimate Success One or more affected files have operations pending. You should restart your computer to complete this process. - PS C:\> ``` 5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: @@ -130,7 +129,7 @@ The procedures in this guide are summarized in the following table. An estimate 1. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: - ```dos + ```powershell Get-Service Winmgmt Status Name DisplayName @@ -159,13 +158,13 @@ The procedures in this guide are summarized in the following table. An estimate 1. To extend the Active Directory schema, type the following command at an elevated Windows PowerShell prompt: - ```powershell - cmd /c C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe + ```cmd + C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe ``` 1. Temporarily switch to the DC1 VM, and type the following command at an elevated command prompt on DC1: - ```dos + ```cmd adsiedit.msc ``` @@ -182,8 +181,8 @@ The procedures in this guide are summarized in the following table. An estimate 1. Close the ADSI Edit console and switch back to SRV1. 1. To start Configuration Manager installation, type the following command at an elevated Windows PowerShell prompt on SRV1: - ```powershell - cmd /c C:\configmgr\SMSSETUP\BIN\X64\Setup.exe + ```cmd + C:\configmgr\SMSSETUP\BIN\X64\Setup.exe ``` 1. Provide the following information in the Configuration Manager Setup Wizard: @@ -229,8 +228,8 @@ The procedures in this guide are summarized in the following table. An estimate 3. Type the following command at an elevated Windows PowerShell prompt on SRV1: - ```powershell - cmd /c "D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi" + ```cmd + D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi ``` 4. Install DaRT 10 using default settings. @@ -307,8 +306,8 @@ This section contains several procedures to support Zero Touch installation with > [!IMPORTANT] > Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, type the following commands at an elevated Windows PowerShell prompt on SRV1: -```powershell -WDSUTIL /Set-Server /AnswerClients:None +```cmd +WDSUTIL.exe /Set-Server /AnswerClients:None ``` 1. Determine the MAC address of the internal network adapter on SRV1. Type the following command at an elevated Windows PowerShell prompt on SRV1: @@ -336,8 +335,8 @@ WDSUTIL /Set-Server /AnswerClients:None 5. Select **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: - ```powershell - cmd /c dir /b C:\RemoteInstall\SMSBoot\x64 + ```cmd + dir /b C:\RemoteInstall\SMSBoot\x64 abortpxe.com bootmgfw.efi @@ -353,8 +352,8 @@ WDSUTIL /Set-Server /AnswerClients:None > > You can also type the following command at an elevated Windows PowerShell prompt to open the CMTrace. In the tool, select **File**, select **Open**, and then open the **distmgr.log** file. If errors are present, they will be highlighted in red: > - > ```powershell - > Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' + > ```cmd + > "C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe" > ``` > > The log file is updated continuously while Configuration Manager is running. Wait for Configuration Manager to repair any issues that are present, and periodically recheck that the files are present in the REMINST share location. Close CMTrace when done. You'll see the following line in distmgr.log that indicates the REMINST share is being populated with necessary files: @@ -404,8 +403,8 @@ WDSUTIL /Set-Server /AnswerClients:None 13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and select **OK**. 14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example: - ```console - cmd /c dir /s /b C:\RemoteInstall\SMSImages + ```cmd + dir /s /b C:\RemoteInstall\SMSImages C:\RemoteInstall\SMSImages\PS100004 C:\RemoteInstall\SMSImages\PS100005 @@ -706,8 +705,8 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 5. Type the following command at an elevated Windows PowerShell prompt on SRV1: - ```powershell - notepad "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini" + ```cmd + notepad.exe "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini" ``` 6. Replace the contents of the file with the following text, and then save the file: @@ -878,8 +877,8 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF > [!Note] > This command requires an elevated _command prompt_, not an elevated Windows PowerShell prompt. - ```dos - sc stop ccmsetup + ```cmd + sc.exe stop ccmsetup "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /Uninstall ``` @@ -888,24 +887,24 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue. From an elevated command prompt, type: - ```dos - net stop wuauserv - net stop BITS + ```cmd + net.exe stop wuauserv + net.exe stop BITS ``` Verify that both services were stopped successfully, then type the following command at an elevated command prompt: - ```dos + ```cmd del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" - net start BITS - bitsadmin /list /allusers + net.exe start BITS + bitsadmin.exe /list /allusers ``` Verify that BITSAdmin displays zero jobs. 1. To install the Configuration Manager client as a standalone process, type the following command at an elevated command prompt: - ```dos + ```cmd "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /mp:SRV1.contoso.com /logon SMSSITECODE=PS1 ``` @@ -920,8 +919,8 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. On PC1, open the Configuration Manager control panel applet by typing the following command from a command prompt: - ```dos - control smscfgrc + ```cmd + control.exe smscfgrc ``` 1. Select the **Site** tab, select **Configure Settings**, and select **Find Site**. The client will report that it has found the PS1 site. See the following example: @@ -1032,15 +1031,15 @@ In the Configuration Manager console, in the **Software Library** workspace, und 1. On PC1, open the Configuration Manager control panel applet by typing the following command in a command prompt: - ```dos - control smscfgrc + ```cmd + control.exe smscfgrc ``` 2. On the **Actions** tab, select **Machine Policy Retrieval & Evaluation Cycle**, select **Run Now**, select **OK**, and then select **OK** again. This method is one that you can use to run a task sequence in addition to the Client Notification method that will be demonstrated in the computer refresh procedure. 3. Type the following command at an elevated command prompt to open the Software Center: - ```dos + ```cmd C:\Windows\CCM\SCClient.exe ``` diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 376a7ff9c4..ab9463fb9f 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -120,8 +120,8 @@ Starting with Windows 8, the host computer's microprocessor must support second 1. To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: - ```console - C:\>systeminfo + ```cmd + C:\>systeminfo.exe ... Hyper-V Requirements: VM Monitor Mode Extensions: Yes @@ -136,8 +136,8 @@ Starting with Windows 8, the host computer's microprocessor must support second You can also identify Hyper-V support using [tools](/archive/blogs/taylorb/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v) provided by the processor manufacturer, the [msinfo32](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731397(v=ws.11)) tool, or you can download the [coreinfo](/sysinternals/downloads/coreinfo) utility and run it, as shown in the following example: - ```console - C:\>coreinfo -v + ```cmd + C:\>coreinfo.exe -v Coreinfo v3.31 - Dump information on system CPU and memory topology Copyright (C) 2008-2014 Mark Russinovich @@ -205,7 +205,7 @@ When you have completed installation of Hyper-V on the host computer, begin conf The following example displays the procedures described in this section, both before and after downloading files: - ```console + ```cmd C:>mkdir VHD C:>cd VHD C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd @@ -265,7 +265,7 @@ If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to If the **Type** column doesn't indicate GPT, then the disk partition format is MBR ("Installable File System" = MBR). In the following example, the disk is GPT: ```powershell -PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type +Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type SystemName Caption Type ---------- ------- ---- @@ -276,7 +276,7 @@ USER-PC1 Disk #0, Partition #1 GPT On a computer running Windows 8 or later, you can also type **Get-Disk** at a Windows PowerShell prompt to discover the partition style. The default output of this cmdlet displays the partition style for all attached disks. Both commands are displayed below. In this example, the client computer is running Windows 8.1 and uses a GPT style partition format: ```powershell -PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type +Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type SystemName Caption Type ---------- ------- ---- @@ -374,8 +374,8 @@ The following tables display the Hyper-V VM generation to choose based on the OS 2. On the computer you wish to convert, open an elevated command prompt and type the following command: - ```console - mountvol s: /s + ```cmd + mountvol.exe s: /s ``` This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s). @@ -394,7 +394,7 @@ The following tables display the Hyper-V VM generation to choose based on the OS 6. When the Disk2vhd utility has completed converting the source computer to a VHD, copy the VHDX file (PC1.vhdx) to your Hyper-V host in the C:\VHD directory. There should now be four files in this directory: - ```console + ```cmd C:\vhd>dir /B 2012R2-poc-1.vhd 2012R2-poc-2.vhd @@ -579,14 +579,14 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to 4. Select **Command Prompt**. 5. Type the following command to save an image of the OS drive: - ```console - dism /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C + ```cmd + dism.exe /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C ``` 6. Wait for the OS image to complete saving, and then type the following commands to convert the C: drive to MBR: - ```console - diskpart + ```cmd + diskpart.exe select disk 0 clean convert MBR @@ -601,9 +601,9 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to 7. Type the following commands to restore the OS image and boot files: - ```console - dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\ - bcdboot c:\windows + ```cmd + dism.exe /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\ + bcdboot.exe c:\windows exit ``` @@ -690,7 +690,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to The following output should be displayed: - ```powershell + ```console UseRootHint : True Timeout(s) : 3 EnableReordering : True @@ -752,8 +752,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to To open Windows PowerShell on Windows 7, select **Start**, and search for "**power**." Right-click **Windows PowerShell** and then select **Pin to Taskbar** so that it's simpler to use Windows PowerShell during this lab. Select **Windows PowerShell** on the taskbar, and then type `ipconfig` at the prompt to see the client's current IP address. Also type `ping dc1.contoso.com` and `nltest /dsgetdc:contoso.com` to verify that it can reach the domain controller. See the following examples of a successful network connection: - ```console - ipconfig + ```cmd + ipconfig.exe Windows IP Configuration @@ -909,8 +909,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to 33. In most cases, this process completes configuration of the PoC network. However, if your network has a firewall that filters queries from local DNS servers, you'll also need to configure a server-level DNS forwarder on SRV1 to resolve internet names. To test whether or not DNS is working without this forwarder, try to reach a name on the internet from DC1 or PC1, which are only using DNS services on the PoC network. You can test DNS with the ping command, for example: - ```powershell - ping www.microsoft.com + ```cmd + ping.exe www.microsoft.com ``` If you see "Ping request couldn't find host `www.microsoft.com`" on PC1 and DC1, but not on SRV1, then you'll need to configure a server-level DNS forwarder on SRV1. To do this action, open an elevated Windows PowerShell prompt on SRV1 and type the following command. @@ -924,8 +924,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to 34. If DNS and routing are both working correctly, you'll see the following output on DC1 and PC1 (the IP address might be different, but that's OK): - ```powershell - PS C:\> ping www.microsoft.com + ```cmd + ping www.microsoft.com Pinging e2847.dspb.akamaiedge.net [23.222.146.170] with 32 bytes of data: Reply from 23.222.146.170: bytes=32 time=3ms TTL=51 @@ -943,7 +943,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to 36. Lastly, because the client computer has different hardware after copying it to a VM, its Windows activation will be invalidated and you might receive a message that you must activate Windows in three days. To extend this period to 30 days, type the following commands at an elevated Windows PowerShell prompt on PC1: ```powershell - runas /noprofile /env /user:administrator@contoso.com "cmd /c slmgr -rearm" + runas.exe /noprofile /env /user:administrator@contoso.com "cmd.exe /c slmgr -rearm" Restart-Computer ``` @@ -963,7 +963,7 @@ Use the following procedures to verify that the PoC environment is configured pr Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com Get-DhcpServerInDC Get-DhcpServerv4Statistics - ipconfig /all + ipconfig.exe /all ``` **Get-Service** displays a status of "Running" for all three services. @@ -988,8 +988,8 @@ Use the following procedures to verify that the PoC environment is configured pr Get-Service DNS,RemoteAccess Get-DnsServerForwarder Resolve-DnsName -Server dc1.contoso.com -Name www.microsoft.com - ipconfig /all - netsh int ipv4 show address + ipconfig.exe /all + netsh.exe int ipv4 show address ``` **Get-Service** displays a status of "Running" for both services. @@ -1004,23 +1004,23 @@ Use the following procedures to verify that the PoC environment is configured pr 3. On PC1, open an elevated Windows PowerShell prompt and type the following commands: - ```powershell - whoami - hostname - nslookup www.microsoft.com - ping -n 1 dc1.contoso.com - tracert www.microsoft.com + ```cmd + whoami.exe + hostname.exe + nslookup.exe www.microsoft.com + ping.exe -n 1 dc1.contoso.com + tracert.exe www.microsoft.com ``` - **whoami** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed. + **whoami.exe** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed. - **hostname** displays the name of the local computer, for example W7PC-001. + **hostname.exe** displays the name of the local computer, for example W7PC-001. - **nslookup** displays the DNS server used for the query, and the results of the query. For example, server `dc1.contoso.com`, address 192.168.0.1, Name `e2847.dspb.akamaiedge.net`. + **nslookup.exe** displays the DNS server used for the query, and the results of the query. For example, server `dc1.contoso.com`, address 192.168.0.1, Name `e2847.dspb.akamaiedge.net`. - **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it can't be resolved, "couldn't find host" will be displayed. If the target is found and also responds to ICMP, you'll see "Reply from" and the IP address of the target. + **ping.exe** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it can't be resolved, "couldn't find host" will be displayed. If the target is found and also responds to ICMP, you'll see "Reply from" and the IP address of the target. - **tracert** displays the path to reach the destination, for example `srv1.contoso.com` [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. + **tracert.exe** displays the path to reach the destination, for example `srv1.contoso.com` [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. ## Appendix B: Terminology used in this guide diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index d939130747..655fb1b5df 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -32,13 +32,13 @@ DISM is one of the deployment tools included in the Windows ADK and is used for DISM services online and offline images. For example, with DISM you can install the Microsoft .NET Framework 3.5.1 in Windows 10 online, which means that you can start the installation in the running operating system, not that you get the software online. The /LimitAccess switch configures DISM to get the files only from a local source: -``` syntax +```cmd Dism.exe /Online /Enable-Feature /FeatureName:NetFX3 /All /Source:D:\Sources\SxS /LimitAccess ``` In Windows 10, you can use Windows PowerShell for many of the functions done by DISM.exe. The equivalent command in Windows 10 using PowerShell is: -``` syntax +```powershell Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source D:\Sources\SxS -LimitAccess ``` @@ -160,7 +160,7 @@ The updated Volume Activation Management Tool. VAMT also can be used to create reports, switch from MAK to KMS, manage Active Directory-based activation, and manage Office 2010 and Office 2013 volume activation. VAMT also supports PowerShell (instead of the old command-line tool). For example, if you want to get information from the VAMT database, you can type: -``` syntax +```powershell Get-VamtProduct ``` From 4c8adab0755ca97a7e3c91da42d22af39dc14b36 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 23 Nov 2022 17:14:56 -0500 Subject: [PATCH 045/324] Deploy root code block standardization plus style updates 2 --- windows/deployment/add-store-apps-to-image.md | 8 +- ...nfigure-a-pxe-server-to-load-windows-pe.md | 5 +- windows/deployment/deploy-windows-to-go.md | 24 ++-- windows/deployment/deploy.md | 2 +- windows/deployment/mbr-to-gpt.md | 105 ++++++++++-------- 5 files changed, 82 insertions(+), 62 deletions(-) diff --git a/windows/deployment/add-store-apps-to-image.md b/windows/deployment/add-store-apps-to-image.md index a91e078d81..1d67fee4df 100644 --- a/windows/deployment/add-store-apps-to-image.md +++ b/windows/deployment/add-store-apps-to-image.md @@ -40,10 +40,10 @@ On a machine where your image file is accessible: 1. Open Windows PowerShell with administrator privileges. -2. Mount the image. At the Windows PowerShell prompt, type: +2. Mount the image. At the Windows PowerShell prompt, enter: `Mount-WindowsImage -ImagePath c:\images\myimage.wim -Index 1 -Path C:\test` -3. Use the Add-AppxProvisionedPackage cmdlet in Windows PowerShell to preinstall the app. Use the /PackagePath option to specify the location of the Store package and /LicensePath to specify the location of the license .xml file. In Windows PowerShell, type: +3. Use the Add-AppxProvisionedPackage cmdlet in Windows PowerShell to preinstall the app. Use the /PackagePath option to specify the location of the Store package and /LicensePath to specify the location of the license .xml file. In Windows PowerShell, enter: `Add-AppxProvisionedPackage -Path C:\test -PackagePath C:\downloads\appxpackage -LicensePath C:\downloads\appxpackage\license.xml` > [!NOTE] @@ -69,10 +69,10 @@ On a test machine: Now, on the machine where your image file is accessible: -1. Import the Start layout. At the Windows PowerShell prompt, type: +1. Import the Start layout. At the Windows PowerShell prompt, enter: `Import-StartLayout -LayoutPath ".xml" -MountPath "C:\test\"` -2. Save changes and dismount the image. At the Windows PowerShell prompt, type: +2. Save changes and dismount the image. At the Windows PowerShell prompt, enter: `Dismount-WindowsImage -Path c:\test -Save` > [!NOTE] diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md index 07bb63b78d..8daba62c5b 100644 --- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md +++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md @@ -62,7 +62,10 @@ All four of the roles specified above can be hosted on the same computer or each dism.exe /mount-image /imagefile:c:\winpe_amd64\media\sources\boot.wim /index:1 /mountdir:C:\winpe_amd64\mount ``` - Verify that "The operation completed successfully" is displayed. Note: To view currently mounted images, type **dism /get-MountedWiminfo**. + Verify that the message **The operation completed successfully** is displayed. + + > [!NOTE] + > To view currently mounted images, enter **`dism.exe /get-MountedWiminfo`**. 5. Map a network share to the root TFTP directory on the PXE/TFTP server and create a \Boot folder. Consult your TFTP server documentation to determine the root TFTP server directory, then enable sharing for this directory, and verify it can be accessed on the network. In the following example, the PXE server name is PXE-1 and the TFTP root directory is shared using a network path of **\\\PXE-1\TFTPRoot**: diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md index 14c8c0cf25..4e89ec4ec5 100644 --- a/windows/deployment/deploy-windows-to-go.md +++ b/windows/deployment/deploy-windows-to-go.md @@ -62,7 +62,7 @@ In this step we're creating the operating system image that will be used on the 3. Verify that the `.wim` file location (which can be a network share, a DVD, or a USB drive) is accessible and that it contains a valid Windows 10 Enterprise or Windows 10 Education image that has been generalized using sysprep. Many environments can use the same image for both Windows To Go and desktop deployments. > [!NOTE] - > For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824929(v=win.10)). For more information about using sysprep, see [Sysprep Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825209(v=win.10)). + > For more information about `.wim` files, see [Windows System Image Manager (Windows SIM) Technical Reference](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824929(v=win.10)). For more information about using sysprep, see [Sysprep Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/hh825209(v=win.10)). 4. Search for **Windows To Go** and then press **Enter**. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. The **Windows To Go Creator Wizard** opens. @@ -139,8 +139,8 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as 3. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows) command-line tool (DISM): - >[!TIP] - >The index number must be set correctly to a valid Enterprise image in the `.WIM` file. + > [!TIP] + > The index number must be set correctly to a valid Enterprise image in the `.wim` file. ```cmd #The WIM file must contain a sysprep generalized image. @@ -231,8 +231,8 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as After the answer file has been saved, copy `unattend.xml` into the sysprep folder on the Windows To Go drive (for example, `W:\Windows\System32\sysprep\`) - >[!IMPORTANT] - >Setup unattend files are processed based on their location. Setup will place a temporary unattend file into the **`%systemroot%\panther`** folder which is the first location that setup will check for installation information. You should make sure that folder does not contain a previous version of an unattend.xml file to ensure that the one you just created is used. + > [!IMPORTANT] + > Setup unattend files are processed based on their location. Setup will place a temporary unattend file into the **`%systemroot%\panther`** folder which is the first location that setup will check for installation information. You should make sure that folder does not contain a previous version of an unattend.xml file to ensure that the one you just created is used. If you don't wish to boot your Windows To Go device on this computer and want to remove it to boot it on another PC, be sure to use the **Safely Remove Hardware and Eject Media** option to safely disconnect the drive before physically removing it from the PC. @@ -242,8 +242,8 @@ Your Windows To Go workspace is now ready to be started. You can now [prepare a Computers running Windows 8 and later can be configured as host computers that use Windows To Go automatically whenever a Windows To Go workspace is available at startup. When the Windows To Go startup options are enabled on a host computer, Windows will divert startup to the Windows To Go drive whenever it's attached to the computer. This makes it easy to switch from using the host computer to using the Windows To Go workspace. ->[!TIP] ->If you will be using a PC running Windows 7 as your host computer, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) for information to help you prepare the host computer. +> [!TIP] +> If you will be using a PC running Windows 7 as your host computer, see [Tips for configuring your BIOS settings to work with Windows To Go](https://go.microsoft.com/fwlink/p/?LinkId=618951) for information to help you prepare the host computer. If you want to use the Windows To Go workspace, shut down the computer, plug in the Windows To Go drive, and turn on the computer. To use the host computer, shut down the Windows To Go workspace, unplug the Windows To Go drive, and turn on the computer. @@ -277,7 +277,7 @@ After you've configured your host PC to boot from USB, you can use the following 2. Insert the Windows To Go USB drive directly into a USB 3.0 or USB 2.0 port on the PC. Don't use a USB hub or extender. -3. Turn on the PC. If your Windows To Go drive is protected with BitLocker you'll be asked to type the password, otherwise the workspace will boot directly into the Windows To Go workspace. +3. Turn on the PC. If your Windows To Go drive is protected with BitLocker you'll be asked to enter the password, otherwise the workspace will boot directly into the Windows To Go workspace. ## Advanced deployment steps @@ -362,7 +362,7 @@ Making sure that Windows To Go workspaces are effective when used off premises i ``` > [!TIP] - > The index number must be set correctly to a valid Enterprise image in the `.WIM` file. + > The index number must be set correctly to a valid Enterprise image in the `.wim` file. 6. After those commands have completed, run the following command: @@ -521,8 +521,8 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows) command-line tool (DISM): - >[!TIP] - >The index number must be set correctly to a valid Enterprise image in the .WIM file. + > [!TIP] + > The index number must be set correctly to a valid Enterprise image in the `.wim` file. ```cmd #The WIM file must contain a sysprep generalized image. @@ -617,7 +617,7 @@ The sample script creates an unattend file that streamlines the deployment proce The RemoteSigned execution policy will prevent unsigned scripts from the internet from running on the computer, but will allow locally created scripts to run. For more information on execution policies, see [Set-ExecutionPolicy](/powershell/module/microsoft.powershell.security/set-executionpolicy). > [!TIP] - > To get online help for any Windows PowerShell cmdlet, whether or not it is installed locally type the following cmdlet, replacing <cmdlet-name> with the name of the cmdlet you want to see the help for: + > To get online help for any Windows PowerShell cmdlet, whether or not it is installed locally, enter the following cmdlet, replacing `` with the name of the cmdlet you want to see the help for: > > `Get-Help -Online` > diff --git a/windows/deployment/deploy.md b/windows/deployment/deploy.md index 51982b85d2..fadb45e713 100644 --- a/windows/deployment/deploy.md +++ b/windows/deployment/deploy.md @@ -23,7 +23,7 @@ Windows 10 upgrade options are discussed and information is provided about plann |[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This article provides information about support for upgrading directly to Windows 10 from a previous operating system. | |[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This article provides information about support for upgrading from one edition of Windows 10 to another. | |[Windows 10 volume license media](windows-10-media.md) |This article provides information about updates to volume licensing media in the current version of Windows 10. | -|[Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they're known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | +|[Manage Windows upgrades with Upgrade Readiness](/mem/configmgr/desktop-analytics/overview) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they're known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | |[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After you complete this guide, more guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md). | |[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to help Windows 10 deployment planning. | |[Deploy Windows 10 with the Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) |This guide will walk you through the process of deploying Windows 10 in an enterprise environment using the Microsoft Deployment Toolkit (MDT). | diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index e30fc24235..30949e1768 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -15,18 +15,23 @@ ms.technology: itpro-deploy # MBR2GPT.EXE -**Applies to** -- Windows 10 +*Applies to:* -**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **/allowFullOS** option. +- Windows 10 -MBR2GPT.EXE is located in the **Windows\\System32** directory on a computer running Windows 10 version 1703 (also known as the Creator's Update) or later. +**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **`/allowFullOS`** option. + +MBR2GPT.EXE is located in the **`Windows\System32`** directory on a computer running Windows 10 version 1703 or later. The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version. See the following video for a detailed description and demonstration of MBR2GPT. +> [!VIDEO https://www.youtube-nocookie.com/embed/hfJep4hmg9o] + + +--> You can use MBR2GPT to: @@ -45,6 +50,7 @@ Offline conversion of system disks with earlier versions of Windows installed, s ## Disk Prerequisites Before any change to the disk is made, MBR2GPT validates the layout and geometry of the selected disk to ensure that: + - The disk is currently using MBR - There's enough space not occupied by partitions to store the primary and secondary GPTs: - 16 KB + 2 sectors at the front of the disk @@ -66,18 +72,18 @@ If any of these checks fails, the conversion won't proceed, and an error will be | Option | Description | |----|-------------| -|/validate| Instructs MBR2GPT.exe to perform only the disk validation steps and report whether the disk is eligible for conversion. | -|/convert| Instructs MBR2GPT.exe to perform the disk validation and to proceed with the conversion if all validation tests pass. | -|/disk:\| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| -|/logs:\| Specifies the directory where MBR2GPT.exe logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.| -|/map:\=\| Specifies other partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexadecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | -|/allowFullOS| By default, MBR2GPT.exe is blocked unless it's run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
**Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new ESP is created by shrinking the OS partition.| +|**/validate**| Instructs `MBR2GPT.exe` to perform only the disk validation steps and report whether the disk is eligible for conversion. | +|**/convert**| Instructs `MBR2GPT.exe` to perform the disk validation and to proceed with the conversion if all validation tests pass. | +|**/disk:*\***| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| +|**/logs:*\***| Specifies the directory where `MBR2GPT.exe` logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.| +|**/map:*\*=*\***| Specifies other partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexadecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | +|**/allowFullOS**| By default, `MBR2GPT.exe` is blocked unless it's run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
**Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new ESP is created by shrinking the OS partition.| ## Examples ### Validation example -In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location, **%windir%**. +In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location of **`%windir%`**. ```cmd X:\>mbr2gpt.exe /validate /disk:0 @@ -92,14 +98,23 @@ MBR2GPT: Validation completed successfully In the following example: 1. Using DiskPart, the current disk partition layout is displayed prior to conversion - three partitions are present on the MBR disk (disk 0): a system reserved partition, a Windows partition, and a recovery partition. A DVD-ROM is also present as volume 0. + 2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](/windows/win32/fileio/disk-partition-types) is **07** corresponding to the installable file system (IFS) type. -2. The MBR2GPT tool is used to convert disk 0. -3. The DiskPart tool displays that disk 0 is now using the GPT format. -4. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). -5. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. + +3. The MBR2GPT tool is used to convert disk 0. + +4. The DiskPart tool displays that disk 0 is now using the GPT format. + +5. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). + +6. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. +
+
+ Expand to show MBR2GPT example + ```cmd X:\>DiskPart.exe @@ -219,6 +234,8 @@ Offset in Bytes: 524288000 * Volume 1 D Windows NTFS Partition 58 GB Healthy ``` +
+ ## Specifications ### Disk conversion workflow @@ -259,17 +276,18 @@ Since GPT partitions use a different set of type IDs than MBR partitions, each p 4. All other MBR partitions recognized by Windows are converted to GPT partitions of type PARTITION_BASIC_DATA_GUID (ebd0a0a2-b9e5-4433-87c0-68b6b72699c7). In addition to applying the correct partition types, partitions of type PARTITION_MSFT_RECOVERY_GUID also have the following GPT attributes set: + - GPT_ATTRIBUTE_PLATFORM_REQUIRED (0x0000000000000001) - GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER (0x8000000000000000) For more information about partition types, see: + - [GPT partition types](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) - [MBR partition types](/windows/win32/fileio/disk-partition-types) - ### Persisting drive letter assignments -The conversion tool will attempt to remap all drive letter assignment information contained in the registry that corresponds to the volumes of the converted disk. If a drive letter assignment can't be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. +The conversion tool will attempt to remap all drive letter assignment information contained in the registry that corresponds to the volumes of the converted disk. If a drive letter assignment can't be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. > [!IMPORTANT] > This code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. @@ -293,7 +311,7 @@ Four log files are created by the MBR2GPT tool: - setupact.log - setuperr.log -These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. +These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. > [!NOTE] > The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory. @@ -302,7 +320,7 @@ The default location for all these log files in Windows PE is **%windir%**. ### Interactive help -To view a list of options available when using the tool, type **mbr2gpt /?** +To view a list of options available when using the tool, enter **`mbr2gpt.exe /?`** The following text is displayed: @@ -348,19 +366,18 @@ MBR2GPT has the following associated return codes: | Return code | Description | |----|-------------| -|0| Conversion completed successfully.| -|1| Conversion was canceled by the user.| -|2| Conversion failed due to an internal error.| -|3| Conversion failed due to an initialization error.| -|4| Conversion failed due to invalid command-line parameters. | -|5| Conversion failed due to error reading the geometry and layout of the selected disk.| -|6| Conversion failed because one or more volumes on the disk is encrypted.| -|7| Conversion failed because the geometry and layout of the selected disk don't meet requirements.| -|8| Conversion failed due to error while creating the EFI system partition.| -|9| Conversion failed due to error installing boot files.| -|10| Conversion failed due to error while applying GPT layout.| -|100| Conversion to GPT layout succeeded, but some boot configuration data entries couldn't be restored.| - +|**0**| Conversion completed successfully.| +|**1**| Conversion was canceled by the user.| +|**2**| Conversion failed due to an internal error.| +|**3**| Conversion failed due to an initialization error.| +|**4**| Conversion failed due to invalid command-line parameters. | +|**5**| Conversion failed due to error reading the geometry and layout of the selected disk.| +|**6**| Conversion failed because one or more volumes on the disk is encrypted.| +|**7**| Conversion failed because the geometry and layout of the selected disk don't meet requirements.| +|**8**| Conversion failed due to error while creating the EFI system partition.| +|**9**| Conversion failed due to error installing boot files.| +|**10**| Conversion failed due to error while applying GPT layout.| +|**100**| Conversion to GPT layout succeeded, but some boot configuration data entries couldn't be restored.| ### Determining the partition type @@ -405,15 +422,15 @@ In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is When you start a Windows 10, version 1903-based computer in the Windows Preinstallation Environment (Windows PE), you encounter the following issues: -**Issue 1** When you run the MBR2GPT.exe command, the process exits without converting the drive. +**Issue 1** When you run the `MBR2GPT.exe` command, the process exits without converting the drive. -**Issue 2** When you manually run the MBR2GPT.exe command in a Command Prompt window, there's no output from the tool. +**Issue 2** When you manually run the `MBR2GPT.exe` command in a Command Prompt window, there's no output from the tool. -**Issue 3** When MBR2GPT.exe runs inside an imaging process such as a Microsoft Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. +**Issue 3** When `MBR2GPT.exe` runs inside an imaging process such as a Microsoft Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. #### Cause -This issue occurs because in Windows 10, version 1903 and later versions, MBR2GPT.exe requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later. +This issue occurs because in Windows 10, version 1903 and later versions, `MBR2GPT.exe` requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later. #### Workaround @@ -433,28 +450,28 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from ```cmd copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" ``` - + This command copies three files: - * ReAgent.admx - * ReAgent.dll - * ReAgent.xml + - ReAgent.admx + - ReAgent.dll + - ReAgent.xml **Command 2:** ```cmd copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" ``` - + This command copies two files: - * ReAgent.adml - * ReAgent.dll.mui + - ReAgent.adml + - ReAgent.dll.mui > [!NOTE] > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. -3. After you copy all the files, commit the changes and unmount the Windows PE WIM. MBR2GPT.exe now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). +3. After you copy all the files, commit the changes and unmount the Windows PE WIM. `MBR2GPT.exe` now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). ## Related articles From fe1d49ae81c6a4309548ee2eb252dfcf2398716d Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 23 Nov 2022 17:22:51 -0500 Subject: [PATCH 046/324] Deploy root code block standardization plus style updates 3 --- windows/deployment/mbr-to-gpt.md | 4 ---- windows/deployment/s-mode.md | 12 ++++++------ 2 files changed, 6 insertions(+), 10 deletions(-) diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 30949e1768..dd44fd4c49 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -29,10 +29,6 @@ See the following video for a detailed description and demonstration of MBR2GPT. > [!VIDEO https://www.youtube-nocookie.com/embed/hfJep4hmg9o] - - ---> - You can use MBR2GPT to: - Convert any attached MBR-formatted system disk to the GPT partition format. You can't use the tool to convert non-system disks from MBR to GPT. diff --git a/windows/deployment/s-mode.md b/windows/deployment/s-mode.md index eaba8cdb52..ffaff09e92 100644 --- a/windows/deployment/s-mode.md +++ b/windows/deployment/s-mode.md @@ -20,15 +20,15 @@ S mode is an evolution of the S SKU introduced with Windows 10 April 2018 Update ## S mode key features -**Microsoft-verified security** +### Microsoft-verified security With Windows 10 in S mode, you'll find your favorite applications, such as Office, Evernote, and Spotify in the Microsoft Store where they're Microsoft-verified for security. You can also feel secure when you're online. Microsoft Edge, your default browser, gives you protection against phishing and socially engineered malware. -**Performance that lasts** +### Performance that lasts Start-ups are quick, and S mode is built to keep them that way. With Microsoft Edge as your browser, your online experience is fast and secure. Plus, you'll enjoy a smooth, responsive experience, whether you're streaming HD video, opening apps, or being productive on the go. -**Choice and flexibility** +### Choice and flexibility Save your files to your favorite cloud, like OneDrive or Dropbox, and access them from any device you choose. Browse the Microsoft Store for thousands of apps, and if you don't find exactly what you want, you can easily [switch out of S mode](./windows-10-pro-in-s-mode.md) to Windows 10 Home, Pro, or Enterprise editions at any time and search the web for more choices, as shown below. @@ -48,7 +48,7 @@ The [MSIX Packaging Tool](/windows/application-management/msix-app-packaging-too ## Related links -- [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode) -- [S mode devices](https://www.microsoft.com/en-us/windows/view-all-devices) +- [Consumer applications for S mode](/windows/s-mode) +- [S mode devices](/windows/view-all-devices) - [Windows Defender Application Control deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) -- [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) +- [Microsoft Defender for Endpoint](/microsoft-365/windows/microsoft-defender-atp) From 88a8bf9614e5ebe31dbe9e405c03f59d4ca1a7f9 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 23 Nov 2022 18:29:44 -0500 Subject: [PATCH 047/324] Deploy root code block standardization plus style updates 4 --- ...nfigure-a-pxe-server-to-load-windows-pe.md | 10 +- windows/deployment/deploy-whats-new.md | 2 +- windows/deployment/deploy-windows-to-go.md | 2 +- windows/deployment/deploy.md | 2 +- windows/deployment/mbr-to-gpt.md | 2 +- windows/deployment/s-mode.md | 6 +- .../deployment/vda-subscription-activation.md | 82 ++++++++---- windows/deployment/wds-boot-support.md | 11 +- .../windows-10-deployment-posters.md | 7 +- .../windows-10-deployment-scenarios.md | 62 ++++----- .../windows-10-enterprise-e3-overview.md | 102 +++++++------- windows/deployment/windows-10-media.md | 10 +- .../deployment/windows-10-missing-fonts.md | 8 +- windows/deployment/windows-10-poc-mdt.md | 126 +++++++++++------- 14 files changed, 247 insertions(+), 185 deletions(-) diff --git a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md index 8daba62c5b..3dbdf7eef2 100644 --- a/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md +++ b/windows/deployment/configure-a-pxe-server-to-load-windows-pe.md @@ -63,7 +63,7 @@ All four of the roles specified above can be hosted on the same computer or each ``` Verify that the message **The operation completed successfully** is displayed. - + > [!NOTE] > To view currently mounted images, enter **`dism.exe /get-MountedWiminfo`**. @@ -93,7 +93,7 @@ All four of the roles specified above can be hosted on the same computer or each copy C:\winpe_amd64\media\sources\boot.wim y:\Boot ``` -9. (Optional) Copy true type fonts to the \boot folder +9. (Optional) Copy TrueType fonts to the \boot folder ```cmd copy C:\winpe_amd64\media\Boot\Fonts y:\Boot\Fonts @@ -178,8 +178,8 @@ ramdisksdidevice boot ramdisksdipath \Boot\boot.sdi ``` ->[!TIP] ->If you start the PXE boot process, but receive the error **The boot configuration data for your PC is missing or contains error**, then verify that `\boot` directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different. +> [!TIP] +> If you start the PXE boot process, but receive the error **The boot configuration data for your PC is missing or contains error**, then verify that `\boot` directory is installed under the correct TFTP server root directory. In the example used here the name of this directory is TFTPRoot, but your TFTP server might be different. ## PXE boot process summary @@ -210,7 +210,7 @@ DHCP OPTIONS ARE NOT RECOMMENDED AND IN SOME SCENARIOS NOT SUPPORTED. SWITCHING > [!NOTE] > The BCD store must reside in the `\boot` directory on the TFTP server and must be named BCD. -6. `Bootmgr.exe` reads the BCD operating system entries and downloads `boot\boot.sdi` and the Windows PE image (`boot\boot.wim`). Optional files that can also be downloaded include true type fonts (`boot\Fonts\wgl4_boot.ttf`) and the hibernation state file (`\hiberfil.sys`) if these files are present. +6. `Bootmgr.exe` reads the BCD operating system entries and downloads `boot\boot.sdi` and the Windows PE image (`boot\boot.wim`). Optional files that can also be downloaded include TrueType fonts (`boot\Fonts\wgl4_boot.ttf`) and the hibernation state file (`\hiberfil.sys`) if these files are present. 7. `Bootmgr.exe` starts Windows PE by calling `winload.exe` within the Windows PE image. diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index f838e4e172..309fe14ba0 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -9,7 +9,7 @@ author: frankroj ms.topic: article ms.custom: seo-marvel-apr2020 ms.collection: highpri -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md index 4e89ec4ec5..e2257c041b 100644 --- a/windows/deployment/deploy-windows-to-go.md +++ b/windows/deployment/deploy-windows-to-go.md @@ -9,7 +9,7 @@ ms.prod: windows-client ms.technology: itpro-deploy ms.topic: article ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 --- # Deploy Windows To Go in your organization diff --git a/windows/deployment/deploy.md b/windows/deployment/deploy.md index fadb45e713..6274640054 100644 --- a/windows/deployment/deploy.md +++ b/windows/deployment/deploy.md @@ -9,7 +9,7 @@ ms.prod: windows-client ms.localizationpriority: medium ms.topic: article ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index dd44fd4c49..eb154e5d93 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -4,7 +4,7 @@ description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) ms.prod: windows-client author: frankroj ms.author: frankroj -ms.date: 10/31/2022 +ms.date: 11/23/2022 manager: aaroncz ms.localizationpriority: high ms.topic: article diff --git a/windows/deployment/s-mode.md b/windows/deployment/s-mode.md index ffaff09e92..3fc8a55190 100644 --- a/windows/deployment/s-mode.md +++ b/windows/deployment/s-mode.md @@ -8,7 +8,7 @@ author: frankroj ms.author: frankroj ms.topic: article ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- @@ -48,7 +48,7 @@ The [MSIX Packaging Tool](/windows/application-management/msix-app-packaging-too ## Related links -- [Consumer applications for S mode](/windows/s-mode) -- [S mode devices](/windows/view-all-devices) +- [Consumer applications for S mode](https://www.microsoft.com/windows/s-mode) +- [S mode devices](https://www.microsoft.com/windows/view-all-devices) - [Windows Defender Application Control deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) - [Microsoft Defender for Endpoint](/microsoft-365/windows/microsoft-defender-atp) diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 422e304a73..fbbf1013ee 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -11,12 +11,12 @@ ms.technology: itpro-fundamentals ms.localizationpriority: medium ms.topic: how-to ms.collection: M365-modern-desktop -ms.date: 10/31/2022 +ms.date: 11/23/2022 --- # Configure VDA for Windows subscription activation -Applies to: +*Applies to:* - Windows 10 - Windows 11 @@ -61,42 +61,55 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl ## Active Directory-joined VMs 1. Use the following instructions to prepare the VM for Azure: [Prepare a Windows VHD or VHDX to upload to Azure](/azure/virtual-machines/windows/prepare-for-upload-vhd-image) -2. (Optional) To disable network level authentication, type the following command at an elevated command prompt: + +2. (Optional) To disable network level authentication, enter the following command at an elevated command prompt: ```cmd REG.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f ``` -3. At an elevated command prompt, type **sysdm.cpl** and press ENTER. +3. At an elevated command prompt, enter **sysdm.cpl**. + 4. On the Remote tab, choose **Allow remote connections to this computer** and then select **Select Users**. -5. Select **Add**, type **Authenticated users**, and then select **OK** three times. + +5. Select **Add**, enter **Authenticated users**, and then select **OK** three times. + 6. Follow the instructions to use sysprep at [Steps to generalize a VHD](/azure/virtual-machines/windows/prepare-for-upload-vhd-image#generalize-a-vhd) and then start the VM again. + 7. If you must activate Windows Pro as described for [scenario 3](#scenario-3), complete the following steps to use Windows Configuration Designer and inject an activation key. Otherwise, skip to step 8. 1. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). - 1. Open Windows Configuration Designer and select **Provision desktop services**. - 1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name. + + 2. Open Windows Configuration Designer and select **Provision desktop services**. + + 3. Under **Name**, enter **Desktop AD Enrollment Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name. > [!NOTE] > You can use a different project name, but this name is also used with dism.exe in a later step. - 1. Under **Enter product key** type the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`. - 1. On the Set up network page, choose **Off**. - 1. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. + 4. Under **Enter product key** enter the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`. + + 5. On the Set up network page, choose **Off**. + + 6. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. > [!NOTE] > This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). - 1. On the Add applications page, add applications if desired. This step is optional. - 1. On the Add certificates page, add certificates if desired. This step is optional. - 1. On the Finish page, select **Create**. - 1. In file explorer, open the VHD to mount the disk image. Determine the drive letter of the mounted image. - 1. Type the following command at an elevated command prompt. Replace the letter `G` with the drive letter of the mounted image, and enter the project name you used if it's different than the one suggested: + 7. On the Add applications page, add applications if desired. This step is optional. + + 8. On the Add certificates page, add certificates if desired. This step is optional. + + 9. On the Finish page, select **Create**. + + 10. In file explorer, open the VHD to mount the disk image. Determine the drive letter of the mounted image. + + 11. Enter the following command at an elevated command prompt. Replace the letter `G` with the drive letter of the mounted image, and enter the project name you used if it's different than the one suggested: ```cmd Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg" ``` - 1. Right-click the mounted image in file explorer and select **Eject**. + 12. Right-click the mounted image in file explorer and select **Eject**. 8. See the instructions at [Upload and create VM from generalized VHD](/azure/virtual-machines/windows/upload-generalized-managed#upload-the-vhd) to sign in to Azure, get your storage account details, upload the VHD, and create a managed image. @@ -107,33 +120,50 @@ For examples of activation issues, see [Troubleshoot the user experience](./depl For Azure AD-joined VMs, follow the same instructions as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions: -- During setup with Windows Configuration Designer, under **Name**, type a name for the project that indicates it isn't for Active Directory-joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**. +- During setup with Windows Configuration Designer, under **Name**, enter a name for the project that indicates it isn't for Active Directory-joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**. + - During setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, select **Get Bulk Token**, sign in, and add the bulk token using your organization's credentials. + - When entering the PackagePath, use the project name you previously entered. For example, **Desktop Bulk Enrollment Token Pro GVLK.ppkg** + - When attempting to access the VM using remote desktop, you'll need to create a custom RDP settings file as described below in [Create custom RDP settings for Azure](#create-custom-rdp-settings-for-azure). ## Azure Gallery VMs -1. (Optional) To disable network level authentication, type the following command at an elevated command prompt: +1. (Optional) To disable network level authentication, enter the following command at an elevated command prompt: ```cmd REG.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f ``` -2. At an elevated command prompt, type `sysdm.cpl` and press ENTER. +2. At an elevated command prompt, enter `sysdm.cpl`. + 3. On the Remote tab, choose **Allow remote connections to this computer** and then select **Select Users**. -4. Select **Add**, type **Authenticated users**, and then select **OK** three times. + +4. Select **Add**, enter **Authenticated users**, and then select **OK** three times. + 5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). + 6. Open Windows Configuration Designer and select **Provision desktop services**. + 7. If you must activate Windows Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8. - 1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name. - 2. Under **Enter product key** type the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`. -8. Under **Name**, type **Desktop Bulk Enrollment**, select **Finish**, and then on the **Set up device** page enter a device name. + + 1. Under **Name**, enter **Desktop Bulk Enrollment Token Pro GVLK**, select **Finish**, and then on the **Set up device** page enter a device name. + + 2. Under **Enter product key** enter the Pro GVLK key: `W269N-WFGWX-YVC9B-4J6C9-T83GX`. + +8. Under **Name**, enter **Desktop Bulk Enrollment**, select **Finish**, and then on the **Set up device** page enter a device name. + 9. On the Set up network page, choose **Off**. + 10. On the Account Management page, choose **Enroll in Azure AD**, select **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials. + 11. On the Add applications page, add applications if desired. This step is optional. + 12. On the Add certificates page, add certificates if desired. This step is optional. + 13. On the Finish page, select **Create**. + 14. Copy the PPKG file to the remote virtual machine. Open the provisioning package to install it. This process will restart the system. > [!NOTE] @@ -142,9 +172,13 @@ For Azure AD-joined VMs, follow the same instructions as for [Active Directory-j ## Create custom RDP settings for Azure 1. Open Remote Desktop Connection and enter the IP address or DNS name for the remote host. + 2. Select **Show Options**, and then under Connection settings select **Save As**. Save the RDP file to the location where you'll use it. + 3. Close the Remote Desktop Connection window and open Notepad. + 4. Open the RDP file in Notepad to edit it. + 5. Enter or replace the line that specifies authentication level with the following two lines of text: ```text @@ -162,4 +196,4 @@ For Azure AD-joined VMs, follow the same instructions as for [Active Directory-j [Recommended settings for VDI desktops](/windows-server/remote/remote-desktop-services/rds-vdi-recommendations) -[Whitepaper on licensing the Windows desktop for VDI environments](https://download.microsoft.com/download/9/8/d/98d6a56c-4d79-40f4-8462-da3ecba2dc2c/licensing_windows_desktop_os_for_virtual_machines.pdf) \ No newline at end of file +[Whitepaper on licensing the Windows desktop for VDI environments](https://download.microsoft.com/download/9/8/d/98d6a56c-4d79-40f4-8462-da3ecba2dc2c/licensing_windows_desktop_os_for_virtual_machines.pdf) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index dfab934f9d..c0fe80dccc 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -8,14 +8,15 @@ ms.author: frankroj manager: aaroncz ms.topic: article ms.custom: seo-marvel-apr2020 -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # Windows Deployment Services (WDS) boot.wim support -Applies to: -- Windows 10 +*Applies to:* + +- Windows 10 - Windows 11 The operating system deployment functionality of [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831764(v=ws.11)) (WDS) is being partially deprecated. Starting with Windows 11, workflows that rely on **boot.wim** from installation media or on running Windows Setup in WDS mode will no longer be supported. @@ -38,7 +39,7 @@ The table below provides support details for specific deployment scenarios (Boot ## Reason for the change -Alternatives to WDS, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experience for deploying Windows images. +Alternatives to WDS, such as [Microsoft Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experience for deploying Windows images. ## Not affected @@ -53,7 +54,7 @@ You can still run Windows Setup from a network share. Workflows that use a custo - Windows Server 2022 workflows that rely on **boot.wim** from installation media will show a non-blocking deprecation notice. The notice can be dismissed, and currently the workflow isn't blocked. - Windows Server workflows after Windows Server 2022 that rely on **boot.wim** from installation media are blocked. -If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version isn't supported, deprecated, or blocked, it's recommended that you use deployment tools such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. +If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version isn't supported, deprecated, or blocked, it's recommended that you use deployment tools such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. ## Also see diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md index d7d8c65cc3..677807d5c7 100644 --- a/windows/deployment/windows-10-deployment-posters.md +++ b/windows/deployment/windows-10-deployment-posters.md @@ -9,13 +9,14 @@ ms.prod: windows-client ms.technology: itpro-deploy ms.localizationpriority: medium ms.topic: reference -ms.date: 10/31/2022 +ms.date: 11/23/2022 --- # Windows 10 deployment process posters -**Applies to** -- Windows 10 +*Applies to:* + +- Windows 10 The following posters step through various options for deploying Windows 10 with Windows Autopilot or Microsoft Configuration Manager. diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index 4627e3d824..18e44ca25b 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -7,15 +7,15 @@ author: frankroj ms.prod: windows-client ms.localizationpriority: medium ms.topic: article -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # Windows 10 deployment scenarios -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 To successfully deploy the Windows 10 operating system in your organization, it's important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Key tasks include choosing among these scenarios and understanding the capabilities and limitations of each. @@ -55,9 +55,9 @@ The following tables summarize various Windows 10 deployment scenarios. The scen |[Refresh](#computer-refresh)|Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. | [Refresh a Windows 7 computer with Windows 10](/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10)
[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager)| |[Replace](#computer-replace)|Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device.| [Replace a Windows 7 computer with a Windows 10 computer](/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer)
[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](/windows/deployment/deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager)| ->[!IMPORTANT] ->The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
->Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS. +> [!IMPORTANT] +> The Windows Autopilot and Subscription Activation scenarios require that the beginning OS be Windows 10 version 1703, or later.
+> Except for clean install scenarios such as traditional bare metal and Windows Autopilot, all the methods described can optionally migrate apps and settings to the new OS. ## Modern deployment methods @@ -86,19 +86,19 @@ Scenarios that support in-place upgrade with some other procedures include chang - **Legacy BIOS to UEFI booting**: To perform an in-place upgrade on a UEFI-capable system that currently boots using legacy BIOS, first perform the in-place upgrade to Windows 10, maintaining the legacy BIOS boot mode. Windows 10 doesn't require UEFI, so it will work fine to upgrade a system using legacy BIOS emulation. After the upgrade, if you wish to enable Windows 10 features that require UEFI (such as Secure Boot), you can convert the system disk to a format that supports UEFI boot using the [MBR2GPT](./mbr-to-gpt.md) tool. Note: [UEFI specification](http://www.uefi.org/specifications) requires GPT disk layout. After the disk has been converted, you must also configure the firmware to boot in UEFI mode. -- **Non-Microsoft disk encryption software**: While devices encrypted with BitLocker can easily be upgraded, more work is necessary for non-Microsoft disk encryption tools. Some ISVs will provide instructions on how to integrate their software into the in-place upgrade process. Check with your ISV to see if they have instructions. The following articles provide details on how to provision encryption drivers for use during Windows Setup via the ReflectDrivers setting: - - [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) - - [Windows Setup Command-Line Options](/windows-hardware/manufacture/desktop/windows-setup-command-line-options) +- **Non-Microsoft disk encryption software**: While devices encrypted with BitLocker can easily be upgraded, more work is necessary for non-Microsoft disk encryption tools. Some ISVs will provide instructions on how to integrate their software into the in-place upgrade process. Check with your ISV to see if they have instructions. The following articles provide details on how to provision encryption drivers for use during Windows Setup via the ReflectDrivers setting: + - [Windows Setup Automation Overview](/windows-hardware/manufacture/desktop/windows-setup-automation-overview) + - [Windows Setup Command-Line Options](/windows-hardware/manufacture/desktop/windows-setup-command-line-options) There are some situations where you can't use in-place upgrade; in these situations, you can use traditional deployment (wipe-and-load) instead. Examples of these situations include: -- Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process can't change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. +- Changing from Windows 7, Windows 8, or Windows 8.1 x86 to Windows 10 x64. The upgrade process can't change from a 32-bit operating system to a 64-bit operating system, because of possible complications with installed applications and drivers. -- Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. +- Windows To Go and Boot from VHD installations. The upgrade process is unable to upgrade these installations. Instead, new installations would need to be performed. -- Updating existing images. It can be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image. But, it's not supported. Preparing an upgraded OS via `Sysprep.exe` before capturing an image isn't supported and won't work. When `Sysprep.exe` detects the upgraded OS, it will fail. +- Updating existing images. It can be tempting to try to upgrade existing Windows 7, Windows 8, or Windows 8.1 images to Windows 10 by installing the old image, upgrading it, and then recapturing the new Windows 10 image. But, it's not supported. Preparing an upgraded OS via `Sysprep.exe` before capturing an image isn't supported and won't work. When `Sysprep.exe` detects the upgraded OS, it will fail. -- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS. If you use dual-boot or multi-boot systems with multiple operating systems (not using virtual machines for the second and subsequent operating systems), then extra care should be taken. +- Dual-boot and multi-boot systems. The upgrade process is designed for devices running a single OS. If you use dual-boot or multi-boot systems with multiple operating systems (not using virtual machines for the second and subsequent operating systems), then extra care should be taken. ## Dynamic provisioning @@ -106,7 +106,7 @@ For new PCs, organizations have historically replaced the version of Windows inc The goal of dynamic provisioning is to take a new PC out of the box, turn it on, and transform it into a productive organization device, with minimal time and effort. The types of transformations that are available include: -### Windows 10 Subscription Activation +### Windows 10 Subscription Activation Windows 10 Subscription Activation is a dynamic deployment method that enables you to change the SKU from Pro to Enterprise with no keys and no reboots. For more information about Subscription Activation, see [Windows 10 Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation). @@ -122,17 +122,17 @@ These scenarios can be used to enable "choose your own device" (CYOD) programs. While the initial Windows 10 release includes various provisioning settings and deployment mechanisms, provisioning settings and deployment mechanisms will continue to be enhanced and extended based on feedback from organizations. As with all Windows features, organizations can submit suggestions for more features through the Windows Feedback app or through their Microsoft Support contacts. -## Traditional deployment: +## Traditional deployment -New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md), and [Microsoft Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). +New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Microsoft Deployment Toolkit](./deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md), and [Microsoft Configuration Manager](deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md). With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important, and will continue to be available to organizations that need them. The traditional deployment scenario can be divided into different sub-scenarios. These sub-scenarios are explained in detail in the following sections, but the following list provides a brief summary: -- **New computer.** A bare-metal deployment of a new machine. -- **Computer refresh.** A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup). -- **Computer replace.** A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup). +- **New computer**: A bare-metal deployment of a new machine. +- **Computer refresh**: A reinstall of the same machine (with user-state migration and an optional full Windows Imaging (WIM) image backup). +- **Computer replace**: A replacement of the old machine with a new machine (with user-state migration and an optional full WIM image backup). ### New computer @@ -140,13 +140,13 @@ Also called a "bare metal" deployment. This scenario occurs when you have a blan The deployment process for the new machine scenario is as follows: -1. Start the setup from boot media (CD, USB, ISO, or PXE). +1. Start the setup from boot media (CD, USB, ISO, or PXE). -2. Wipe the hard disk clean and create new volume(s). +2. Wipe the hard disk clean and create new volume(s). -3. Install the operating system image. +3. Install the operating system image. -4. Install other applications (as part of the task sequence). +4. Install other applications (as part of the task sequence). After you follow these steps, the computer is ready for use. @@ -156,17 +156,17 @@ A refresh is sometimes called wipe-and-load. The process is normally initiated i The deployment process for the wipe-and-load scenario is as follows: -1. Start the setup on a running operating system. +1. Start the setup on a running operating system. -2. Save the user state locally. +2. Save the user state locally. -3. Wipe the hard disk clean (except for the folder containing the backup). +3. Wipe the hard disk clean (except for the folder containing the backup). -4. Install the operating system image. +4. Install the operating system image. -5. Install other applications. +5. Install other applications. -6. Restore the user state. +6. Restore the user state. After you follow these steps, the machine is ready for use. @@ -176,9 +176,9 @@ A computer replace is similar to the refresh scenario. However, since we're repl The deployment process for the replace scenario is as follows: -1. Save the user state (data and settings) on the server through a backup job on the running operating system. +1. Save the user state (data and settings) on the server through a backup job on the running operating system. -2. Deploy the new computer as a bare-metal deployment. +2. Deploy the new computer as a bare-metal deployment. > [!NOTE] > In some situations, you can use the replace scenario even if the target is the same machine. For example, you can use replace if you want to modify the disk layout from the master boot record (MBR) to the GUID partition table (GPT), which will allow you to take advantage of the Unified Extensible Firmware Interface (UEFI) functionality. You can also use replace if the disk needs to be repartitioned since user data needs to be transferred off the disk. diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index 67864fbe6c..972ef1adaf 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -3,7 +3,7 @@ title: Windows 10/11 Enterprise E3 in CSP description: Describes Windows 10/11 Enterprise E3, an offering that delivers, by subscription, the features of Windows 10/11 Enterprise edition. ms.prod: windows-client ms.localizationpriority: medium -ms.date: 10/31/2022 +ms.date: 11/23/2022 author: frankroj ms.author: frankroj manager: aaroncz @@ -15,16 +15,17 @@ ms.technology: itpro-deploy # Windows 10/11 Enterprise E3 in CSP -Applies to: +*Applies to:* + - Windows 10 - Windows 11 -Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. With the release of Windows 11, Windows 10/11 Enterprise E3 in CSP is available. +Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. With the release of Windows 11, Windows 10/11 Enterprise E3 in CSP is available. Windows 10/11 Enterprise E3 in CSP delivers, by subscription, exclusive features reserved for Windows 10 or Windows 11 Enterprise editions. This offering is available through the Cloud Solution Provider (CSP) channel via the Partner Center as an online service. Windows 10/11 Enterprise E3 in CSP provides a flexible, per-user subscription for small and medium-sized organizations (from one to hundreds of users). To take advantage of this offering, you must have the following prerequisites: -- Windows 10 Pro, version 1607 (Windows 10 Anniversary Update) or later (or Windows 11), installed and activated, on the devices to be upgraded. -- Azure Active Directory (Azure AD) available for identity management +- Windows 10 Pro, version 1607 (Windows 10 Anniversary Update) or later (or Windows 11), installed and activated, on the devices to be upgraded. +- Azure Active Directory (Azure AD) available for identity management You can move from Windows 10 Pro or Windows 11 Pro to Windows 10 Enterprise or Windows 11 Enterprise more easily than ever before with no keys and no reboots. After one of your users enters the Azure AD credentials associated with a Windows 10/11 Enterprise E3 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise or Windows 11 Pro to Windows 11 Enterprise, and all the appropriate Enterprise features are unlocked. When a subscription license expires or is transferred to another user, the Enterprise device seamlessly steps back down to Windows 10 Pro or Windows 11 Pro. @@ -32,22 +33,22 @@ Previously, only organizations with a Microsoft Volume Licensing Agreement could When you purchase Windows 10/11 Enterprise E3 via a partner, you get the following benefits: -- **Windows 10/11 Enterprise edition**. Devices currently running Windows 10 Pro or Windows 11 Pro can get Windows 10/11 Enterprise Current Branch (CB) or Current Branch for Business (CBB). This benefit doesn't include Long Term Service Branch (LTSB). -- **Support from one to hundreds of users**. Although the Windows 10/11 Enterprise E3 in CSP program doesn't have a limitation on the number of licenses an organization can have, the program is designed for small- and medium-sized organizations. -- **Deploy on up to five devices**. For each user covered by the license, you can deploy Windows 10 Enterprise edition on up to five devices. -- **Roll back to Windows 10/11 Pro at any time**. When a user's subscription expires or is transferred to another user, the Windows 10/11 Enterprise device reverts seamlessly to Windows 10/11 Pro edition (after a grace period of up to 90 days). -- **Monthly, per-user pricing model**. This makes Windows 10/11 Enterprise E3 affordable for any organization. -- **Move licenses between users**. Licenses can be quickly and easily reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. +- **Windows 10/11 Enterprise edition**. Devices currently running Windows 10 Pro or Windows 11 Pro can get Windows 10/11 Enterprise Current Branch (CB) or Current Branch for Business (CBB). This benefit doesn't include Long Term Service Branch (LTSB). +- **Support from one to hundreds of users**. Although the Windows 10/11 Enterprise E3 in CSP program doesn't have a limitation on the number of licenses an organization can have, the program is designed for small- and medium-sized organizations. +- **Deploy on up to five devices**. For each user covered by the license, you can deploy Windows 10 Enterprise edition on up to five devices. +- **Roll back to Windows 10/11 Pro at any time**. When a user's subscription expires or is transferred to another user, the Windows 10/11 Enterprise device reverts seamlessly to Windows 10/11 Pro edition (after a grace period of up to 90 days). +- **Monthly, per-user pricing model**. This makes Windows 10/11 Enterprise E3 affordable for any organization. +- **Move licenses between users**. Licenses can be quickly and easily reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. How does the Windows 10/11 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance? -- [Microsoft Volume Licensing](https://www.microsoft.com/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. -- [Software Assurance](https://www.microsoft.com/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: +- [Microsoft Volume Licensing](https://www.microsoft.com/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. +- [Software Assurance](https://www.microsoft.com/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: - - **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits. - - **Training**. These benefits include training vouchers, online e-learning, and a home use program. - - **Support**. These benefits include 24x7 problem resolution support, backup capabilities for disaster recovery, System Center Global Service Monitor, and a passive secondary instance of SQL Server. - - **Specialized**. These benefits include step-up licensing availability (which enables you to migrate software from an earlier edition to a higher-level edition) and to spread license and Software Assurance payments across three equal, annual sums. + - **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits. + - **Training**. These benefits include training vouchers, online e-learning, and a home use program. + - **Support**. These benefits include 24x7 problem resolution support, backup capabilities for disaster recovery, System Center Global Service Monitor, and a passive secondary instance of SQL Server. + - **Specialized**. These benefits include step-up licensing availability (which enables you to migrate software from an earlier edition to a higher-level edition) and to spread license and Software Assurance payments across three equal, annual sums. In addition, in Windows 10/11 Enterprise E3 in CSP, a partner can manage your licenses for you. With Software Assurance, you, the customer, manage your own licenses. @@ -60,15 +61,15 @@ In summary, the Windows 10/11 Enterprise E3 in CSP program is an upgrade offerin Windows 10 Enterprise edition has many features that are unavailable in Windows 10 Pro. Table 1 lists the Windows 10 Enterprise features not found in Windows 10 Pro. Many of these features are security-related, whereas others enable finer-grained device management. -*Table 1. Windows 10 Enterprise features not found in Windows 10 Pro* +### Table 1. Windows 10 Enterprise features not found in Windows 10 Pro |Feature|Description| |--- |--- | -|Credential Guard|Credential Guard uses virtualization-based security to help protect security secrets so that only privileged system software can access them. Examples of security secrets that can be protected include NTLM password hashes and Kerberos Ticket Granting Tickets. This protection helps prevent Pass-the-Hash or Pass-the-Ticket attacks.

Credential Guard has the following features:

  • **Hardware-level security**. Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.
  • **Virtualization-based security**. Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.
  • **Improved protection against persistent threats**. Credential Guard works with other technologies (for example, Device Guard) to help provide further protection against attacks, no matter how persistent.
  • **Improved manageability**. Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.

    For more information, see [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard).

    *Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*| -|Device Guard|This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, they'll be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.

    Device Guard protects in the following ways:

  • Helps protect against malware
  • Helps protect the Windows system core from vulnerability and zero-day exploits
  • Allows only trusted apps to run

    For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).| -|AppLocker management|This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

    For more information, see [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).| -|Application Virtualization (App-V)|This feature makes applications available to end users without installing the applications directly on users' devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.

    For more information, see [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started).| -|User Experience Virtualization (UE-V)|With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share.

    When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.

    UE-V provides the following features:

  • Specify which application and Windows settings synchronize across user devices
  • Deliver the settings anytime and anywhere users work throughout the enterprise
  • Create custom templates for your third-party or line-of-business applications
  • Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state

    For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows).| +|Credential Guard|Credential Guard uses virtualization-based security to help protect security secrets so that only privileged system software can access them. Examples of security secrets that can be protected include NTLM password hashes and Kerberos Ticket Granting Tickets. This protection helps prevent Pass-the-Hash or Pass-the-Ticket attacks.

    Credential Guard has the following features:

  • **Hardware-level security** - Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.
  • **Virtualization-based security** - Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.
  • **Improved protection against persistent threats** - Credential Guard works with other technologies (for example, Device Guard) to help provide further protection against attacks, no matter how persistent.
  • **Improved manageability** - Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.

    For more information, see [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard).

    *Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*| +|Device Guard|This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, they'll be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.

    Device Guard protects in the following ways:
  • Helps protect against malware
  • Helps protect the Windows system core from vulnerability and zero-day exploits
  • Allows only trusted apps to run

    For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).| +|AppLocker management|This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

    For more information, see [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).| +|Application Virtualization (App-V)|This feature makes applications available to end users without installing the applications directly on users' devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.

    For more information, see [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started).| +|User Experience Virtualization (UE-V)|With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share.

    When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.

    UE-V provides the following features:
  • Specify which application and Windows settings synchronize across user devices
  • Deliver the settings anytime and anywhere users work throughout the enterprise
  • Create custom templates for your third-party or line-of-business applications
  • Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state

    For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows).| |Managed User Experience|This feature helps customize and lock down a Windows device's user interface to restrict it to a specific task. For example, you can configure a device for a controlled scenario such as a kiosk or classroom device. The user experience would be automatically reset once a user signs off. You can also restrict access to services including Cortana or the Windows Store, and manage Start layout options, such as:
  • Removing and preventing access to the Shut Down, Restart, Sleep, and Hibernate commands
  • Removing Log Off (the User tile) from the Start menu
  • Removing frequent programs from the Start menu
  • Removing the All Programs list from the Start menu
  • Preventing users from customizing their Start screen
  • Forcing Start menu to be either full-screen size or menu size
  • Preventing changes to Taskbar and Start menu settings| ## Deployment of Windows 10/11 Enterprise E3 licenses @@ -88,41 +89,39 @@ The following sections provide you with the high-level tasks that need to be per You can implement Credential Guard on Windows 10 Enterprise devices by turning on Credential Guard on these devices. Credential Guard uses Windows 10/11 virtualization-based security features (Hyper-V features) that must be enabled on each device before you can turn on Credential Guard. You can turn on Credential Guard by using one of the following methods: -- **Automated**. You can automatically turn on Credential Guard for one or more devices by using Group Policy. The Group Policy settings automatically add the virtualization-based security features and configure the Credential Guard registry settings on managed devices. +- **Automated**. You can automatically turn on Credential Guard for one or more devices by using Group Policy. The Group Policy settings automatically add the virtualization-based security features and configure the Credential Guard registry settings on managed devices. -- **Manual**. You can manually turn on Credential Guard by taking one of the following actions: +- **Manual**. You can manually turn on Credential Guard by taking one of the following actions: - - Add the virtualization-based security features by using Programs and Features or Deployment Image Servicing and Management (DISM). + - Add the virtualization-based security features by using Programs and Features or Deployment Image Servicing and Management (DISM). - - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). + - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). You can automate these manual steps by using a management tool such as Microsoft Configuration Manager. For more information about implementing Credential Guard, see the following resources: -- [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard) -- [PC OEM requirements for Device Guard and Credential Guard](/windows-hardware/design/device-experiences/oem-security-considerations) -- [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337) - - +- [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard) +- [PC OEM requirements for Device Guard and Credential Guard](/windows-hardware/design/device-experiences/oem-security-considerations) +- [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337) ### Device Guard Now that the devices have Windows 10/11 Enterprise, you can implement Device Guard on the Windows 10 Enterprise devices by performing the following steps: -1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To sign catalog files or code integrity policies internally, you'll either need a publicly issued code signing certificate (that you purchase) or an internal certificate authority (CA). If you choose to use an internal CA, you'll need to create a code signing certificate. +1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To sign catalog files or code integrity policies internally, you'll either need a publicly issued code signing certificate (that you purchase) or an internal certificate authority (CA). If you choose to use an internal CA, you'll need to create a code signing certificate. -2. **Create code integrity policies from "golden" computers**. When you have identified departments or roles that use distinctive or partly distinctive sets of hardware and software, you can set up "golden" computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each "golden" computer, you can create a code integrity policy and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. +2. **Create code integrity policies from "golden" computers**. When you have identified departments or roles that use distinctive or partly distinctive sets of hardware and software, you can set up "golden" computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each "golden" computer, you can create a code integrity policy and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. -3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use "audit mode" to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. +3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use "audit mode" to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. -4. **Create a "catalog file" for unsigned line-of-business (LOB) applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. In later steps, you can merge the catalog file's signature into your code integrity policy so that applications in the catalog will be allowed by the policy. +4. **Create a "catalog file" for unsigned line-of-business (LOB) applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. In later steps, you can merge the catalog file's signature into your code integrity policy so that applications in the catalog will be allowed by the policy. -5. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies. +5. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies. -6. **Deploy code integrity policies and catalog files**. After you confirm that you've completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of audit mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly. +6. **Deploy code integrity policies and catalog files**. After you confirm that you've completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of audit mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly. -7. **Enable desired hardware security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies. +7. **Enable desired hardware security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies. For more information about implementing Device Guard, see: @@ -139,19 +138,20 @@ For more information about AppLocker management by using Group Policy, see [AppL App-V requires an App-V server infrastructure to support App-V clients. The primary App-V components that you must have are as follows: -- **App-V server**. The App-V server provides App-V management, virtualized app publishing, app streaming, and reporting services. Each of these services can be run on one server or can be run individually on multiple servers. For example, you could have multiple streaming servers. App-V clients contact App-V servers to determine which apps are published to the user or device, and then run the virtualized app from the server. +- **App-V server**. The App-V server provides App-V management, virtualized app publishing, app streaming, and reporting services. Each of these services can be run on one server or can be run individually on multiple servers. For example, you could have multiple streaming servers. App-V clients contact App-V servers to determine which apps are published to the user or device, and then run the virtualized app from the server. -- **App-V sequencer**. The App-V sequencer is a typical client device that is used to sequence (capture) apps and prepare them for hosting from the App-V server. You install apps on the App-V sequencer, and the App-V sequencer software determines the files and registry settings that are changed during app installation. Then the sequencer captures these settings to create a virtualized app. +- **App-V sequencer**. The App-V sequencer is a typical client device that is used to sequence (capture) apps and prepare them for hosting from the App-V server. You install apps on the App-V sequencer, and the App-V sequencer software determines the files and registry settings that are changed during app installation. Then the sequencer captures these settings to create a virtualized app. -- **App-V client**. The App-V client must be enabled on any client device on which apps will be run from the App-V server. These will be the Windows 10/11 Enterprise E3 devices. +- **App-V client**. The App-V client must be enabled on any client device on which apps will be run from the App-V server. These will be the Windows 10/11 Enterprise E3 devices. For more information about implementing the App-V server, App-V sequencer, and App-V client, see the following resources: -- [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started) -- [Deploying the App-V server](/windows/application-management/app-v/appv-deploying-the-appv-server) -- [Deploying the App-V Sequencer and Configuring the Client](/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client) +- [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started) +- [Deploying the App-V server](/windows/application-management/app-v/appv-deploying-the-appv-server) +- [Deploying the App-V Sequencer and Configuring the Client](/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client) ### UE-V + UE-V requires server and client-side components that you'll need to download, activate, and install. These components include: - **UE-V service**. The UE-V service (when enabled on devices) monitors registered applications and Windows for any settings changes, then synchronizes those settings between devices. @@ -174,16 +174,16 @@ For more information about deploying UE-V, see the following resources: The Managed User Experience feature is a set of Windows 10 Enterprise edition features and corresponding settings that you can use to manage user experience. Table 2 describes the Managed User Experience settings (by category), which are only available in Windows 10 Enterprise edition. The management methods used to configure each feature depend on the feature. Some features are configured by using Group Policy, while others are configured by using Windows PowerShell, Deployment Image Servicing and Management (DISM), or other command-line tools. For the Group Policy settings, you must have AD DS with the Windows 10 Enterprise devices joined to your AD DS domain. -*Table 2. Managed User Experience features* +#### Table 2. Managed User Experience features | Feature | Description | |------------------|-----------------| | Start layout customization | You can deploy a customized Start layout to users in a domain. No reimaging is required, and the Start layout can be updated simply by overwriting the .xml file that contains the layout. The XML file enables you to customize Start layouts for different departments or organizations, with minimal management overhead.
    For more information on these settings, see [Customize Windows 10 Start and taskbar with Group Policy](/windows/configuration/customize-windows-10-start-screens-by-using-group-policy). | -| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it can't recover.
    For more information on these settings, see [Unbranded Boot](/windows-hardware/customize/enterprise/unbranded-boot). | -| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown.
    For more information on these settings, see [Custom Logon](/windows-hardware/customize/enterprise/custom-logon). | -| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell.
    For more information on these settings, see [Shell Launcher](/windows-hardware/customize/enterprise/shell-launcher). | -| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This isn't desirable on devices intended for a dedicated purpose.
    For more information on these settings, see [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter). | -| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume.
    For more information on these settings, see [Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter). | +| Unbranded boot | You can suppress Windows elements that appear when Windows starts or resumes and can suppress the crash screen when Windows encounters an error from which it can't recover.
    For more information on these settings, see [Unbranded Boot](/windows-hardware/customize/enterprise/unbranded-boot). | +| Custom logon | You can use the Custom Logon feature to suppress Windows 10 UI elements that relate to the Welcome screen and shutdown screen. For example, you can suppress all elements of the Welcome screen UI and provide a custom logon UI. You can also suppress the Blocked Shutdown Resolver (BSDR) screen and automatically end applications while the OS waits for applications to close before a shutdown.
    For more information on these settings, see [Custom Logon](/windows-hardware/customize/enterprise/custom-logon). | +| Shell launcher | Enables Assigned Access to run only a classic Windows app via Shell Launcher to replace the shell.
    For more information on these settings, see [Shell Launcher](/windows-hardware/customize/enterprise/shell-launcher). | +| Keyboard filter | You can use Keyboard Filter to suppress undesirable key presses or key combinations. Normally, users can use certain Windows key combinations like Ctrl+Alt+Delete or Ctrl+Shift+Tab to control a device by locking the screen or using Task Manager to close a running application. This isn't desirable on devices intended for a dedicated purpose.
    For more information on these settings, see [Keyboard Filter](/windows-hardware/customize/enterprise/keyboardfilter). | +| Unified write filter | You can use Unified Write Filter (UWF) on your device to help protect your physical storage media, including most standard writable storage types that are supported by Windows, such as physical hard disks, solid-state drives, internal USB devices, external SATA devices, and so on. You can also use UWF to make read-only media appear to the OS as a writable volume.
    For more information on these settings, see [Unified Write Filter](/windows-hardware/customize/enterprise/unified-write-filter). | ## Related articles diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index 6668d42e52..66d08877b8 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -3,7 +3,7 @@ title: Windows 10 volume license media description: Learn about volume license media in Windows 10, and channels such as the Volume License Service Center (VLSC). ms.prod: windows-client ms.localizationpriority: medium -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.reviewer: manager: aaroncz ms.author: frankroj @@ -14,9 +14,9 @@ ms.technology: itpro-deploy # Windows 10 volume license media -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 With each release of Windows 10, volume license media is made available on the [Volume Licensing Service Center](https://www.microsoft.com/vlsc) (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. This article provides a description of volume license media, and describes some of the changes that have been implemented with the current release of Windows 10. @@ -29,7 +29,7 @@ When you select a product, for example "Windows 10 Enterprise" or "Windows 10 Ed > [!NOTE] > If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx). -Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. +Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. ### Language packs @@ -47,4 +47,4 @@ Features on demand is a method for adding features to your Windows 10 image that
    [Volume Activation for Windows 10](./volume-activation/volume-activation-windows-10.md)
    [Plan for volume activation](./volume-activation/plan-for-volume-activation-client.md)
    [VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) -
    [Download and burn an ISO file on the volume licensing site (VLSC)](/troubleshoot/windows-client/deployment/iso-file-on-vlsc) \ No newline at end of file +
    [Download and burn an ISO file on the volume licensing site (VLSC)](/troubleshoot/windows-client/deployment/iso-file-on-vlsc) diff --git a/windows/deployment/windows-10-missing-fonts.md b/windows/deployment/windows-10-missing-fonts.md index 3c0da5a490..364c23a213 100644 --- a/windows/deployment/windows-10-missing-fonts.md +++ b/windows/deployment/windows-10-missing-fonts.md @@ -7,12 +7,12 @@ author: frankroj ms.author: frankroj manager: aaroncz ms.topic: article -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # How to install fonts that are missing after upgrading to Windows client -**Applies to** +*Applies to:* - Windows 10 - Windows 11 @@ -36,7 +36,7 @@ For example, if you've an English, French, German, or Spanish version of Windows If you want to use these fonts, you can enable the optional feature to add them back to your system. The removal of these fonts is a permanent change in behavior for Windows client, and it will remain this way in future releases. -## Installing language-associated features via language settings: +## Installing language-associated features via language settings If you want to use the fonts from the optional feature and you know that you'll want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. Use the Settings app. @@ -57,7 +57,7 @@ Once you've added Hebrew to your language list, then the optional Hebrew font fe > [!NOTE] > The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. -## Install optional fonts manually without changing language settings: +## Install optional fonts manually without changing language settings If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index a33c6b3a90..3741412fbb 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -3,7 +3,7 @@ title: Step by step - Deploy Windows 10 in a test lab using MDT description: In this article, you'll learn how to deploy Windows 10 in a test lab using Microsoft Deployment Toolkit (MDT). ms.prod: windows-client ms.localizationpriority: medium -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.reviewer: manager: aaroncz ms.author: frankroj @@ -14,23 +14,26 @@ ms.technology: itpro-deploy # Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit -**Applies to** +*Applies to:* -- Windows 10 +- Windows 10 > [!IMPORTANT] -> This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: -- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) - -Complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide: -- [Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md) +> This guide leverages the proof of concept (PoC) environment configured using procedures in the following guide: +> +> [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) +> +> Complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide: +> +> [Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md) The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): + - **DC1**: A contoso.com domain controller, DNS server, and DHCP server. - **SRV1**: A dual-homed contoso.com domain member server, DNS server, and default gateway providing NAT service for the PoC network. - **PC1**: A contoso.com member computer running Windows 7, Windows 8, or Windows 8.1 that has been shadow-copied from a physical computer on your corporate network. -This guide uses the Hyper-V server role. If you don't complete all steps in a single session, consider using [checkpoints](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn818483(v=ws.11)) and [saved states](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee247418(v=ws.10)) to pause, resume, or restart your work. +This guide uses the Hyper-V server role. If you don't complete all steps in a single session, consider using [checkpoints](/virtualization/hyper-v-on-windows/user-guide/checkpoints) to pause, resume, or restart your work. ## In this guide @@ -50,10 +53,13 @@ Topics and procedures in this guide are summarized in the following table. An es ## About MDT -MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods. +MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods. + - LTI is the deployment method used in the current guide, requiring only MDT and performed with a minimum amount of user interaction. + - ZTI is fully automated, requiring no user interaction and is performed using MDT and Microsoft Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment. -- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and Microsoft Configuration Manager. + +- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and Microsoft Configuration Manager. ## Install MDT @@ -80,11 +86,12 @@ MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch A reference image serves as the foundation for Windows 10 devices in your organization. -1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: +1. In [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md), the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and enter the following command: ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso ``` + 2. On SRV1, verify that the Windows Enterprise installation DVD is mounted as drive letter D. 3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, select **Start**, type **deployment**, and then select **Deployment Workbench**. @@ -108,7 +115,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 9. Right-click the **Windows 10** folder created in the previous step, and then select **Import Operating System**. -10. Use the following settings for the Import Operating System Wizard: +10. Use the following settings for the Import Operating System Wizard: - OS Type: **Full set of source files**
    - Source: **D:\\**
    - Destination: **W10Ent_x64**
    @@ -119,6 +126,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi For purposes of this test lab, we'll only add the prerequisite .NET Framework feature. Commercial applications (ex: Microsoft Office) won't be added to the deployment share. For information about adding applications, see the [Add applications](./deploy-windows-mdt/create-a-windows-10-reference-image.md#add-applications) section of the [Create a Windows 10 reference image](deploy-windows-mdt/create-a-windows-10-reference-image.md) article. 11. The next step is to create a task sequence to reference the operating system that was imported. To create a task sequence, right-click the **Task Sequences** node and then select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: **REFW10X64-001**
    - Task sequence name: **Windows 10 Enterprise x64 Default Image**
    - Task sequence comments: **Reference Build**
    @@ -143,7 +151,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi 16. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then select **Apply**. 17. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. - + > [!NOTE] > Since we are not installing applications in this test lab, there is no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you are also installing applications. @@ -211,7 +219,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi > [!TIP] > To copy the file, right-click the **LiteTouchPE_x86.iso** file and click **Copy** on SRV1, then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder and click **Paste**. -26. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: +26. Open a Windows PowerShell prompt on the Hyper-V host computer and enter the following commands: ```powershell New-VM REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB @@ -221,21 +229,21 @@ A reference image serves as the foundation for Windows 10 devices in your organi vmconnect localhost REFW10X64-001 ``` - The VM will require a few minutes to prepare devices and boot from the LiteTouchPE_x86.iso file. + The VM will require a few minutes to prepare devices and boot from the LiteTouchPE_x86.iso file. 27. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then select **Next**. 28. Accept the default values on the Capture Image page, and select **Next**. Operating system installation will complete after 5 to 10 minutes, and then the VM will reboot automatically. Allow the system to boot normally (don't press a key). The process is fully automated. - Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures: + Additional system restarts will occur to complete updating and preparing the operating system. Setup will complete the following procedures: - - Install the Windows 10 Enterprise operating system. - - Install added applications, roles, and features. - - Update the operating system using Windows Update (or WSUS if optionally specified). - - Stage Windows PE on the local disk. - - Run System Preparation (Sysprep) and reboot into Windows PE. - - Capture the installation to a Windows Imaging (WIM) file. - - Turn off the virtual machine.

    + - Install the Windows 10 Enterprise operating system. + - Install added applications, roles, and features. + - Update the operating system using Windows Update (or WSUS if optionally specified). + - Stage Windows PE on the local disk. + - Run System Preparation (Sysprep) and reboot into Windows PE. + - Capture the installation to a Windows Imaging (WIM) file. + - Turn off the virtual machine.

    This step requires from 30 minutes to 2 hours, depending on the speed of the Hyper-V host. After some time, you'll have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep. The image is located in the C:\MDTBuildLab\Captures folder on your deployment server (SRV1). The file name is **REFW10X64-001.wim**. @@ -244,6 +252,7 @@ A reference image serves as the foundation for Windows 10 devices in your organi This procedure will demonstrate how to deploy the reference image to the PoC environment using MDT. 1. On SRV1, open the MDT Deployment Workbench console, right-click **Deployment Shares**, and then select **New Deployment Share**. Use the following values in the New Deployment Share Wizard: + - **Deployment share path**: C:\MDTProd - **Share name**: MDTProd$ - **Deployment share description**: MDT Production @@ -259,7 +268,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 6. On the Image page, browse to the **C:\MDTBuildLab\Captures\REFW10X64-001.wim** file created in the previous procedure, select **Open**, and then select **Next**. -7. On the Setup page, select **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path**. +7. On the Setup page, select **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path**. 8. Under **Setup source directory**, browse to **C:\MDTBuildLab\Operating Systems\W10Ent_x64** select **OK** and then select **Next**. @@ -274,6 +283,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 1. Using the Deployment Workbench, right-click **Task Sequences** under the **MDT Production** node, select **New Folder** and create a folder with the name: **Windows 10**. 2. Right-click the **Windows 10** folder created in the previous step, and then select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-001 - Task sequence name: Windows 10 Enterprise x64 Custom Image - Task sequence comments: Production Image @@ -282,17 +292,18 @@ This procedure will demonstrate how to deploy the reference image to the PoC env - Specify Product Key: Don't specify a product key at this time - Full Name: Contoso - Organization: Contoso - - Internet Explorer home page: http://www.contoso.com - - Admin Password: pass@word1 - + - Internet Explorer home page: `http://www.contoso.com` + - Admin Password: pass@word1 + ### Configure the MDT production deployment share -1. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: +1. On SRV1, open an elevated Windows PowerShell prompt and enter the following commands: ```powershell copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\Bootstrap.ini" C:\MDTProd\Control\Bootstrap.ini -Force copy-item "C:\Program Files\Microsoft Deployment Toolkit\Templates\CustomSettings.ini" C:\MDTProd\Control\CustomSettings.ini -Force - ``` + ``` + 2. In the Deployment Workbench console on SRV1, right-click the **MDT Production** deployment share and then select **Properties**. 3. Select the **Rules** tab and replace the rules with the following text (don't select OK yet): @@ -367,7 +378,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env SkipBDDWelcome=YES ``` -5. Select **OK** when finished. +5. Select **OK** when finished. ### Update the deployment share @@ -404,12 +415,12 @@ This procedure will demonstrate how to deploy the reference image to the PoC env ### Deploy the client image -1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This configuration is just an artifact of the lab environment. In a typical deployment environment WDS wouldn't be installed on the default gateway. +1. Before using WDS to deploy a client image, you must temporarily disable the external network adapter on SRV1. This configuration is just an artifact of the lab environment. In a typical deployment environment WDS wouldn't be installed on the default gateway. > [!NOTE] - > Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, type **Get-NetIPAddress | ft interfacealias, ipaddress** + > Do not disable the *internal* network interface. To quickly view IP addresses and interface names configured on the VM, enter **`Get-NetIPAddress | ft interfacealias, ipaddress** in a PowerShell prompt. - Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and type the following command: + Assuming the external interface is named "Ethernet 2", to disable the *external* interface on SRV1, open a Windows PowerShell prompt on SRV1 and enter the following command: ```powershell Disable-NetAdapter "Ethernet 2" -Confirm:$false @@ -417,7 +428,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env >Wait until the disable-netadapter command completes before proceeding. -2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, type the following commands at an elevated Windows PowerShell prompt: +2. Next, switch to the Hyper-V host and open an elevated Windows PowerShell prompt. Create a generation 2 VM on the Hyper-V host that will load its OS using PXE. To create this VM, enter the following commands at an elevated Windows PowerShell prompt: ```powershell New-VM -Name "PC2" -NewVHDPath "c:\vhd\pc2.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 @@ -437,7 +448,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 5. In the Windows Deployment Wizard, choose the **Windows 10 Enterprise x64 Custom Image** and then select **Next**. -6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. Re-enabling the external network adapter is needed so the client can use Windows Update after operating system installation is complete. To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and type the following command: +6. After MDT lite touch installation has started, be sure to re-enable the external network adapter on SRV1. Re-enabling the external network adapter is needed so the client can use Windows Update after operating system installation is complete. To re-enable the external network interface, open an elevated Windows PowerShell prompt on SRV1 and enter the following command: ```powershell Enable-NetAdapter "Ethernet 2" @@ -453,7 +464,7 @@ This completes the demonstration of how to deploy a reference image to the netwo ## Refresh a computer with Windows 10 -This section will demonstrate how to export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings. The scenario will use PC1, a computer that was cloned from a physical device to a VM, as described in [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md). +This section will demonstrate how to export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings. The scenario will use PC1, a computer that was cloned from a physical device to a VM, as described in [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md). 1. If the PC1 VM isn't already running, then start and connect to it: @@ -462,7 +473,7 @@ This section will demonstrate how to export user data from an existing client co vmconnect localhost PC1 ``` -2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and performing additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +2. Switch back to the Hyper-V host and create a checkpoint for the PC1 VM so that it can easily be reverted to its current state for troubleshooting purposes and performing additional scenarios. Checkpoints are also known as snapshots. To create a checkpoint for the PC1 VM, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Checkpoint-VM -Name PC1 -SnapshotName BeginState @@ -472,7 +483,7 @@ This section will demonstrate how to export user data from an existing client co Specify **contoso\administrator** as the user name to ensure you don't sign on using the local administrator account. You must sign in with this account so that you have access to the deployment share. -4. Open an elevated command prompt on PC1 and type the following command: +4. Open an elevated command prompt on PC1 and enter the following command: ```cmd cscript.exe \\SRV1\MDTProd$\Scripts\Litetouch.vbs @@ -498,13 +509,13 @@ This section will demonstrate how to export user data from an existing client co 8. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share). -9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +9. Create another checkpoint for the PC1 VM so that you can review results of the computer refresh later. To create a checkpoint, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Checkpoint-VM -Name PC1 -SnapshotName RefreshState ``` -10. Restore the PC1 VM to its previous state in preparation for the replace procedure. To restore a checkpoint, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +10. Restore the PC1 VM to its previous state in preparation for the replace procedure. To restore a checkpoint, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Restore-VMSnapshot -VMName PC1 -Name BeginState -Confirm:$false @@ -516,15 +527,18 @@ This section will demonstrate how to export user data from an existing client co ## Replace a computer with Windows 10 -At a high level, the computer replace process consists of:
    +At a high level, the computer replace process consists of: + - A special replace task sequence that runs the USMT backup and an optional full Windows Imaging (WIM) backup.
    - A standard OS deployment on a new computer. At the end of the deployment, the USMT backup from the old computer is restored. ### Create a backup-only task sequence 1. On SRV1, in the deployment workbench console, right-click the MDT Production deployment share, select **Properties**, select the **Rules** tab, and change the line **SkipUserData=YES** to **SkipUserData=NO**. + 2. Select **OK**, right-click **MDT Production**, select **Update Deployment Share** and accept the default options in the wizard to update the share. -3. Type the following commands at an elevated Windows PowerShell prompt on SRV1: + +3. enter the following commands at an elevated Windows PowerShell prompt on SRV1: ```powershell New-Item -Path C:\MigData -ItemType directory @@ -533,41 +547,52 @@ At a high level, the computer replace process consists of:
    ``` 4. On SRV1 in the deployment workbench, under **MDT Production**, right-click the **Task Sequences** node, and select **New Folder**. + 5. Name the new folder **Other**, and complete the wizard using default options. + 6. Right-click the **Other** folder and then select **New Task Sequence**. Use the following values in the wizard: + - **Task sequence ID**: REPLACE-001 - **Task sequence name**: Backup Only Task Sequence - **Task sequence comments**: Run USMT to back up user data and settings - **Template**: Standard Client Replace Task Sequence (note: this template isn't the default template) + 7. Accept defaults for the rest of the wizard and then select **Finish**. The replace task sequence will skip OS selection and settings. -8. Open the new task sequence that was created and review it. Note the type of capture and backup tasks that are present. Select **OK** when you're finished reviewing the task sequence. + +8. Open the new task sequence that was created and review it. Note the enter of capture and backup tasks that are present. Select **OK** when you're finished reviewing the task sequence. ### Run the backup-only task sequence -1. If you aren't already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, type the following command at an elevated command prompt: +1. If you aren't already signed on to PC1 as **contoso\administrator**, sign in using this account. To verify the currently signed in account, enter the following command at an elevated command prompt: ```cmd whoami.exe ``` -2. To ensure a clean environment before running the backup task sequence, type the following commands at an elevated Windows PowerShell prompt on PC1: + +2. To ensure a clean environment before running the backup task sequence, enter the following commands at an elevated Windows PowerShell prompt on PC1: ```powershell Remove-Item c:\minint -recurse Remove-Item c:\_SMSTaskSequence -recurse Restart-Computer ``` -3. Sign in to PC1 using the contoso\administrator account, and then type the following command at an elevated command prompt: + +3. Sign in to PC1 using the contoso\administrator account, and then enter the following command at an elevated command prompt: ```cmd cscript.exe \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` 4. Complete the deployment wizard using the following settings: + - **Task Sequence**: Backup Only Task Sequence - **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1** - **Computer Backup**: Don't back up the existing computer. + 5. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and select the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks. + 6. On PC1, verify that **The user state capture was completed successfully** is displayed, and select **Finish** when the capture is complete. + 7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: ```cmd @@ -580,16 +605,16 @@ At a high level, the computer replace process consists of:
    -a--- 9/6/2016 11:34 AM 14248685 USMT.MIG ``` -### Deploy PC3 +### Deploy PC3 -1. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: +1. On the Hyper-V host, enter the following commands at an elevated Windows PowerShell prompt: ```powershell New-VM -Name "PC3" -NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 ``` -2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: +2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, enter the following command at an elevated Windows PowerShell prompt on SRV1: ```powershell Disable-NetAdapter "Ethernet 2" -Confirm:$false @@ -628,6 +653,7 @@ At a high level, the computer replace process consists of:
    ## Troubleshooting logs, events, and utilities Deployment logs are available on the client computer in the following locations: + - Before the image is applied: X:\MININT\SMSOSD\OSDLOGS - After the system drive has been formatted: C:\MININT\SMSOSD\OSDLOGS - After deployment: %WINDIR%\TEMP\DeploymentLogs From dfdf916b8b894ce6a4a9695a08d4a1034207f4ba Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 23 Nov 2022 21:15:14 -0500 Subject: [PATCH 048/324] Deploy root code block standardization plus style updates FINAL --- .../deployment/Windows-AutoPilot-EULA-note.md | 6 +- .../deployment/deploy-enterprise-licenses.md | 4 +- .../usmt/understanding-migration-xml-files.md | 5 +- .../usmt/usmt-what-does-usmt-migrate.md | 5 +- .../windows-10-poc-sc-config-mgr.md | 342 +++++++++++------- windows/deployment/windows-10-poc.md | 73 ++-- .../deployment/windows-10-pro-in-s-mode.md | 25 +- .../windows-10-subscription-activation.md | 6 +- .../windows-adk-scenarios-for-it-pros.md | 48 +-- .../windows-deployment-scenarios-and-tools.md | 143 +++----- 10 files changed, 373 insertions(+), 284 deletions(-) diff --git a/windows/deployment/Windows-AutoPilot-EULA-note.md b/windows/deployment/Windows-AutoPilot-EULA-note.md index bdcc134152..674bd00551 100644 --- a/windows/deployment/Windows-AutoPilot-EULA-note.md +++ b/windows/deployment/Windows-AutoPilot-EULA-note.md @@ -3,7 +3,7 @@ title: Windows Autopilot EULA dismissal – important information description: A notice about EULA dismissal through Windows Autopilot ms.prod: windows-client ms.localizationpriority: medium -ms.date: 10/31/2022 +ms.date: 11/23/2022 author: frankroj ms.author: frankroj manager: aaroncz @@ -13,8 +13,8 @@ ms.technology: itpro-deploy --- # Windows Autopilot EULA dismissal – important information ->[!IMPORTANT] ->The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). +> [!IMPORTANT] +> The information below isn't the EULA. It is a notice of awareness to the administrator that's configuring to skip End User License Agreement (EULA) during the OOBE (Out-of-Box Experience). Using this tool allows you to configure individual installations of Windows on devices managed by your organization. You may choose to suppress or hide certain set-up screens that are normally presented to users when setting up Windows, including the EULA acceptance screen. diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index cc2f4777f2..f19a79ea47 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -10,8 +10,8 @@ ms.localizationpriority: medium ms.topic: how-to ms.collection: highpri appliesto: - - Windows 10 - - Windows 11 + - ✅ Windows 10 + - ✅ Windows 11 ms.date: 11/23/2022 --- diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index 8862f18acc..64fe549a96 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -6,7 +6,7 @@ manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 11/23/2022 ms.topic: article ms.technology: itpro-deploy --- @@ -136,6 +136,9 @@ The default `MigUser.xml` file migrates the following data: > [!NOTE] > The asterisk (`*`) stands for zero or more characters. + > [!NOTE] + > The OpenDocument extensions (`*.odt`, `*.odp`, `*.ods`) that Microsoft Office applications can use aren't migrated by default. + The default `MigUser.xml` file doesn't migrate the following data: - Files tagged with both the **Hidden** and **System** attributes. diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index b4964f369a..9fac4ebca3 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -6,7 +6,7 @@ manager: aaroncz ms.author: frankroj ms.prod: windows-client author: frankroj -ms.date: 11/01/2022 +ms.date: 11/23/2022 ms.topic: article ms.technology: itpro-deploy --- @@ -78,6 +78,9 @@ This section describes the user data that USMT migrates by default, using the `M > [!NOTE] > The asterisk (`*`) stands for zero or more characters. + > [!NOTE] + > The OpenDocument extensions (`*.odt`, `*.odp`, `*.ods`) that Microsoft Office applications can use aren't migrated by default. + - **Access control lists.** USMT migrates access control lists (ACLs) for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named `File1.txt` that is **read-only** for **User1** and **read/write** for **User2**, these settings will still apply on the destination computer after the migration. > [!IMPORTANT] diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index d6cf61ec51..46c6a2b39c 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -9,16 +9,16 @@ manager: aaroncz ms.author: frankroj author: frankroj ms.topic: tutorial -ms.date: 10/31/2022 +ms.date: 11/23/2022 --- # Deploy Windows 10 in a test lab using Configuration Manager -*Applies to* +*Applies to:* - Windows 10 -> [!Important] +> [!IMPORTANT] > This guide uses the proof of concept (PoC) environment, and some settings that are configured in the following guides: > > - [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) @@ -59,7 +59,7 @@ The procedures in this guide are summarized in the following table. An estimate ## Install prerequisites -1. Before installing Microsoft Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: +1. Before installing Microsoft Configuration Manager, we must install prerequisite services and features. Enter the following command at an elevated Windows PowerShell prompt on SRV1: ```powershell Install-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ @@ -69,7 +69,7 @@ The procedures in this guide are summarized in the following table. An estimate > If the request to add features fails, retry the installation by typing the command again. 2. Download [SQL Server 2014 SP2](https://www.microsoft.com/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. -3. When you've downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: +3. When you've downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\SQLServer2014SP2-FullSlipstream-x64-ENU.iso @@ -77,7 +77,7 @@ The procedures in this guide are summarized in the following table. An estimate This command mounts the .ISO file to drive D on SRV1. -4. Type the following command at an elevated Windows PowerShell prompt on SRV1 to install SQL Server: +4. Enter the following command at an elevated Windows PowerShell prompt on SRV1 to install SQL Server: ```cmd D:\setup.exe /q /ACTION=Install /ERRORREPORTING="False" /FEATURES=SQLENGINE,RS,IS,SSMS,TOOLS,ADV_SSMS,CONN /INSTANCENAME=MSSQLSERVER /INSTANCEDIR="C:\Program Files\Microsoft SQL Server" /SQLSVCACCOUNT="NT AUTHORITY\System" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /SQLSVCSTARTUPTYPE=Automatic /AGTSVCACCOUNT="NT AUTHORITY\SYSTEM" /AGTSVCSTARTUPTYPE=Automatic /RSSVCACCOUNT="NT AUTHORITY\System" /RSSVCSTARTUPTYPE=Automatic /ISSVCACCOUNT="NT AUTHORITY\System" /ISSVCSTARTUPTYPE=Disabled /ASCOLLATION="Latin1_General_CI_AS" /SQLCOLLATION="SQL_Latin1_General_CP1_CI_AS" /TCPENABLED="1" /NPENABLED="1" /IAcceptSQLServerLicenseTerms @@ -101,7 +101,7 @@ The procedures in this guide are summarized in the following table. An estimate You should restart your computer to complete this process. ``` -5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: +5. Enter the following commands at an elevated Windows PowerShell prompt on SRV1: ```powershell New-NetFirewallRule -DisplayName "SQL Server" -Direction Inbound -Protocol TCP -LocalPort 1433 -Action allow @@ -123,11 +123,11 @@ The procedures in this guide are summarized in the following table. An estimate Stop-Process -Name Explorer ``` -1. Download [Microsoft Configuration Manager (current branch)](https://www.microsoft.com/evalcenter/evaluate-microsoft-endpoint-configuration-manager) and extract the contents on SRV1. +2. Download [Microsoft Configuration Manager (current branch)](https://www.microsoft.com/evalcenter/evaluate-microsoft-endpoint-configuration-manager) and extract the contents on SRV1. -1. Open the file, enter **C:\configmgr** for **Unzip to folder**, and select **Unzip**. The `C:\configmgr` directory will be automatically created. Select **OK** and then close the **WinZip Self-Extractor** dialog box when finished. +3. Open the file, enter **C:\configmgr** for **Unzip to folder**, and select **Unzip**. The `C:\configmgr` directory will be automatically created. Select **OK** and then close the **WinZip Self-Extractor** dialog box when finished. -1. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: +4. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: ```powershell Get-Service Winmgmt @@ -156,36 +156,48 @@ The procedures in this guide are summarized in the following table. An estimate If the WMI service isn't started, attempt to start it or reboot the computer. If WMI is running but errors are present, see [WMIDiag](https://blogs.technet.microsoft.com/askperf/2015/05/12/wmidiag-2-2-is-here/) for troubleshooting information. -1. To extend the Active Directory schema, type the following command at an elevated Windows PowerShell prompt: +5. To extend the Active Directory schema, enter the following command at an elevated Windows PowerShell prompt: ```cmd C:\configmgr\SMSSETUP\BIN\X64\extadsch.exe ``` -1. Temporarily switch to the DC1 VM, and type the following command at an elevated command prompt on DC1: +6. Temporarily switch to the DC1 VM, and enter the following command at an elevated command prompt on DC1: ```cmd adsiedit.msc ``` -1. Right-click **ADSI Edit**, select **Connect to**, select **Default (Domain or server that you logged in to)** under **Computer** and then select **OK**. -1. Expand **Default naming context**>**DC=contoso,DC=com**, and then in the console tree right-click **CN=System**, point to **New**, and then select **Object**. -1. Select **container** and then select **Next**. -1. Next to **Value**, type **System Management**, select **Next**, and then select **Finish**. -1. Right-click **CN=system Management** and then select **Properties**. -1. On the **Security** tab, select **Add**, select **Object Types**, select **Computers**, and select **OK**. -1. Under **Enter the object names to select**, type **SRV1** and select **OK**. -1. The **SRV1** computer account will be highlighted, select **Allow** next to **Full control**. -1. Select **Advanced**, select **SRV1 (CONTOSO\SRV1$)** and select **Edit**. -1. Next to **Applies to**, choose **This object and all descendant objects**, and then select **OK** three times. -1. Close the ADSI Edit console and switch back to SRV1. -1. To start Configuration Manager installation, type the following command at an elevated Windows PowerShell prompt on SRV1: +7. Right-click **ADSI Edit**, select **Connect to**, select **Default (Domain or server that you logged in to)** under **Computer** and then select **OK**. + +8. Expand **Default naming context**>**DC=contoso,DC=com**, and then in the console tree right-click **CN=System**, point to **New**, and then select **Object**. + +9. Select **container** and then select **Next**. + +10. Next to **Value**, enter **System Management**, select **Next**, and then select **Finish**. + +11. Right-click **CN=system Management** and then select **Properties**. + +12. On the **Security** tab, select **Add**, select **Object Types**, select **Computers**, and select **OK**. + +13. Under **Enter the object names to select**, enter **SRV1** and select **OK**. + +14. The **SRV1** computer account will be highlighted, select **Allow** next to **Full control**. + +15. Select **Advanced**, select **SRV1 (CONTOSO\SRV1$)** and select **Edit**. + +16. Next to **Applies to**, choose **This object and all descendant objects**, and then select **OK** three times. + +17. Close the ADSI Edit console and switch back to SRV1. + +18. To start Configuration Manager installation, enter the following command at an elevated Windows PowerShell prompt on SRV1: ```cmd C:\configmgr\SMSSETUP\BIN\X64\Setup.exe ``` -1. Provide the following information in the Configuration Manager Setup Wizard: +19. Provide the following information in the Configuration Manager Setup Wizard: + - **Before You Begin**: Read the text and select *Next*. - **Getting Started**: Choose **Install a Configuration Manager primary site** and select the **Use typical installation options for a stand-alone primary site** checkbox. - Select **Yes** in response to the popup window. @@ -205,7 +217,7 @@ The procedures in this guide are summarized in the following table. An estimate Depending on the speed of the Hyper-V host and resources allocated to SRV1, installation can require approximately one hour. Select **Close** when installation is complete. -1. If desired, re-enable IE Enhanced Security Configuration at this time on SRV1: +20. If desired, re-enable IE Enhanced Security Configuration at this time on SRV1: ```powershell Set-ItemProperty -Path $AdminKey -Name "IsInstalled" -Value 1 @@ -216,24 +228,30 @@ The procedures in this guide are summarized in the following table. An estimate > [!IMPORTANT] > This step requires an MSDN subscription or volume licence agreement. For more information, see [Ready for Windows 10: MDOP 2015 and more tools are now available](https://blogs.technet.microsoft.com/windowsitpro/2015/08/17/ready-for-windows-10-mdop-2015-and-more-tools-are-now-available/). + 1. Download the [Microsoft Desktop Optimization Pack 2015](https://msdn.microsoft.com/subscriptions/downloads/#ProductFamilyId=597) to the Hyper-V host using an MSDN subscription. Download the .ISO file (mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso, 2.79 GB) to the C:\VHD directory on the Hyper-V host. -2. Type the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1: +2. Enter the following command at an elevated Windows PowerShell prompt on the Hyper-V host to mount the MDOP file on SRV1: ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\mu_microsoft_desktop_optimization_pack_2015_x86_x64_dvd_5975282.iso ``` -3. Type the following command at an elevated Windows PowerShell prompt on SRV1: +3. Enter the following command at an elevated Windows PowerShell prompt on SRV1: ```cmd D:\DaRT\DaRT 10\Installers\en-us\x64\MSDaRT100.msi ``` 4. Install DaRT 10 using default settings. -5. Type the following commands at an elevated Windows PowerShell prompt on SRV1: + +5. Enter the following commands at an elevated Windows PowerShell prompt on SRV1: ```powershell Copy-Item "C:\Program Files\Microsoft DaRT\v10\Toolsx64.cab" -Destination "C:\Program Files\Microsoft Deployment Toolkit\Templates\Distribution\Tools\x64" @@ -246,7 +264,7 @@ This section contains several procedures to support Zero Touch installation with ### Create a folder structure -1. Type the following commands at a Windows PowerShell prompt on SRV1: +1. Enter the following commands at a Windows PowerShell prompt on SRV1: ```powershell New-Item -ItemType Directory -Path "C:\Sources\OSD\Boot" @@ -261,56 +279,78 @@ This section contains several procedures to support Zero Touch installation with ### Enable MDT ConfigMgr integration -1. On SRV1, select **Start**, type `configmgr`, and then select **Configure ConfigMgr Integration**. -2. Type `PS1` as the **Site code**, and then select **Next**. +1. On SRV1, select **Start**, enter `configmgr`, and then select **Configure ConfigMgr Integration**. + +2. Enter `PS1` as the **Site code**, and then select **Next**. + 3. Verify **The process completed successfully** is displayed, and then select **Finish**. ### Configure client settings -1. On SRV1, select **Start**, type **configuration manager**, right-click **Configuration Manager Console**, and then select **Pin to Taskbar**. +1. On SRV1, select **Start**, enter **configuration manager**, right-click **Configuration Manager Console**, and then select **Pin to Taskbar**. + 2. Select **Desktop**, and then launch the Configuration Manager console from the taskbar. + 3. If the console notifies you that an update is available, select **OK**. It isn't necessary to install updates to complete this lab. + 4. In the console tree, open the **Administration** workspace (in the lower left corner) and select **Client Settings**. + 5. In the display pane, double-click **Default Client Settings**. -6. Select **Computer Agent**, next to **Organization name displayed in Software Center** type **Contoso**, and then select **OK**. + +6. Select **Computer Agent**, next to **Organization name displayed in Software Center** enter **Contoso**, and then select **OK**. ### Configure the network access account 1. in the **Administration** workspace, expand **Site Configuration** and select **Sites**. + 2. On the **Home** ribbon at the top of the console window, select **Configure Site Components** and then select **Software Distribution**. + 3. On the **Network Access Account** tab, choose **Specify the account that accesses network locations**. + 4. Select the yellow starburst and then select **New Account**. -5. Select **Browse** and then under **Enter the object name to select**, type **CM_NAA** and select **OK**. -6. Next to **Password** and **Confirm Password**, type **pass\@word1**, and then select **OK** twice. + +5. Select **Browse** and then under **Enter the object name to select**, enter **CM_NAA** and select **OK**. + +6. Next to **Password** and **Confirm Password**, enter **pass\@word1**, and then select **OK** twice. ### Configure a boundary group 1. in the **Administration** workspace, expand **Hierarchy Configuration**, right-click **Boundaries** and then select **Create Boundary**. -2. Next to **Description**, type **PS1**, next to **Type** choose **Active Directory Site**, and then select **Browse**. + +2. Next to **Description**, enter **PS1**, next to **Type** choose **Active Directory Site**, and then select **Browse**. + 3. Choose **Default-First-Site-Name** and then select **OK** twice. + 4. in the **Administration** workspace, right-click **Boundary Groups** and then select **Create Boundary Group**. -5. Next to **Name**, type **PS1 Site Assignment and Content Location**, select **Add**, select the **Default-First-Site-Name** boundary and then select **OK**. + +5. Next to **Name**, enter **PS1 Site Assignment and Content Location**, select **Add**, select the **Default-First-Site-Name** boundary and then select **OK**. + 6. On the **References** tab in the **Create Boundary Group** window, select the **Use this boundary group for site assignment** checkbox. + 7. Select **Add**, select the **\\\SRV1.contoso.com** checkbox, and then select **OK** twice. ### Add the state migration point role 1. in the **Administration** workspace, expand **Site Configuration**, select **Sites**, and then in on the **Home** ribbon at the top of the console select **Add Site System Roles**. + 2. In the Add site System Roles Wizard, select **Next** twice and then on the Specify roles for this server page, select the **State migration point** checkbox. -3. Select **Next**, select the yellow starburst, type **C:\MigData** for the **Storage folder**, and select **OK**. + +3. Select **Next**, select the yellow starburst, enter **C:\MigData** for the **Storage folder**, and select **OK**. + 4. Select **Next**, and then verify under **Boundary groups** that **PS1 Site Assignment and Content Location** is displayed. + 5. Select **Next** twice and then select **Close**. ### Enable PXE on the distribution point > [!IMPORTANT] -> Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, type the following commands at an elevated Windows PowerShell prompt on SRV1: +> Before enabling PXE in Configuration Manager, ensure that any previous installation of WDS does not cause conflicts. Configuration Manager will automatically configure the WDS service to manage PXE requests. To disable a previous installation, if it exists, enter the following commands at an elevated Windows PowerShell prompt on SRV1: ```cmd WDSUTIL.exe /Set-Server /AnswerClients:None ``` -1. Determine the MAC address of the internal network adapter on SRV1. Type the following command at an elevated Windows PowerShell prompt on SRV1: +1. Determine the MAC address of the internal network adapter on SRV1. Enter the following command at an elevated Windows PowerShell prompt on SRV1: ```powershell (Get-NetAdapter "Ethernet").MacAddress @@ -320,8 +360,11 @@ WDSUTIL.exe /Set-Server /AnswerClients:None > If the internal network adapter, assigned an IP address of 192.168.0.2, isn't named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing **ipconfig**. 2. In the Configuration Manager console, in the **Administration** workspace, select **Distribution Points**. + 3. In the display pane, right-click **SRV1.CONTOSO.COM** and then select **Properties**. + 4. On the PXE tab, select the following settings: + - **Enable PXE support for clients**. Select **Yes** in the popup that appears. - **Allow this distribution point to respond to incoming PXE requests** - **Enable unknown computer support**. Select **OK** in the popup that appears. @@ -333,7 +376,8 @@ WDSUTIL.exe /Set-Server /AnswerClients:None ![Config Mgr PXE.](images/configmgr-pxe.png) 5. Select **OK**. -6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: + +6. Wait for a minute, then enter the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: ```cmd dir /b C:\RemoteInstall\SMSBoot\x64 @@ -348,9 +392,9 @@ WDSUTIL.exe /Set-Server /AnswerClients:None ``` > [!NOTE] - > If these files aren't present in the C:\RemoteInstall directory, verify that the REMINST share is configured as C:\RemoteInstall. You can view the properties of this share by typing `net share REMINST` at a command prompt. If the share path is set to a different value, then replace C:\RemoteInstall with your REMINST share path. + > If these files aren't present in the C:\RemoteInstall directory, verify that the REMINST share is configured as C:\RemoteInstall. You can view the properties of this share by typing `net.exe share REMINST` at a command prompt. If the share path is set to a different value, then replace C:\RemoteInstall with your REMINST share path. > - > You can also type the following command at an elevated Windows PowerShell prompt to open the CMTrace. In the tool, select **File**, select **Open**, and then open the **distmgr.log** file. If errors are present, they will be highlighted in red: + > You can also enter the following command at an elevated Windows PowerShell prompt to open CMTrace. In the tool, select **File**, select **Open**, and then open the **distmgr.log** file. If errors are present, they will be highlighted in red: > > ```cmd > "C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe" @@ -365,7 +409,8 @@ WDSUTIL.exe /Set-Server /AnswerClients:None ### Create a branding image file 1. If you have a bitmap (.BMP) image for suitable use as a branding image, copy it to the C:\Sources\OSD\Branding folder on SRV1. Otherwise, use the following step to copy a branding image. -2. Type the following command at an elevated Windows PowerShell prompt: + +2. Enter the following command at an elevated Windows PowerShell prompt: ```powershell Copy-Item -Path "C:\ProgramData\Microsoft\User Account Pictures\user.bmp" -Destination "C:\Sources\OSD\Branding\contoso.bmp" @@ -377,16 +422,26 @@ WDSUTIL.exe /Set-Server /AnswerClients:None ### Create a boot image for Configuration Manager 1. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Boot Images**, and then select **Create Boot Image using MDT**. -2. On the Package Source page, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then select **Next**. + +2. On the Package Source page, under **Package source folder to be created (UNC Path):**, enter **\\\SRV1\Sources$\OSD\Boot\Zero Touch WinPE x64**, and then select **Next**. + - The Zero Touch WinPE x64 folder doesn't yet exist. The folder will be created later. -3. On the General Settings page, type **Zero Touch WinPE x64** next to **Name**, and select **Next**. + +3. On the General Settings page, enter **Zero Touch WinPE x64** next to **Name**, and select **Next**. + 4. On the Options page, under **Platform** choose **x64**, and select **Next**. + 5. On the Components page, in addition to the default selection of **Microsoft Data Access Components (MDAC/ADO) support**, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox, and select **Next**. -6. On the Customization page, select the **Use a custom background bitmap file** checkbox, and under **UNC path**, type or browse to **\\\SRV1\Sources$\OSD\Branding\contoso.bmp**, and then select **Next** twice. It will take a few minutes to generate the boot image. + +6. On the Customization page, select the **Use a custom background bitmap file** checkbox, and under **UNC path**, enter or browse to **\\\SRV1\Sources$\OSD\Branding\contoso.bmp**, and then select **Next** twice. It will take a few minutes to generate the boot image. + 7. Select **Finish**. + 8. In the console display pane, right-click the **Zero Touch WinPE x64** boot image, and then select **Distribute Content**. + 9. In the Distribute Content Wizard, select **Next**, select **Add** and select **Distribution Point**, select the **SRV1.CONTOSO.COM** checkbox, select **OK**, select **Next** twice, and then select **Close**. -10. Use the CMTrace application to view the **distmgr.log** file again and verify that the boot image has been distributed. To open CMTrace, type the following command at an elevated Windows PowerShell prompt on SRV1: + +10. Use the CMTrace application to view the **distmgr.log** file again and verify that the boot image has been distributed. To open CMTrace, enter the following command at an elevated Windows PowerShell prompt on SRV1: ```powershell Invoke-Item 'C:\Program Files\Microsoft Configuration Manager\tools\cmtrace.exe' @@ -399,8 +454,11 @@ WDSUTIL.exe /Set-Server /AnswerClients:None ``` 11. You can also review status by clicking the **Zero Touch WinPE x64** image, and then clicking **Content Status** under **Related Objects** in the bottom right-hand corner of the console, or by entering **\Monitoring\Overview\Distribution Status\Content Status** on the location bar in the console. Double-click **Zero Touch WinPE x64** under **Content Status** in the console tree and verify that a status of **Successfully distributed content** is displayed on the **Success** tab. + 12. Next, in the **Software Library** workspace, double-click **Zero Touch WinPE x64** and then select the **Data Source** tab. + 13. Select the **Deploy this boot image from the PXE-enabled distribution point** checkbox, and select **OK**. + 14. Review the distmgr.log file again for "**STATMSG: ID=2301**" and verify that there are three folders under **C:\RemoteInstall\SMSImages** with boot images. See the following example: ```cmd @@ -421,19 +479,19 @@ WDSUTIL.exe /Set-Server /AnswerClients:None If you've already completed steps in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) then you've already created a Windows 10 reference image. In this case, skip to the next procedure in this guide: [Add a Windows 10 OS image](#add-a-windows-10-os-image). If you've not yet created a Windows 10 reference image, complete the steps in this section. -1. In [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and type the following command: +1. In [Step by step guide: Deploy Windows 10 in a test lab](windows-10-poc.md) the Windows 10 Enterprise .iso file was saved to the c:\VHD directory as **c:\VHD\w10-enterprise.iso**. The first step in creating a deployment share is to mount this file on SRV1. To mount the Windows 10 Enterprise DVD on SRV1, open an elevated Windows PowerShell prompt on the Hyper-V host computer and enter the following command: ```powershell Set-VMDvdDrive -VMName SRV1 -Path c:\VHD\w10-enterprise.iso ``` -1. Verify that the Windows Enterprise installation DVD is mounted on SRV1 as drive letter D. +2. Verify that the Windows Enterprise installation DVD is mounted on SRV1 as drive letter D. -1. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, select **Start**, type **deployment**, and then select **Deployment Workbench**. +3. The Windows 10 Enterprise installation files will be used to create a deployment share on SRV1 using the MDT deployment workbench. To open the deployment workbench, select **Start**, enter **deployment**, and then select **Deployment Workbench**. -1. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. +4. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. -1. Use the following settings for the New Deployment Share Wizard: +5. Use the following settings for the New Deployment Share Wizard: - Deployment share path: **C:\MDTBuildLab** - Share name: **MDTBuildLab$** - Deployment share description: **MDT build lab** @@ -442,22 +500,23 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr - Progress: settings will be applied - Confirmation: Select **Finish** -1. Expand the **Deployment Shares** node, and then expand **MDT build lab**. +6. Expand the **Deployment Shares** node, and then expand **MDT build lab**. -1. Right-click the **Operating Systems** node, and then select **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and select **Finish**. +7. Right-click the **Operating Systems** node, and then select **New Folder**. Name the new folder **Windows 10**. Complete the wizard using default values and select **Finish**. -1. Right-click the **Windows 10** folder created in the previous step, and then select **Import Operating System**. +8. Right-click the **Windows 10** folder created in the previous step, and then select **Import Operating System**. -1. Use the following settings for the Import Operating System Wizard: +9. Use the following settings for the Import Operating System Wizard: - OS Type: **Full set of source files** - Source: **D:\\** - Destination: **W10Ent_x64** - Summary: Select **Next** - Confirmation: Select **Finish** -1. For purposes of this test lab, we won't add applications, such as Microsoft Office, to the deployment share. For more information about adding applications, see [Add applications](deploy-windows-mdt/create-a-windows-10-reference-image.md#add-applications). +10. For purposes of this test lab, we won't add applications, such as Microsoft Office, to the deployment share. For more information about adding applications, see [Add applications](deploy-windows-mdt/create-a-windows-10-reference-image.md#add-applications). + +11. The next step is to create a task sequence to reference the OS that was imported. To create a task sequence, right-click the **Task Sequences** node under **MDT Build Lab** and then select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: -1. The next step is to create a task sequence to reference the OS that was imported. To create a task sequence, right-click the **Task Sequences** node under **MDT Build Lab** and then select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - Task sequence ID: **REFW10X64-001** - Task sequence name: **Windows 10 Enterprise x64 Default Image** - Task sequence comments: **Reference Build** @@ -466,31 +525,31 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr - Specify Product Key: **Do not specify a product key at this time** - Full Name: **Contoso** - Organization: **Contoso** - - Internet Explorer home page: **http://www.contoso.com** + - Internet Explorer home page: **`http://www.contoso.com`** - Admin Password: **Do not specify an Administrator password at this time** - Summary: Select **Next** - Confirmation: Select **Finish** -1. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step. +12. Edit the task sequence to add the Microsoft NET Framework 3.5, which is required by many applications. To edit the task sequence, double-click **Windows 10 Enterprise x64 Default Image** that was created in the previous step. -1. Select the **Task Sequence** tab. Under **State Restore**, select **Tattoo** to highlight it, then select **Add** and choose **New Group**. A new group will be added under Tattoo. +13. Select the **Task Sequence** tab. Under **State Restore**, select **Tattoo** to highlight it, then select **Add** and choose **New Group**. A new group will be added under Tattoo. -1. On the Properties tab of the group that was created in the previous step, change the Name from New Group to **Custom Tasks (Pre-Windows Update)** and then select **Apply**. To see the name change, select **Tattoo**, then select the new group again. +14. On the Properties tab of the group that was created in the previous step, change the Name from New Group to **Custom Tasks (Pre-Windows Update)** and then select **Apply**. To see the name change, select **Tattoo**, then select the new group again. -1. Select the **Custom Tasks (Pre-Windows Update)** group again, select **Add**, point to **Roles**, and then select **Install Roles and Features**. +15. Select the **Custom Tasks (Pre-Windows Update)** group again, select **Add**, point to **Roles**, and then select **Install Roles and Features**. -1. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then select **Apply**. +16. Under **Select the roles and features that should be installed**, select **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** and then select **Apply**. -1. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. +17. Enable Windows Update in the task sequence by clicking the **Windows Update (Post-Application Installation)** step, clicking the **Options** tab, and clearing the **Disable this step** checkbox. > [!NOTE] > Since we aren't installing applications in this test lab, there's no need to enable the Windows Update Pre-Application Installation step. However, you should enable this step if you're also installing applications. -1. Select **OK** to complete editing the task sequence. +18. Select **OK** to complete editing the task sequence. -1. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click MDT build lab (C:\MDTBuildLab) and select **Properties**, and then select the **Rules** tab. +19. The next step is to configure the MDT deployment share rules. To configure rules in the Deployment Workbench, right-click MDT build lab (C:\MDTBuildLab) and select **Properties**, and then select the **Rules** tab. -1. Replace the default rules with the following text: +20. Replace the default rules with the following text: ```ini [Settings] @@ -525,7 +584,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr SkipFinalSummary=NO ``` -1. Select **Apply** and then select **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: +21. Select **Apply** and then select **Edit Bootstrap.ini**. Replace the contents of the Bootstrap.ini file with the following text, and save the file: ```ini [Settings] @@ -539,18 +598,18 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr SkipBDDWelcome=YES ``` -1. Select **OK** to complete the configuration of the deployment share. +22. Select **OK** to complete the configuration of the deployment share. -1. Right-click **MDT build lab (C:\MDTBuildLab)** and then select **Update Deployment Share**. +23. Right-click **MDT build lab (C:\MDTBuildLab)** and then select **Update Deployment Share**. -1. Accept all default values in the Update Deployment Share Wizard by clicking **Next**. The update process will take 5 to 10 minutes. When it has completed, select **Finish**. +24. Accept all default values in the Update Deployment Share Wizard by clicking **Next**. The update process will take 5 to 10 minutes. When it has completed, select **Finish**. -1. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. In MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). +25. Copy **c:\MDTBuildLab\Boot\LiteTouchPE_x86.iso** on SRV1 to the **c:\VHD** directory on the Hyper-V host computer. In MDT, the x86 boot image can deploy both x86 and x64 operating systems, except on computers based on Unified Extensible Firmware Interface (UEFI). > [!TIP] > To copy the file, right-click the **LiteTouchPE_x86.iso** file, and select **Copy** on SRV1. Then open the **c:\VHD** folder on the Hyper-V host, right-click inside the folder, and select **Paste**. -1. Open a Windows PowerShell prompt on the Hyper-V host computer and type the following commands: +26. Open a Windows PowerShell prompt on the Hyper-V host computer and enter the following commands: ```powershell New-VM -Name REFW10X64-001 -SwitchName poc-internal -NewVHDPath "c:\VHD\REFW10X64-001.vhdx" -NewVHDSizeBytes 60GB @@ -560,9 +619,9 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr vmconnect localhost REFW10X64-001 ``` -1. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then select **Next**. +27. In the Windows Deployment Wizard, select **Windows 10 Enterprise x64 Default Image**, and then select **Next**. -1. Accept the default values on the Capture Image page, and select **Next**. OS installation will complete after 5 to 10 minutes and then the VM will reboot automatically. Allow the system to boot normally, don't press a key. The process is fully automated. +28. Accept the default values on the Capture Image page, and select **Next**. OS installation will complete after 5 to 10 minutes and then the VM will reboot automatically. Allow the system to boot normally, don't press a key. The process is fully automated. Other system restarts will occur to complete updating and preparing the OS. Setup will complete the following procedures: @@ -578,7 +637,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr ### Add a Windows 10 OS image -1. Type the following commands at an elevated Windows PowerShell prompt on SRV1: +1. Enter the following commands at an elevated Windows PowerShell prompt on SRV1: ```powershell New-Item -ItemType Directory -Path "C:\Sources\OSD\OS\Windows 10 Enterprise x64" @@ -587,9 +646,9 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 2. In the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Operating System Images**, and then select **Add Operating System Image**. -3. On the Data Source page, under **Path:**, type or browse to **\\\SRV1\Sources$\OSD\OS\Windows 10 Enterprise x64\REFW10X64-001.wim**, and select **Next**. +3. On the Data Source page, under **Path:**, enter or browse to **\\\SRV1\Sources$\OSD\OS\Windows 10 Enterprise x64\REFW10X64-001.wim**, and select **Next**. -4. On the General page, next to **Name:**, type **Windows 10 Enterprise x64**, select **Next** twice, and then select **Close**. +4. On the General page, next to **Name:**, enter **Windows 10 Enterprise x64**, select **Next** twice, and then select **Close**. 5. Distribute the OS image to the SRV1 distribution point by right-clicking the **Windows 10 Enterprise x64** OS image and then clicking **Distribute Content**. @@ -609,9 +668,10 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 2. On the Choose Template page, select the **Client Task Sequence** template and select **Next**. -3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then select **Next**. +3. On the General page, enter **Windows 10 Enterprise x64** under **Task sequence name:** and then select **Next**. 4. On the Details page, enter the following settings: + - Join a domain: **contoso.com** - Account: Select **Set** - User name: **contoso\CM_JD** @@ -631,9 +691,9 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 6. On the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package, select **OK**, and then select **Next**. -7. On the MDT Package page, select **Create a new Microsoft Deployment Toolkit Files package**, under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\MDT\MDT** (MDT is repeated here, not a typo), and then select **Next**. +7. On the MDT Package page, select **Create a new Microsoft Deployment Toolkit Files package**, under **Package source folder to be created (UNC Path):**, enter **\\\SRV1\Sources$\OSD\MDT\MDT** (MDT is repeated here, not a typo), and then select **Next**. -8. On the MDT Details page, next to **Name:** type **MDT** and then select **Next**. +8. On the MDT Details page, next to **Name:** enter **MDT** and then select **Next**. 9. On the OS Image page, browse and select the **Windows 10 Enterprise x64** package, select **OK**, and then select **Next**. @@ -643,9 +703,9 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 12. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows 10.0.14393.0** package, select **OK**, and then select **Next**. -13. On the Settings Package page, select **Create a new settings package**, and under **Package source folder to be created (UNC Path):**, type **\\\SRV1\Sources$\OSD\Settings\Windows 10 x64 Settings**, and then select **Next**. +13. On the Settings Package page, select **Create a new settings package**, and under **Package source folder to be created (UNC Path):**, enter **\\\SRV1\Sources$\OSD\Settings\Windows 10 x64 Settings**, and then select **Next**. -14. On the Settings Details page, next to **Name:**, type **Windows 10 x64 Settings**, and select **Next**. +14. On the Settings Details page, next to **Name:**, enter **Windows 10 x64 Settings**, and select **Next**. 15. On the Sysprep Package page, select **Next** twice. @@ -662,6 +722,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 4. In the **State Restore** group, select the **Set Status 5** action, select **Add** in the upper left corner, point to **User State**, and select **Request State Store**. This action adds a new step immediately after **Set Status 5**. 5. Configure this **Request State Store** step with the following settings: + - Request state storage location to: **Restore state from another computer** - Select the **If computer account fails to connect to state store, use the Network Access account** checkbox. - Options tab: Select the **Continue on error** checkbox. @@ -675,6 +736,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 6. In the **State Restore** group, select **Restore User State**, select **Add**, point to **User State**, and select **Release State Store**. 7. Configure this **Release State Store** step with the following settings: + - Options tab: Select the **Continue on error** checkbox. - Add Condition: **Task Sequence Variable**: - Variable: **USMTLOCAL** @@ -703,7 +765,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr 4. Select the **Monitoring** tab, select the **Enable monitoring for this deployment share** checkbox, and then select **OK**. -5. Type the following command at an elevated Windows PowerShell prompt on SRV1: +5. Enter the following command at an elevated Windows PowerShell prompt on SRV1: ```cmd notepad.exe "C:\Sources\OSD\Settings\Windows 10 x64 Settings\CustomSettings.ini" @@ -734,9 +796,9 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr > OSDMigrateAdditionalCaptureOptions=/all > ``` -7. Return to the Configuration Manager console, and in the Software Library workspace, expand **Application Management**, select **Packages**, right-click **Windows 10 x64 Settings**, and then select **Update Distribution Points**. Select **OK** in the popup that appears. +7. Return to the Configuration Manager console, and in the **Software Library** workspace, expand **Application Management**, select **Packages**, right-click **Windows 10 x64 Settings**, and then select **Update Distribution Points**. Select **OK** in the popup that appears. -8. In the Software Library workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then select **Distribute Content**. +8. In the **Software Library** workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then select **Distribute Content**. 9. In the Distribute Content Wizard, select **Next** twice, select **Add**, select **Distribution Point**, select the **SRV1.CONTOSO.COM** distribution point, select **OK**, select **Next** twice and then select **Close**. @@ -744,7 +806,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr ### Create a deployment for the task sequence -1. In the Software Library workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then select **Deploy**. +1. In the **Software Library** workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64**, and then select **Deploy**. 2. On the General page, next to **Collection**, select **Browse**, select the **All Unknown Computers** collection, select **OK**, and then select **Next**. @@ -760,7 +822,7 @@ If you've already completed steps in [Deploy Windows 10 in a test lab using Micr In this first deployment scenario, you'll deploy Windows 10 using PXE. This scenario creates a new computer that doesn't have any migrated users or settings. -1. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: +1. Enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell New-VM -Name "PC4" -NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 40GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 @@ -775,7 +837,7 @@ In this first deployment scenario, you'll deploy Windows 10 using PXE. This scen 4. Before you select **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open. -5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. +5. At the command prompt, enter **explorer.exe** and review the Windows PE file structure. 6. The smsts.log file is critical for troubleshooting any installation problems that might be encountered. Depending on the deployment phase, the smsts.log file is created in different locations: - X:\Windows\temp\SMSTSLog\smsts.log before disks are formatted. @@ -795,6 +857,7 @@ In this first deployment scenario, you'll deploy Windows 10 using PXE. This scen 10. The **Windows 10 Enterprise x64** task sequence is selected in the Task Sequence Wizard. Select **Next** to continue with the deployment. 11. The task sequence will require several minutes to complete. You can monitor progress of the task sequence using the MDT Deployment Workbench under Deployment Shares > MDTProduction > Monitoring. The task sequence will: + - Install Windows 10 - Install the Configuration Manager client and hotfix - Join the computer to the contoso.com domain @@ -802,7 +865,7 @@ In this first deployment scenario, you'll deploy Windows 10 using PXE. This scen 12. When Windows 10 installation has completed, sign in to PC4 using the **contoso\administrator** account. -13. Right-click **Start**, select **Run**, type **control appwiz.cpl**, press ENTER, select **Turn Windows features on or off**, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This feature is included in the reference image. +13. Right-click **Start**, select **Run**, enter **control appwiz.cpl**, press ENTER, select **Turn Windows features on or off**, and verify that **.NET Framework 3.5 (includes .NET 2.0 and 3.0)** is installed. This feature is included in the reference image. 14. Shut down the PC4 VM. @@ -820,19 +883,25 @@ In the replace procedure, PC1 won't be migrated to a new OS. It's simplest to pe ### Create a replace task sequence -1. On SRV1, in the Configuration Manager console, in the Software Library workspace, expand **Operating Systems**, right-click **Task Sequences**, and then select **Create MDT Task Sequence**. +1. On SRV1, in the Configuration Manager console, in the **Software Library** workspace, expand **Operating Systems**, right-click **Task Sequences**, and then select **Create MDT Task Sequence**. 2. On the Choose Template page, select **Client Replace Task Sequence** and select **Next**. -3. On the General page, type the following information: +3. On the General page, enter the following information: + - Task sequence name: **Replace Task Sequence** - Task sequence comments: **USMT backup only** 4. Select **Next**, and on the Boot Image page, browse and select the **Zero Touch WinPE x64** boot image package. Select **OK** and then select **Next** to continue. + 5. On the MDT Package page, browse and select the **MDT** package. Select **OK** and then select **Next** to continue. + 6. On the USMT Package page, browse and select the **Microsoft Corporation User State Migration Tool for Windows** package. Select **OK** and then select **Next** to continue. + 7. On the Settings Package page, browse and select the **Windows 10 x64 Settings** package. Select **OK** and then select **Next** to continue. + 8. On the Summary page, review the details and then select **Next**. + 9. On the Confirmation page, select **Finish**. > [!NOTE] @@ -840,7 +909,7 @@ In the replace procedure, PC1 won't be migrated to a new OS. It's simplest to pe ### Deploy PC4 -Create a VM named PC4 to receive the applications and settings from PC1. This VM represents a new computer that will replace PC1. To create this VM, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: +Create a VM named PC4 to receive the applications and settings from PC1. This VM represents a new computer that will replace PC1. To create this VM, enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell New-VM -Name "PC4" -NewVHDPath "c:\vhd\pc4.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 @@ -855,27 +924,31 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 1. Verify that the PC1 VM is running and in its original state, which was saved as a checkpoint and then restored in [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md). -1. If you haven't already saved a checkpoint for PC1, then do it now. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: +2. If you haven't already saved a checkpoint for PC1, then do it now. Enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Checkpoint-VM -Name PC1 -SnapshotName BeginState ``` -1. On SRV1, in the Configuration Manager console, in the **Administration** workspace, expand **Hierarchy Configuration** and select on **Discovery Methods**. -1. Double-click **Active Directory System Discovery** and on the **General** tab select the **Enable Active Directory System Discovery** checkbox. -1. Select the yellow starburst, select **Browse**, select **contoso\Computers**, and then select **OK** three times. -1. When a popup dialog box asks if you want to run full discovery, select **Yes**. -1. In the Assets and Compliance workspace, select **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example): +3. On SRV1, in the Configuration Manager console, in the **Administration** workspace, expand **Hierarchy Configuration** and select on **Discovery Methods**. + +4. Double-click **Active Directory System Discovery** and on the **General** tab select the **Enable Active Directory System Discovery** checkbox. + +5. Select the yellow starburst, select **Browse**, select **contoso\Computers**, and then select **OK** three times. + +6. When a popup dialog box asks if you want to run full discovery, select **Yes**. + +7. In the **Assets and Compliance** workspace, select **Devices** and verify that the computer account names for SRV1 and PC1 are displayed. See the following example (GREGLIN-PC1 is the computer account name of PC1 in this example): > [!TIP] > If you don't see the computer account for PC1, select **Refresh** in the upper right corner of the console. The **Client** column indicates that the Configuration Manager client isn't currently installed. This procedure will be carried out next. -1. Sign in to PC1 using the contoso\administrator account and type the following command at an elevated command prompt to remove any pre-existing client configuration, if it exists. +8. Sign in to PC1 using the contoso\administrator account and enter the following command at an elevated command prompt to remove any pre-existing client configuration, if it exists. > [!Note] - > This command requires an elevated _command prompt_, not an elevated Windows PowerShell prompt. + > This command requires an elevated command prompt, not an elevated Windows PowerShell prompt. ```cmd sc.exe stop ccmsetup @@ -885,14 +958,14 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF > [!NOTE] > If PC1 still has Configuration Manager registry settings that were applied by Group Policy, startup scripts, or other policies in its previous domain, these might not all be removed by `CCMSetup /Uninstall` and can cause problems with installation or registration of the client in its new environment. It might be necessary to manually remove these settings if they are present. For more information, see [Manual removal of the Configuration Manager client](/archive/blogs/michaelgriswold/manual-removal-of-the-sccm-client). -1. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue. From an elevated command prompt, type: +9. On PC1, temporarily stop Windows Update from queuing items for download and clear all BITS jobs from the queue. From an elevated command prompt, enter: ```cmd net.exe stop wuauserv net.exe stop BITS ``` - Verify that both services were stopped successfully, then type the following command at an elevated command prompt: + Verify that both services were stopped successfully, then enter the following command at an elevated command prompt: ```cmd del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" @@ -902,14 +975,15 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF Verify that BITSAdmin displays zero jobs. -1. To install the Configuration Manager client as a standalone process, type the following command at an elevated command prompt: +10. To install the Configuration Manager client as a standalone process, enter the following command at an elevated command prompt: ```cmd "\\SRV1\c$\Program Files\Microsoft Configuration Manager\Client\CCMSetup.exe" /mp:SRV1.contoso.com /logon SMSSITECODE=PS1 ``` -1. On PC1, using file explorer, open the **C:\Windows\ccmsetup** directory. During client installation, files will be downloaded here. -1. Installation progress will be captured in the file: **c:\windows\ccmsetup\logs\ccmsetup.log**. You can periodically open this file in notepad, or you can type the following command at an elevated Windows PowerShell prompt to monitor installation progress: +11. On PC1, using file explorer, open the **C:\Windows\ccmsetup** directory. During client installation, files will be downloaded here. + +12. Installation progress will be captured in the file: **c:\windows\ccmsetup\logs\ccmsetup.log**. You can periodically open this file in notepad, or you can enter the following command at an elevated Windows PowerShell prompt to monitor installation progress: ```powershell Get-Content -Path c:\windows\ccmsetup\logs\ccmsetup.log -Wait @@ -917,21 +991,21 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF Installation might require several minutes, and display of the log file will appear to hang while some applications are installed. This behavior is normal. When setup is complete, verify that **CcmSetup is existing with return code 0** is displayed on the last line of the ccmsetup.log file. Then press **CTRL-C** to break out of the Get-Content operation. If you're viewing the log file in Windows PowerShell, the last line will be wrapped. A return code of `0` indicates that installation was successful and you should now see a directory created at **C:\Windows\CCM** that contains files used in registration of the client with its site. -1. On PC1, open the Configuration Manager control panel applet by typing the following command from a command prompt: +13. On PC1, open the Configuration Manager control panel applet by typing the following command from a command prompt: ```cmd control.exe smscfgrc ``` -1. Select the **Site** tab, select **Configure Settings**, and select **Find Site**. The client will report that it has found the PS1 site. See the following example: +14. Select the **Site** tab, select **Configure Settings**, and select **Find Site**. The client will report that it has found the PS1 site. See the following example: ![site.](images/configmgr-site.png) If the client isn't able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the client can't locate the site code is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode**, delete or update this entry. -1. On SRV1, in the Assets and Compliance workspace, select **Device Collections** and then double-click **All Desktop and Server Clients**. This node will be added under **Devices**. +15. On SRV1, in the **Assets and Compliance** workspace, select **Device Collections** and then double-click **All Desktop and Server Clients**. This node will be added under **Devices**. -1. Select **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: +16. Select **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: ![client.](images/configmgr-client.png) @@ -940,9 +1014,10 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF ### Create a device collection and deployment -1. On SRV1, in the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections** and then select **Create Device Collection**. +1. On SRV1, in the Configuration Manager console, in the **Assets and Compliance** workspace, right-click **Device Collections** and then select **Create Device Collection**. 2. Use the following settings in the **Create Device Collection Wizard**: + - General > Name: **Install Windows 10 Enterprise x64** - General > Limiting collection: **All Systems** - Membership Rules > Add Rule: **Direct Rule** @@ -955,7 +1030,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 3. Double-click the Install Windows 10 Enterprise x64 device collection and verify that the PC1 computer account is displayed. -4. In the Software Library workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64** and then select **Deploy**. +4. In the **Software Library** workspace, expand **Operating Systems**, select **Task Sequences**, right-click **Windows 10 Enterprise x64** and then select **Deploy**. 5. Use the following settings in the Deploy Software wizard: - General > Collection: Select Browse and select **Install Windows 10 Enterprise x64** @@ -970,24 +1045,25 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF ### Associate PC4 with PC1 -1. On SRV1 in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Devices** and then select **Import Computer Information**. +1. On SRV1 in the Configuration Manager console, in the **Assets and Compliance** workspace, right-click **Devices** and then select **Import Computer Information**. 2. On the Select Source page, choose **Import single computer** and select **Next**. 3. On the Single Computer page, use the following settings: + - Computer Name: **PC4** - MAC Address: **00:15:5D:83:26:FF** - - Source Computer: \ + - Source Computer: \ 4. Select **Next**, and on the User Accounts page choose **Capture and restore specified user accounts**, then select the yellow starburst next to **User accounts to migrate**. -5. Select **Browse** and then under Enter the object name to select type **user1** and select OK twice. +5. Select **Browse** and then under **Enter the object name to select** enter **user1** and select **OK** twice. 6. Select the yellow starburst again and repeat the previous step to add the **contoso\administrator** account. 7. Select **Next** twice, and on the Choose Target Collection page, choose **Add computers to the following collection**, select **Browse**, choose **Install Windows 10 Enterprise x64**, select **OK**, select **Next** twice, and then select **Close**. -8. In the Assets and Compliance workspace, select **User State Migration** and review the computer association in the display pane. The source computer will be the computername of PC1 (GREGLIN-PC1 in this example), the destination computer will be **PC4**, and the migration type will be **side-by-side**. +8. In the **Assets and Compliance** workspace, select **User State Migration** and review the computer association in the display pane. The source computer will be the computername of PC1 (GREGLIN-PC1 in this example), the destination computer will be **PC4**, and the migration enter will be **side-by-side**. 9. Right-click the association in the display pane and then select **Specify User Accounts**. You can add or remove user account here. Select **OK**. @@ -999,9 +1075,10 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF ### Create a device collection for PC1 -1. On SRV1, in the Configuration Manager console, in the Assets and Compliance workspace, right-click **Device Collections** and then select **Create Device Collection**. +1. On SRV1, in the Configuration Manager console, in the **Assets and Compliance** workspace, right-click **Device Collections** and then select **Create Device Collection**. 2. Use the following settings in the **Create Device Collection Wizard**: + - General > Name: **USMT Backup (Replace)** - General > Limiting collection: **All Systems** - Membership Rules > Add Rule: **Direct Rule** @@ -1037,7 +1114,7 @@ In the Configuration Manager console, in the **Software Library** workspace, und 2. On the **Actions** tab, select **Machine Policy Retrieval & Evaluation Cycle**, select **Run Now**, select **OK**, and then select **OK** again. This method is one that you can use to run a task sequence in addition to the Client Notification method that will be demonstrated in the computer refresh procedure. -3. Type the following command at an elevated command prompt to open the Software Center: +3. Enter the following command at an elevated command prompt to open the Software Center: ```cmd C:\Windows\CCM\SCClient.exe @@ -1051,26 +1128,30 @@ In the Configuration Manager console, in the **Software Library** workspace, und > If you don't see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. 5. Select **INSTALL SELECTED** and then select **INSTALL OPERATING SYSTEM**. + 6. Allow the **Replace Task Sequence** to complete, then verify that the C:\MigData folder on SRV1 contains the USMT backup. ### Deploy the new computer -1. Start PC4 and press ENTER for a network boot when prompted. To start PC4, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: +1. Start PC4 and press ENTER for a network boot when prompted. To start PC4, enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Start-VM PC4 vmconnect localhost PC4 ``` -1. In the **Welcome to the Task Sequence Wizard**, enter **pass@word1** and select **Next**. -1. Choose the **Windows 10 Enterprise X64** image. -1. Setup will install the OS using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. -1. Save checkpoints for all VMs if you wish to review their status at a later date. This action isn't required, as checkpoints do take up space on the Hyper-V host. +2. In the **Welcome to the Task Sequence Wizard**, enter **pass@word1** and select **Next**. + +3. Choose the **Windows 10 Enterprise X64** image. + +4. Setup will install the OS using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. + +5. Save checkpoints for all VMs if you wish to review their status at a later date. This action isn't required, as checkpoints do take up space on the Hyper-V host. > [!Note] > The next procedure will install a new OS on PC1, and update its status in Configuration Manager and in Active Directory as a Windows 10 device. So you can't return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this action for all VMs. - To save a checkpoint for all VMs, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: + To save a checkpoint for all VMs, enter the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: ```powershell Checkpoint-VM -Name DC1 -SnapshotName cm-refresh @@ -1082,14 +1163,17 @@ In the Configuration Manager console, in the **Software Library** workspace, und ### Initiate the computer refresh -1. On SRV1, in the Assets and Compliance workspace, select **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. +1. On SRV1, in the **Assets and Compliance** workspace, select **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. + 2. Right-click the computer account for PC1, point to **Client Notification**, select **Download Computer Policy**, and select **OK** in the popup dialog box. + 3. On PC1, in the notification area, select **New software is available** and then select **Open Software Center**. + 4. In the Software Center, select **Operating Systems**, select **Windows 10 Enterprise x64**, select **Install** and then select **INSTALL OPERATING SYSTEM**. See the following example: ![installOS.](images/configmgr-install-os.png) - The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then select **More Details**. Select the **Status** tab to see a list of tasks that have been performed. See the following example: + The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the **Monitoring** workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then select **More Details**. Select the **Status** tab to see a list of tasks that have been performed. See the following example: ![asset.](images/configmgr-asset.png) diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index ab9463fb9f..0998486d71 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -9,12 +9,12 @@ ms.prod: windows-client ms.technology: itpro-deploy ms.localizationpriority: medium ms.topic: tutorial -ms.date: 10/31/2022 +ms.date: 11/23/2022 --- # Step by step guide: Configure a test lab to deploy Windows 10 -*Applies to* +*Applies to:* - Windows 10 @@ -69,6 +69,7 @@ The procedures in this guide are summarized in the following table. An estimate One computer that meets the hardware and software specifications below is required to complete the guide; A second computer is recommended to validate the upgrade process. - **Computer 1**: the computer you'll use to run Hyper-V and host virtual machines. This computer should have 16 GB or more of installed RAM and a multi-core processor. + - **Computer 2**: a client computer from your network. It's shadow-copied to create a VM that can be added to the PoC environment, enabling you to test a mirror image of a computer on your network. If you don't have a computer to use for this simulation, you can download an evaluation VHD and use it to represent this computer. Subsequent guides use this computer to simulate Windows 10 replace and refresh scenarios, so the VM is required even if you can't create this VM using computer 2. Hardware requirements are displayed below: @@ -92,7 +93,9 @@ The lab architecture is summarized in the following diagram: ![PoC diagram.](images/poc.png) - Computer 1 is configured to host four VMs on a private, PoC network. + - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. + - Two VMs are client systems: One VM is intended to mirror a host on your network (computer 2) and one VM is running Windows 10 Enterprise to demonstrate the hardware replacement scenario. > [!NOTE] @@ -225,13 +228,23 @@ When you have completed installation of Hyper-V on the host computer, begin conf If you don't have a PC available to convert to VM, do the following steps to download an evaluation VM: -1. Open the [Download virtual machines](https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) page. +1. Open the [Download virtual machines](https://developer.microsoft.com/microsoft-edge/tools/vms/) page. + + > [!NOTE] + > The above link may not be available in all locales. + 2. Under **Virtual machine**, choose **IE11 on Win7**. + 3. Under **Select platform**, choose **HyperV (Windows)**. + 4. Select **Download .zip**. The download is 3.31 GB. + 5. Extract the zip file. Three directories are created. + 6. Open the **Virtual Hard Disks** directory and then copy **IE11 - Win7.vhd** to the **C:\VHD** directory. + 7. Rename **IE11 - Win7.vhd** to **w7.vhd** (don't rename the file to w7.vhdx). + 8. In step 5 of the [Configure Hyper-V](#configure-hyper-v) section, replace the VHD file name **w7.vhdx** with **w7.vhd**. If you have a PC available to convert to VM (computer 2): @@ -242,6 +255,7 @@ If you have a PC available to convert to VM (computer 2): > The account used in this step must have local administrator privileges. You can use a local computer account, or a domain account with administrative rights if domain policy allows the use of cached credentials. After converting the computer to a VM, you must be able to sign in on this VM with administrator rights while the VM is disconnected from the network. 2. [Determine the VM generation and partition type](#determine-the-vm-generation-and-partition-type) that is required. + 3. Based on the VM generation and partition type, perform one of the following procedures: [Prepare a generation 1 VM](#prepare-a-generation-1-vm), [Prepare a generation 2 VM](#prepare-a-generation-2-vm), or [prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk). #### Determine the VM generation and partition type @@ -256,6 +270,7 @@ When creating a VM in Hyper-V, you must specify either generation 1 or generatio If the PC is running a 32-bit OS or the OS is Windows 7, it must be converted to a generation 1 VM. Otherwise, it can be converted to a generation 2 VM. - To determine the OS and architecture of a PC, type **systeminfo** at a command prompt and review the output next to **OS Name** and **System Type**. + - To determine the partition style, open a Windows PowerShell prompt on the PC and type the following command: ```powershell @@ -293,34 +308,32 @@ Number Friendly Name OperationalStatus Tota 0 INTEL SSDSCMMW240A3L Online 223.57 GB GPT ``` - - -**Choosing a VM generation** +##### Choosing a VM generation The following tables display the Hyper-V VM generation to choose based on the OS, architecture, and partition style. Links to procedures to create the corresponding VMs are included. -**Windows 7 MBR** +###### Windows 7 MBR |Architecture|VM generation|Procedure| |--- |--- |--- | |32|1|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| |64|1|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| -**Windows 7 GPT** +###### Windows 7 GPT |Architecture|VM generation|Procedure| |--- |--- |--- | |32|N/A|N/A| |64|1|[Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)| -**Windows 8 or later MBR** +###### Windows 8 or later MBR |Architecture|VM generation|Procedure| |--- |--- |--- | |32|1|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| |64|1, 2|[Prepare a generation 1 VM](#prepare-a-generation-1-vm)| -**Windows 8 or later GPT** +###### Windows 8 or later GPT |Architecture|VM generation|Procedure| |--- |--- |--- | @@ -347,7 +360,7 @@ The following tables display the Hyper-V VM generation to choose based on the OS 3. Select the checkboxes next to the `C:\` and the **system reserved** (BIOS/MBR) volumes. The system volume isn't assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to `\?\Volume{`. See the following example. > [!IMPORTANT] - > You must include the system volume in order to create a bootable VHD. If this volume isn't displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). + > You must include the system volume in order to create a bootable VHD. If this volume isn't displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Choosing a VM generation](#choosing-a-vm-generation). 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and select **Create**. See the following example: @@ -381,6 +394,7 @@ The following tables display the Hyper-V VM generation to choose based on the OS This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s). 3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. + 4. Select the checkboxes next to the **C:\\** and the **S:\\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy won't work if the EFI system partition is selected. > [!IMPORTANT] @@ -409,6 +423,7 @@ The following tables display the Hyper-V VM generation to choose based on the OS You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive. 2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface. + 3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. > [!NOTE] @@ -524,7 +539,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to > [!NOTE] > The RAM values assigned to VMs in this step are not permanent, and can be easily increased or decreased later if needed to address performance issues. -5. Using the same elevated Windows PowerShell prompt that was used in the previous step, type one of the following sets of commands, depending on the type of VM that was prepared in the [Determine VM generation](#determine-vm-generation) section, either generation 1, generation 2, or generation 1 with GPT. +5. Using the same elevated Windows PowerShell prompt that was used in the previous step, type one of the following sets of commands, depending on the type of VM that was prepared in the [Choosing a VM generation](#choosing-a-vm-generation) section, either generation 1, generation 2, or generation 1 with GPT. To create a generation 1 VM (using c:\vhd\w7.vhdx): @@ -574,9 +589,13 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to The VM will automatically boot into Windows Setup. In the PC1 window: 1. Select **Next**. + 2. Select **Repair your computer**. + 3. Select **Troubleshoot**. + 4. Select **Command Prompt**. + 5. Type the following command to save an image of the OS drive: ```cmd @@ -608,7 +627,9 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to ``` 8. Select **Continue** and verify the VM boots successfully. Don't boot from DVD. + 9. Select **Ctrl+Alt+Del**, and then in the bottom right corner, select **Shut down**. + 10. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to remove the temporary disks and drives from PC1: ```powershell @@ -626,8 +647,14 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40 GB to ``` 2. Select **Next** to accept the default settings, read the license terms and select **I accept**, provide a strong administrator password, and select **Finish**. + 3. Select **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account. -4. Right-click **Start**, point to **Shut down or sign out**, and select **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, select **Connect** and sign in again with the local Administrator account. Note: Signing in this way ensures that [enhanced session mode](/windows-server/virtualization/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It's only necessary to do this action the first time you sign in to a new VM. + +4. Right-click **Start**, point to **Shut down or sign out**, and select **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, select **Connect** and sign in again with the local Administrator account. + + > [!NOTE] + > Signing in this way ensures that [enhanced session mode](/windows-server/virtualization/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It's only necessary to do this action the first time you sign in to a new VM. + 5. If DC1 is configured as described in this guide, it will currently be assigned an APIPA address, have a randomly generated hostname, and a single network adapter named "Ethernet." Open an elevated Windows PowerShell prompt on DC1 and type or paste the following commands to provide a new hostname and configure a static IP address and gateway: ```powershell @@ -1026,16 +1053,16 @@ Use the following procedures to verify that the PoC environment is configured pr |Term|Definition| |--- |--- | -|GPT|GUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions.| -|Hyper-V|Hyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8.| -|Hyper-V host|The computer where Hyper-V is installed.| -|Hyper-V Manager|The user-interface console used to view and configure Hyper-V.| -|MBR|Master Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format.| -|Proof of concept (PoC)|Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process.| -|Shadow copy|A copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes.| -|Virtual machine (VM)|A VM is a virtual computer with its own operating system, running on the Hyper-V host.| -|Virtual switch|A virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host.| -|VM snapshot|A point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken.| +|**GPT**|GUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions.| +|**Hyper-V**|Hyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8.| +|**Hyper-V host**|The computer where Hyper-V is installed.| +|**Hyper-V Manager**|The user-interface console used to view and configure Hyper-V.| +|**MBR**|Master Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format.| +|**Proof of concept (PoC)**|Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process.| +|**Shadow copy**|A copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes.| +|**Virtual machine (VM)**|A VM is a virtual computer with its own operating system, running on the Hyper-V host.| +|**Virtual switch**|A virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host.| +|**VM snapshot**|A point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken.| ## Next steps diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index e5ceaf1248..7bfe334519 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -9,13 +9,13 @@ ms.prod: windows-client ms.collection: - M365-modern-desktop ms.topic: article -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- # Switch to Windows 10 Pro or Enterprise from S mode -We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. +We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. Many other transformations are possible depending on which version and edition of Windows 10 you're starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: @@ -37,20 +37,26 @@ Many other transformations are possible depending on which version and edition o | | Home | Not by any method | Not by any method | Not by any method | Use the following information to switch to Windows 10 Pro through the Microsoft Store. + > [!IMPORTANT] > While it's free to switch to Windows 10 Pro, it's not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. ## Switch one device through the Microsoft Store + Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. Note these differences affecting switching modes in various releases of Windows 10: - In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. -- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. -- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. -1. Sign into the Microsoft Store using your Microsoft account. +- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. + +- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. + +1. Sign into the Microsoft Store using your Microsoft account. + 2. Search for "S mode". + 3. In the offer, select **Buy**, **Get**, or **Learn more.** You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. @@ -60,13 +66,14 @@ You'll be prompted to save your files before the switch starts. Follow the promp Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE. Switching out of S mode gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. 1. Start Microsoft Intune. -2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. + +2. Navigate to **Device configuration** > **Profiles** > **Windows 10 and later** > **Edition upgrade and mode switch**. + 3. Follow the instructions to complete the switch. ## Block users from switching -You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. -To set this policy, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. +You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. To set this policy, go to **Device configuration** > **Profiles** > **Windows 10 and later** > **Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. ## S mode management with CSPs @@ -77,4 +84,4 @@ In addition to using Microsoft Intune or another modern device management tool t [FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
    [Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
    [Windows 10 Pro Education](/education/windows/test-windows10s-for-edu)
    -[Introduction to Microsoft Intune in the Azure portal](/intune/what-is-intune) \ No newline at end of file +[Introduction to Microsoft Intune in the Azure portal](/intune/what-is-intune) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 29d62e08fa..af9938ad6a 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -13,7 +13,7 @@ ms.collection: search.appverid: - MET150 ms.topic: conceptual -ms.date: 10/31/2022 +ms.date: 11/23/2022 appliesto: - ✅ Windows 10 - ✅ Windows 11 @@ -98,7 +98,7 @@ The following list illustrates how deploying Windows client has evolved with eac > The following requirements don't apply to general Windows client activation on Azure. Azure activation requires a connection to Azure KMS only. It supports workgroup, hybrid, and Azure AD-joined VMs. In most scenarios, activation of Azure VMs happens automatically. For more information, see [Understanding Azure KMS endpoints for Windows product activation of Azure virtual machines](/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems). > [!IMPORTANT] -> As of October 1, 2022, subscription activation is available for _commercial_ and _GCC_ tenants. It's currently not available on GCC High or DoD tenants. For more information, see [Enable subscription activation with an existing EA](deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea). +> As of October 1, 2022, subscription activation is available for *commercial* and *GCC* tenants. It's currently not available on GCC High or DoD tenants. For more information, see [Enable subscription activation with an existing EA](deploy-enterprise-licenses.md#enable-subscription-activation-with-an-existing-ea). For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following requirements: @@ -144,7 +144,7 @@ You can benefit by moving to Windows as an online service in the following ways: > [!NOTE] > The following examples use Windows 10 Pro to Enterprise edition. The examples also apply to Windows 11, and Education editions. -The device is Azure AD-joined from **Settings > Accounts > Access work or school**. +The device is Azure AD-joined from **Settings** > **Accounts** > **Access work or school**. You assign Windows 10 Enterprise to a user: diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md index f2fce638d0..f38cf33ebe 100644 --- a/windows/deployment/windows-adk-scenarios-for-it-pros.md +++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md @@ -6,7 +6,7 @@ ms.author: frankroj manager: aaroncz ms.prod: windows-client ms.localizationpriority: medium -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.topic: article ms.technology: itpro-deploy --- @@ -19,50 +19,50 @@ In previous releases of Windows, the Windows ADK docs were published on both Tec Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. -### Create a Windows image using command-line tools +## Create a Windows image using command-line tools [DISM](/windows-hardware/manufacture/desktop/dism---deployment-image-servicing-and-management-technical-reference-for-windows) is used to mount and service Windows images. Here are some things you can do with DISM: -- [Mount an offline image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism) -- [Add drivers to an offline image](/windows-hardware/manufacture/desktop/add-and-remove-drivers-to-an-offline-windows-image) -- [Enable or disable Windows features](/windows-hardware/manufacture/desktop/enable-or-disable-windows-features-using-dism) -- [Add or remove packages](/windows-hardware/manufacture/desktop/add-or-remove-packages-offline-using-dism) -- [Add language packs](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) -- [Add Universal Windows apps](/windows-hardware/manufacture/desktop/preinstall-apps-using-dism) -- [Upgrade the Windows edition](/windows-hardware/manufacture/desktop/change-the-windows-image-to-a-higher-edition-using-dism) +- [Mount an offline image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism) +- [Add drivers to an offline image](/windows-hardware/manufacture/desktop/add-and-remove-drivers-to-an-offline-windows-image) +- [Enable or disable Windows features](/windows-hardware/manufacture/desktop/enable-or-disable-windows-features-using-dism) +- [Add or remove packages](/windows-hardware/manufacture/desktop/add-or-remove-packages-offline-using-dism) +- [Add language packs](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) +- [Add Universal Windows apps](/windows-hardware/manufacture/desktop/preinstall-apps-using-dism) +- [Upgrade the Windows edition](/windows-hardware/manufacture/desktop/change-the-windows-image-to-a-higher-edition-using-dism) [Sysprep](/windows-hardware/manufacture/desktop/sysprep--system-preparation--overview) prepares a Windows installation for imaging and allows you to capture a customized installation. Here are some things you can do with Sysprep: -- [Generalize a Windows installation](/windows-hardware/manufacture/desktop/sysprep--generalize--a-windows-installation) -- [Customize the default user profile](/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile) -- [Use answer files](/windows-hardware/manufacture/desktop/use-answer-files-with-sysprep) +- [Generalize a Windows installation](/windows-hardware/manufacture/desktop/sysprep--generalize--a-windows-installation) +- [Customize the default user profile](/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile) +- [Use answer files](/windows-hardware/manufacture/desktop/use-answer-files-with-sysprep) [Windows PE (WinPE)](/windows-hardware/manufacture/desktop/winpe-intro) is a small operating system used to boot a computer that doesn't have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. Here are ways you can create a WinPE image: -- [Create a bootable USB drive](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) -- [Create a Boot CD, DVD, ISO, or VHD](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) +- [Create a bootable USB drive](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) +- [Create a Boot CD, DVD, ISO, or VHD](/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) [Windows Recovery Environment (Windows RE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is a recovery environment that can repair common operating system problems. Here are some things you can do with Windows RE: -- [Customize Windows RE](/windows-hardware/manufacture/desktop/customize-windows-re) -- [Push-button reset](/windows-hardware/manufacture/desktop/push-button-reset-overview) +- [Customize Windows RE](/windows-hardware/manufacture/desktop/customize-windows-re) +- [Push-button reset](/windows-hardware/manufacture/desktop/push-button-reset-overview) [Windows System Image Manager (Windows SIM)](/windows-hardware/customize/desktop/wsim/windows-system-image-manager-technical-reference) helps you create answer files that change Windows settings and run scripts during installation. Here are some things you can do with Windows SIM: -- [Create answer file](/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) -- [Add a driver path to an answer file](/windows-hardware/customize/desktop/wsim/add-a-device-driver-path-to-an-answer-file) -- [Add a package to an answer file](/windows-hardware/customize/desktop/wsim/add-a-package-to-an-answer-file) -- [Add a custom command to an answer file](/windows-hardware/customize/desktop/wsim/add-a-custom-command-to-an-answer-file) +- [Create answer file](/windows-hardware/customize/desktop/wsim/create-or-open-an-answer-file) +- [Add a driver path to an answer file](/windows-hardware/customize/desktop/wsim/add-a-device-driver-path-to-an-answer-file) +- [Add a package to an answer file](/windows-hardware/customize/desktop/wsim/add-a-package-to-an-answer-file) +- [Add a custom command to an answer file](/windows-hardware/customize/desktop/wsim/add-a-custom-command-to-an-answer-file) For a list of settings you can change, see [Unattended Windows Setup Reference](/windows-hardware/customize/desktop/unattend/) on the MSDN Hardware Dev Center. @@ -72,12 +72,12 @@ Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](/wi Here are some things you can do with Windows ICD: -- [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) -- [Export a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) +- [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) +- [Export a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package) ### IT Pro Windows deployment tools There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: -- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) \ No newline at end of file +- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) +- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 655fb1b5df..b6ac225f0e 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -6,7 +6,7 @@ ms.author: frankroj author: frankroj ms.prod: windows-client ms.topic: article -ms.date: 10/31/2022 +ms.date: 11/23/2022 ms.technology: itpro-deploy --- @@ -55,15 +55,15 @@ USMT is a backup and restore tool that allows you to migrate user state, data, a USMT includes several command-line tools, the most important of which are ScanState and LoadState: -- **ScanState.exe.** This tool performs the user-state backup. -- **LoadState.exe.** This tool performs the user-state restore. -- **UsmtUtils.exe.** This tool supplements the functionality in ScanState.exe and LoadState.exe. +- **ScanState.exe**: This tool performs the user-state backup. +- **LoadState.exe**: This tool performs the user-state restore. +- **UsmtUtils.exe**: This tool supplements the functionality in ScanState.exe and LoadState.exe. In addition to these tools, there are also XML templates that manage which data is migrated. You can customize the templates, or create new ones, to manage the backup process at a high level of detail. USMT uses the following terms for its templates: -- **Migration templates.** The default templates in USMT. -- **Custom templates.** Custom templates that you create. -- **Config template.** An optional template called Config.xml which you can use to exclude or include components in a migration without modifying the other standard XML templates. +- **Migration templates**: The default templates in USMT. +- **Custom templates**: Custom templates that you create. +- **Config template**: An optional template called Config.xml which you can use to exclude or include components in a migration without modifying the other standard XML templates. ![A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files..](images/mdt-11-fig06.png) @@ -73,60 +73,21 @@ USMT supports capturing data and settings from Windows Vista and later, and rest By default USMT migrates many settings, most of which are related to the user profile but also to Control Panel configurations, file types, and more. The default templates that are used in Windows 10 deployments are MigUser.xml and MigApp.xml. These two default templates migrate the following data and settings: -- Folders from each profile, including those folders from user profiles, and shared and public profiles. For example, the My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites folders are migrated. -- Specific file types. -
    - USMT templates migrate the following file types: +- Folders from each profile, including those folders from user profiles, and shared and public profiles. For example, the My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites folders are migrated. - - `.accdb` - - `.ch3` - - `.csv` - - `.dif` - - `.doc*` - - `.dot*` - - `.dqy` - - `.iqy` - - `.mcw` - - `.mdb*` - - `.mpp` - - `.one*` - - `.oqy` - - `.or6` - - `.pot*` - - `.ppa` - - `.pps*` - - `.ppt*` - - `.pre` - - `.pst` - - `.pub` - - `.qdf` - - `.qel` - - `.qph` - - `.qsd` - - `.rqy` - - `.rtf` - - `.scd` - - `.sh3` - - `.slk` - - `.txt` - - `.vl*` - - `.vsd` - - `.wk*` - - `.wpd` - - `.wps` - - `.wq1` - - `.wri` - - `.xl*` - - `.xla` - - `.xlb` - - `.xls*` -
    +- The following specific file types: + + `.accdb`, `.ch3`, `.csv`, `.dif`, `.doc*`, `.dot*`, `.dqy`, `.iqy`, `.mcw`, `.mdb*`, `.mpp`, `.one*`, `.oqy`, `.or6`, `.pot*`, `.ppa`, `.pps*`, `.ppt*`, `.pre`, `.pst`, `.pub`, `.qdf`, `.qel`, `.qph`, `.qsd`, `.rqy`, `.rtf`, `.scd`, `.sh3`, `.slk`, `.txt`, `.vl*`, `.vsd`, `.wk*`, `.wpd`, `.wps`, `.wq1`, `.wri`, `.xl*`, `.xla`, `.xlb`, `.xls*` + + > [!NOTE] + > The asterisk (`*`) stands for zero or more characters. > [!NOTE] > The OpenDocument extensions (`*.odt`, `*.odp`, `*.ods`) that Microsoft Office applications can use aren't migrated by default. -- Operating system component settings -- Application settings +- Operating system component settings + +- Application settings These settings are migrated by the default MigUser.xml and MigApp.xml templates. For more information, see [What does USMT migrate?](./usmt/usmt-what-does-usmt-migrate.md) For more general information on USMT, see [USMT technical reference](./usmt/usmt-reference.md). @@ -178,7 +139,7 @@ A machine booted with the Windows ADK default Windows PE boot image. For more information on Windows PE, see [Windows PE (WinPE)](/windows-hardware/manufacture/desktop/winpe-intro). -## Windows Recovery Environment +## Windows Recovery Environment Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you'll see an automatic failover into Windows RE. @@ -204,9 +165,9 @@ In some cases, you need to modify TFTP Maximum Block Size settings for performan Also, there are a few new features related to TFTP performance: -- **Scalable buffer management.** Allows buffering an entire file instead of a fixed-size buffer for each client, enabling different sessions to read from the same shared buffer. -- **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. -- **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. +- **Scalable buffer management**: Allows buffering an entire file instead of a fixed-size buffer for each client, enabling different sessions to read from the same shared buffer. +- **Scalable port management**: Provides the capability to service clients with shared UDP port allocation, increasing scalability. +- **Variable-size transmission window (Variable Windows Extension)**: Improves TFTP performance by allowing the client and server to determine the largest workable window size. ![TFTP changes are now easy to perform.](images/mdt-11-fig12.png) @@ -214,7 +175,6 @@ TFTP changes are now easy to perform. ## Microsoft Deployment Toolkit - MDT is a free deployment solution from Microsoft. It provides end-to-end guidance, best practices, and tools for planning, building, and deploying Windows operating systems. MDT builds on top of the core deployment tools in the Windows ADK by contributing guidance, reducing complexity, and adding critical features for an enterprise-ready deployment solution. MDT has two main parts: the first is Lite Touch, which is a stand-alone deployment solution; the second is Zero Touch, which is an extension to Configuration Manager. @@ -242,16 +202,20 @@ MDOP is a suite of technologies available to Software Assurance customers throug The following components are included in the MDOP suite: -- **Microsoft Application Virtualization (App-V).** App-V 5.0 provides an integrated platform, more flexible virtualization, and powerful management for virtualized applications. With the release of App-V 5.0 SP3, you have support to run virtual applications on Windows 10. +- **Microsoft Application Virtualization (App-V).** App-V 5.0 provides an integrated platform, more flexible virtualization, and powerful management for virtualized applications. With the release of App-V 5.0 SP3, you have support to run virtual applications on Windows 10. -- **Microsoft User Experience Virtualization (UE-V).** UE-V monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. +- **Microsoft User Experience Virtualization (UE-V).** UE-V monitors the changes that are made by users to application settings and Windows operating system settings. The user settings are captured and centralized to a settings storage location. These settings can then be applied to the different computers that are accessed by the user, including desktop computers, laptop computers, and virtual desktop infrastructure (VDI) sessions. -- **Microsoft Advanced Group Policy Management (AGPM).** AGPM enables advanced management of Group Policy objects by providing change control, offline editing, and role-based delegation. -- **Microsoft Diagnostics and Recovery Toolset (DaRT).** DaRT provides additional tools that extend Windows RE to help you troubleshoot and repair your machines. -- **Microsoft BitLocker Administration and Monitoring (MBAM).** MBAM is an administrator interface used to manage BitLocker drive encryption. It allows you to configure your enterprise with the correct BitLocker encryption policy options, and monitor compliance with these policies. +- **Microsoft Advanced Group Policy Management (AGPM).** AGPM enables advanced management of Group Policy objects by providing change control, offline editing, and role-based delegation. +- **Microsoft Diagnostics and Recovery Toolset (DaRT).** DaRT provides additional tools that extend Windows RE to help you troubleshoot and repair your machines. +- **Microsoft BitLocker Administration and Monitoring (MBAM).** MBAM is an administrator interface used to manage BitLocker drive encryption. It allows you to configure your enterprise with the correct BitLocker encryption policy options, and monitor compliance with these policies. For more information on the benefits of an MDOP subscription, see [Microsoft Desktop Optimization Pack](/microsoft-desktop-optimization-pack/). + + ## Windows Server Update Services WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. @@ -274,32 +240,31 @@ For more information on WSUS, see the [Windows Server Update Services Overview]( ## Unified Extensible Firmware Interface - For many years, BIOS has been the industry standard for booting a PC. BIOS has served us well, but it's time to replace it with something better. **UEFI** is the replacement for BIOS, so it's important to understand the differences between BIOS and UEFI. In this section, you learn the major differences between the two and how they affect operating system deployment. ### Introduction to UEFI BIOS has been in use for approximately 30 years. Even though it clearly has proven to work, it has some limitations, including: -- 16-bit code -- 1-MB address space -- Poor performance on ROM initialization -- MBR maximum bootable disk size of 2.2 TB +- 16-bit code +- 1-MB address space +- Poor performance on ROM initialization +- MBR maximum bootable disk size of 2.2 TB As the replacement to BIOS, UEFI has many features that Windows can and will use. With UEFI, you can benefit from: -- **Support for large disks.** UEFI requires a GUID Partition Table (GPT) based disk, which means a limitation of roughly 16.8 million TB in disk size and more than 100 primary disks. -- **Faster boot time.** UEFI doesn't use INT 13, and that improves boot time, especially when it comes to resuming from hibernate. -- **Multicast deployment.** UEFI firmware can use multicast directly when it boots up. In WDS, MDT, and Configuration Manager scenarios, you need to first boot up a normal Windows PE in unicast and then switch into multicast. With UEFI, you can run multicast from the start. -- **Compatibility with earlier BIOS.** Most of the UEFI implementations include a compatibility support module (CSM) that emulates BIOS. -- **CPU-independent architecture.** Even if BIOS can run both 32-bit and 64-bit versions of firmware, all firmware device drivers on BIOS systems must also be 16-bit, and this affects performance. One of the reasons is the limitation in addressable memory, which is only 64 KB with BIOS. -- **CPU-independent drivers.** On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. That isn't needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images, which allow for a processor-independent device driver environment. -- **Flexible pre-operating system environment.** UEFI can perform many functions for you. You just need an UEFI application, and you can perform diagnostics and automatic repairs, and call home to report errors. -- **Secure boot.** Windows 8 and later can use the UEFI firmware validation process, called secure boot, which is defined in UEFI 2.3.1. Using this process, you can ensure that UEFI launches only a verified operating system loader and that malware can't switch the boot loader. +- **Support for large disks.** UEFI requires a GUID Partition Table (GPT) based disk, which means a limitation of roughly 16.8 million TB in disk size and more than 100 primary disks. +- **Faster boot time.** UEFI doesn't use INT 13, and that improves boot time, especially when it comes to resuming from hibernate. +- **Multicast deployment.** UEFI firmware can use multicast directly when it boots up. In WDS, MDT, and Configuration Manager scenarios, you need to first boot up a normal Windows PE in unicast and then switch into multicast. With UEFI, you can run multicast from the start. +- **Compatibility with earlier BIOS.** Most of the UEFI implementations include a compatibility support module (CSM) that emulates BIOS. +- **CPU-independent architecture.** Even if BIOS can run both 32-bit and 64-bit versions of firmware, all firmware device drivers on BIOS systems must also be 16-bit, and this affects performance. One of the reasons is the limitation in addressable memory, which is only 64 KB with BIOS. +- **CPU-independent drivers.** On BIOS systems, PCI add-on cards must include a ROM that contains a separate driver for all supported CPU architectures. That isn't needed for UEFI because UEFI has the ability to use EFI Byte Code (EBC) images, which allow for a processor-independent device driver environment. +- **Flexible pre-operating system environment.** UEFI can perform many functions for you. You just need an UEFI application, and you can perform diagnostics and automatic repairs, and call home to report errors. +- **Secure boot.** Windows 8 and later can use the UEFI firmware validation process, called secure boot, which is defined in UEFI 2.3.1. Using this process, you can ensure that UEFI launches only a verified operating system loader and that malware can't switch the boot loader. -### Versions +### UEFI versions UEFI Version 2.3.1B is the version required for Windows 8 and later logo compliance. Later versions have been released to address issues; a few machines may need to upgrade their firmware to fully support the UEFI implementation in Windows 8 and later. @@ -307,10 +272,10 @@ UEFI Version 2.3.1B is the version required for Windows 8 and later logo complia In regard to UEFI, hardware is divided into four device classes: -- **Class 0 devices.** The device of this class is the UEFI definition for a BIOS, or non-UEFI, device. -- **Class 1 devices.** The devices of this class behave like a standard BIOS machine, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS. These older devices are no longer manufactured. -- **Class 2 devices.** The devices of this class have the capability to behave as a BIOS- or a UEFI-based machine, and the boot process or the configuration in the firmware/BIOS determines the mode. Class 2 devices use a CSM to emulate BIOS. These are the most common type of devices currently available. -- **Class 3 devices.** The devices of this class are UEFI-only devices, which means you must run an operating system that supports only UEFI. Those operating systems include Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. Windows 7 isn't supported on these class 3 devices. Class 3 devices don't have a CSM to emulate BIOS. +- **Class 0 devices.** The device of this class is the UEFI definition for a BIOS, or non-UEFI, device. +- **Class 1 devices.** The devices of this class behave like a standard BIOS machine, but they run EFI internally. They should be treated as normal BIOS-based machines. Class 1 devices use a CSM to emulate BIOS. These older devices are no longer manufactured. +- **Class 2 devices.** The devices of this class have the capability to behave as a BIOS- or a UEFI-based machine, and the boot process or the configuration in the firmware/BIOS determines the mode. Class 2 devices use a CSM to emulate BIOS. These are the most common type of devices currently available. +- **Class 3 devices.** The devices of this class are UEFI-only devices, which means you must run an operating system that supports only UEFI. Those operating systems include Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. Windows 7 isn't supported on these class 3 devices. Class 3 devices don't have a CSM to emulate BIOS. ### Windows support for UEFI @@ -322,14 +287,14 @@ With UEFI 2.3.1, there are both x86 and x64 versions of UEFI. Windows 10 support There are many things that affect operating system deployment as soon as you run on UEFI/EFI-based hardware. Here are considerations to keep in mind when working with UEFI devices: -- Switching from BIOS to UEFI in the hardware is easy, but you also need to reinstall the operating system because you need to switch from MBR/NTFS to GPT/FAT32 and NTFS. -- When you deploy to a Class 2 device, make sure the boot option you select matches the setting you want to have. It's common for old machines to have several boot options for BIOS but only a few for UEFI, or vice versa. -- When deploying from media, remember the media has to be FAT32 for UEFI, and FAT32 has a file-size limitation of 4 GB. -- UEFI doesn't support cross-platform booting; therefore, you need to have the correct boot media (32-bit or 64-bit). +- Switching from BIOS to UEFI in the hardware is easy, but you also need to reinstall the operating system because you need to switch from MBR/NTFS to GPT/FAT32 and NTFS. +- When you deploy to a Class 2 device, make sure the boot option you select matches the setting you want to have. It's common for old machines to have several boot options for BIOS but only a few for UEFI, or vice versa. +- When deploying from media, remember the media has to be FAT32 for UEFI, and FAT32 has a file-size limitation of 4 GB. +- UEFI doesn't support cross-platform booting; therefore, you need to have the correct boot media (32-bit or 64-bit). For more information on UEFI, see the [UEFI firmware](/previous-versions/windows/it-pro/windows-8.1-and-8/hh824898(v=win.10)) overview and related resources. ## Related articles [Sideload apps in Windows 10](/windows/application-management/sideload-apps-in-windows-10)
    -[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md) \ No newline at end of file +[Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md) From b3c513ce2185f2274c06dc992a7d5fa52e1191cd Mon Sep 17 00:00:00 2001 From: "microsoft-github-policy-service[bot]" <77245923+microsoft-github-policy-service[bot]@users.noreply.github.com> Date: Fri, 25 Nov 2022 06:25:11 +0000 Subject: [PATCH 049/324] Microsoft mandatory file --- SECURITY.md | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..e138ec5d6a --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ + + +## Security + +Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/). + +If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), please report it to us as described below. + +## Reporting Security Issues + +**Please do not report security vulnerabilities through public GitHub issues.** + +Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report). + +If you prefer to submit without logging in, send email to [secure@microsoft.com](mailto:secure@microsoft.com). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/opensource/security/pgpkey). + +You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc). + +Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue: + + * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.) + * Full paths of source file(s) related to the manifestation of the issue + * The location of the affected source code (tag/branch/commit or direct URL) + * Any special configuration required to reproduce the issue + * Step-by-step instructions to reproduce the issue + * Proof-of-concept or exploit code (if possible) + * Impact of the issue, including how an attacker might exploit the issue + +This information will help us triage your report more quickly. + +If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs. + +## Preferred Languages + +We prefer all communications to be in English. + +## Policy + +Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd). + + From 26bc812748c24ff6b0469e8038f6e8c885b3f163 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 10:31:52 -0500 Subject: [PATCH 050/324] Update hello-deployment-rdp-certs.md --- .../hello-for-business/hello-deployment-rdp-certs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 61a80e17c5..6d15bed176 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -140,7 +140,7 @@ This section describes how to configure a SCEP policy in Intune. Similar steps c |*Key size (bits)* | **2048**| |*For Hash algorithm*|**SHA-2**| |*Root Certificate*| Select **+Root Certificate** and select the trusted certificate profile created earlier for the Root CA Certificate| - |*Extended key usage*|
    • *Name:* **Smart Card Logon**
    • *Object Identifier:* `1.3.6.1.4.1.311.20.2.2`
    • *Predefined Values:* **Smart Card Logon**

    • *Name:* **Client Authentication**
    • *Object Identifier:* `1.3.6.1.5.5.7.3.2 `
    • *Predefined Values:* **Client Authentication**
    | + |*Extended key usage*|
    • *Name:* **Smart Card Logon**
    • *Object Identifier:* `1.3.6.1.4.1.311.20.2.2`
    • *Predefined Values:* **Not configured**

    • *Name:* **Client Authentication**
    • *Object Identifier:* `1.3.6.1.5.5.7.3.2 `
    • *Predefined Values:* **Client Authentication**
    | |*Renewal threshold (%)*|Configure a value of your choosing| |*SCEP Server URLs*|Provide the public endpoint(s) that you configured during the deployment of your SCEP infrastructure| From 1f665fef2f38ab8ef43f74132d9bb24e6fe44fb5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 10:45:31 -0500 Subject: [PATCH 051/324] Update hello-deployment-rdp-certs.md --- .../hello-for-business/hello-deployment-rdp-certs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 6d15bed176..62f11e2460 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -55,7 +55,7 @@ Follow these steps to create a certificate template: | *Compatibility* |
    • Clear the **Show resulting changes** check box
    • Select **Windows Server 2012 or Windows Server 2012 R2** from the *Certification Authority list*
    • Select **Windows Server 2012 or Windows Server 2012 R2** from the *Certification Recipient list*
    | | *General* |
    • Specify a **Template display name**, for example *WHfB Certificate Authentication*
    • Set the validity period to the desired value
    • Take note of the Template name for later, which should be the same as the Template display name minus spaces (*WHfBCertificateAuthentication* in this example)
    | | *Extensions* | Verify the **Application Policies** extension includes **Smart Card Logon**| - | *Subject Name* |
    • Select the **Build from this Active Directory** information button if it isn't already selected
    • Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name isn't already selected
    • Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**
    | + | *Subject Name* |
    • Select the **Build from this Active Directory** information button if it isn't already selected
    • Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name isn't already selected
    • Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**

    **Note:** If you deploy certificates via Intune, select **Supply in the request** instead of * Build from this Active Directory*.| |*Request Handling*|
    • Set the Purpose to **Signature and smartcard logon** and select **Yes** when prompted to change the certificate purpose
    • Select the **Renew with same key** check box
    • Select **Prompt the user during enrollment**
    | |*Cryptography*|
    • Set the Provider Category to **Key Storage Provider**
    • Set the Algorithm name to **RSA**
    • Set the minimum key size to **2048**
    • Select **Requests must use one of the following providers**
    • Select **Microsoft Software Key Storage Provider**
    • Set the Request hash to **SHA256**
    | |*Security*|Add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated** users group, and then select Enroll permissions for them| From e7ca66c6721d33a79d6ac995315a0e40c801accf Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 10:46:30 -0500 Subject: [PATCH 052/324] Update hello-deployment-rdp-certs.md --- .../hello-for-business/hello-deployment-rdp-certs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 62f11e2460..82e591ddb6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -55,7 +55,7 @@ Follow these steps to create a certificate template: | *Compatibility* |
    • Clear the **Show resulting changes** check box
    • Select **Windows Server 2012 or Windows Server 2012 R2** from the *Certification Authority list*
    • Select **Windows Server 2012 or Windows Server 2012 R2** from the *Certification Recipient list*
    | | *General* |
    • Specify a **Template display name**, for example *WHfB Certificate Authentication*
    • Set the validity period to the desired value
    • Take note of the Template name for later, which should be the same as the Template display name minus spaces (*WHfBCertificateAuthentication* in this example)
    | | *Extensions* | Verify the **Application Policies** extension includes **Smart Card Logon**| - | *Subject Name* |
    • Select the **Build from this Active Directory** information button if it isn't already selected
    • Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name isn't already selected
    • Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**

    **Note:** If you deploy certificates via Intune, select **Supply in the request** instead of * Build from this Active Directory*.| + | *Subject Name* |
    • Select the **Build from this Active Directory** information button if it isn't already selected
    • Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name isn't already selected
    • Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**

    **Note:** If you deploy certificates via Intune, select **Supply in the request** instead of *Build from this Active Directory*| |*Request Handling*|
    • Set the Purpose to **Signature and smartcard logon** and select **Yes** when prompted to change the certificate purpose
    • Select the **Renew with same key** check box
    • Select **Prompt the user during enrollment**
    | |*Cryptography*|
    • Set the Provider Category to **Key Storage Provider**
    • Set the Algorithm name to **RSA**
    • Set the minimum key size to **2048**
    • Select **Requests must use one of the following providers**
    • Select **Microsoft Software Key Storage Provider**
    • Set the Request hash to **SHA256**
    | |*Security*|Add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated** users group, and then select Enroll permissions for them| From 49ff4e0bdb2904333cf32c9eb57559ef4b1574fd Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Mon, 28 Nov 2022 09:34:34 -0700 Subject: [PATCH 053/324] Add DO related items to schema table --- windows/deployment/update/wufb-reports-overview.md | 5 +++-- windows/deployment/update/wufb-reports-schema-ucdostatus.md | 2 +- windows/deployment/update/wufb-reports-schema.md | 2 ++ 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/wufb-reports-overview.md b/windows/deployment/update/wufb-reports-overview.md index 6315bbdd8c..f4206b0189 100644 --- a/windows/deployment/update/wufb-reports-overview.md +++ b/windows/deployment/update/wufb-reports-overview.md @@ -40,10 +40,11 @@ Currently, Windows Update for Business reports contains the following features: - UCClientReadinessStatus - UCClientUpdateStatus - UCDeviceAlert + - UCDOAggregatedStatus + - UCDOStatus - UCServiceUpdateStatus - UCUpdateAlert - - UCDOStatus - - UCDOAggregatedStatus + - Client data collection to populate the Windows Update for Business reports tables :::image type="content" source="media/wufb-reports-query-table.png" alt-text="Screenshot of using a custom Kusto (KQL) query on Windows Update for Business reports data in Log Analytics." lightbox="media/wufb-reports-query-table.png"::: diff --git a/windows/deployment/update/wufb-reports-schema-ucdostatus.md b/windows/deployment/update/wufb-reports-schema-ucdostatus.md index 0b11c3c938..01ad6b186a 100644 --- a/windows/deployment/update/wufb-reports-schema-ucdostatus.md +++ b/windows/deployment/update/wufb-reports-schema-ucdostatus.md @@ -16,7 +16,7 @@ ms.technology: itpro-updates ***(Applies to: Windows 11 & Windows 10)*** -UCDOStatus provides information, for a single device, on its bandwidth utilization across content types in the event they use Delivery Optimization. +UCDOStatus provides information, for a single device, on its bandwidth utilization across content types in the event they use [Delivery Optimization and Microsoft Connected Cache](/windows/deployment/do). |Field |Type |Example |Description | |---|---|---|---| diff --git a/windows/deployment/update/wufb-reports-schema.md b/windows/deployment/update/wufb-reports-schema.md index 8b2936c9bc..27d15d676a 100644 --- a/windows/deployment/update/wufb-reports-schema.md +++ b/windows/deployment/update/wufb-reports-schema.md @@ -31,5 +31,7 @@ The following table summarizes the different tables that are part of the Windows |[**UCClientReadinessStatus**](wufb-reports-schema-ucclientreadinessstatus.md) | Device record | UCClientReadinessStatus is an individual device's record about its readiness for updating to Windows 11. If the device isn't capable of running Windows 11, the record includes which Windows 11 hardware requirements the device doesn't meet.| | [**UCClientUpdateStatus**](wufb-reports-schema-ucclientupdatestatus.md) | Device record | Update Event that combines the latest client-based data with the latest service-based data to create a complete picture for one device (client) and one update. | | [**UCDeviceAlert**](wufb-reports-schema-ucdevicealert.md)| Service and device record | These alerts are activated as a result of an issue that is device-specific. It isn't specific to the combination of a specific update and a specific device. Like UpdateAlerts, the AlertType indicates where the Alert comes from such as a ServiceDeviceAlert or ClientDeviceAlert. | +| [**UCDOAggregatedStatus**](wufb-reports-schema-ucdoaggregatedstatus.md)| Device record | UCDOAggregatedStatus is an aggregation of all individual UDDOStatus records across the tenant and summarizes bandwidth savings across all devices enrolled using Delivery Optimization and Microsoft Connected Cache. | +| [**UCDOStatus**](wufb-reports-schema-ucdostatus.md)| Device record | UCDOStatus provides information, for a single device, on its bandwidth utilization across content types in the event they use Delivery Optimization and Microsoft Connected Cache. | | [**UCServiceUpdateStatus**](wufb-reports-schema-ucserviceupdatestatus.md) | Service record | Update Event that comes directly from the service-side. The event has only service-side information for one device (client), and one update, in one deployment. | | [**UCUpdateAlert**](wufb-reports-schema-ucupdatealert.md) | Service and device records | Alert for both client and service update. Contains information that needs attention, relative to one device (client), one update, and one deployment, if relevant. Certain fields may be blank depending on the UpdateAlert's AlertType field. For example, ServiceUpdateAlert won't necessarily contain client-side statuses and may be blank. | From 1f0b1288fb06bb5fe6c27ac9b78b9108e5e1f4e6 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Mon, 28 Nov 2022 10:58:00 -0600 Subject: [PATCH 054/324] Apply suggestions from code review Acro edits. --- windows/deployment/deploy-windows-to-go.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-windows-to-go.md b/windows/deployment/deploy-windows-to-go.md index e2257c041b..0a538f15f8 100644 --- a/windows/deployment/deploy-windows-to-go.md +++ b/windows/deployment/deploy-windows-to-go.md @@ -68,7 +68,7 @@ In this step we're creating the operating system image that will be used on the 5. On the **Choose the drive you want to use** page select the drive that represents the USB drive you inserted previously, then select **Next.** -6. On the **Choose a Windows image** page, select **Add Search Location** and then navigate to the `.wim` file location and select select folder. The wizard will display the installable images present in the folder; select the Windows 10 Enterprise or Windows 10 Education image you wish to use and then select **Next**. +6. On the **Choose a Windows image** page, select **Add Search Location** and then navigate to the `.wim` file location and select folder. The wizard will display the installable images present in the folder; select the Windows 10 Enterprise or Windows 10 Education image you wish to use and then select **Next**. 7. (Optional) On the **Set a BitLocker password (optional)** page, you can select **Use BitLocker with my Windows To Go Workspace** to encrypt your Windows To Go drive. If you don't wish to encrypt the drive at this time, select **Skip**. If you decide you want to add BitLocker protection later, for instructions see [Enable BitLocker protection for your Windows To Go drive](/previous-versions/windows/it-pro/windows-8.1-and-8/jj721578(v=ws.11)). @@ -443,7 +443,7 @@ Enabling BitLocker on your Windows To Go drive will help ensure that your data i - **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Configure use of passwords for operating system drives** - This policy setting enables passwords to be used to unlock BitLocker-protected operating system drives and provides the means to configure complexity and length requirements on passwords for Windows To Go workspaces. For the complexity requirement setting to be effective the Group Policy setting **Password must meet complexity requirements** located in **Computer Configuration** > **Windows Settings** > **ecurity Settings** > **Account Policies** > **Password Policy** must be also enabled. + This policy setting enables passwords to be used to unlock BitLocker-protected operating system drives and provides the means to configure complexity and length requirements on passwords for Windows To Go workspaces. For the complexity requirement setting to be effective the Group Policy setting **Password must meet complexity requirements** located in **Computer Configuration** > **Windows Settings** > **Security Settings** > **Account Policies** > **Password Policy** must be also enabled. - **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Enable use of BitLocker authentication requiring preboot keyboard input on slates** From a900fbebad45e7ab3ba1197e3d769be0f3c1b846 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <36546697+jborsecnik@users.noreply.github.com> Date: Mon, 28 Nov 2022 09:39:08 -0800 Subject: [PATCH 055/324] Update hello-deployment-rdp-certs.md --- .../hello-for-business/hello-deployment-rdp-certs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 82e591ddb6..af71e186d2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -55,7 +55,7 @@ Follow these steps to create a certificate template: | *Compatibility* |
    • Clear the **Show resulting changes** check box
    • Select **Windows Server 2012 or Windows Server 2012 R2** from the *Certification Authority list*
    • Select **Windows Server 2012 or Windows Server 2012 R2** from the *Certification Recipient list*
    | | *General* |
    • Specify a **Template display name**, for example *WHfB Certificate Authentication*
    • Set the validity period to the desired value
    • Take note of the Template name for later, which should be the same as the Template display name minus spaces (*WHfBCertificateAuthentication* in this example)
    | | *Extensions* | Verify the **Application Policies** extension includes **Smart Card Logon**| - | *Subject Name* |
    • Select the **Build from this Active Directory** information button if it isn't already selected
    • Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name isn't already selected
    • Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**

    **Note:** If you deploy certificates via Intune, select **Supply in the request** instead of *Build from this Active Directory*| + | *Subject Name* |
    • Select the **Build from this Active Directory** information button if it isn't already selected
    • Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name isn't already selected
    • Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**

    **Note:** If you deploy certificates via Intune, select **Supply in the request** instead of *Build from this Active Directory*.| |*Request Handling*|
    • Set the Purpose to **Signature and smartcard logon** and select **Yes** when prompted to change the certificate purpose
    • Select the **Renew with same key** check box
    • Select **Prompt the user during enrollment**
    | |*Cryptography*|
    • Set the Provider Category to **Key Storage Provider**
    • Set the Algorithm name to **RSA**
    • Set the minimum key size to **2048**
    • Select **Requests must use one of the following providers**
    • Select **Microsoft Software Key Storage Provider**
    • Set the Request hash to **SHA256**
    | |*Security*|Add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated** users group, and then select Enroll permissions for them| From d2d667cda31534c2d4d1645eaa2efe1aa3aa027b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 14:38:19 -0500 Subject: [PATCH 056/324] Update windows/security/identity-protection/credential-guard/credential-guard-known-issues.md Co-authored-by: mapalko <20977663+mapalko@users.noreply.github.com> --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 517b038409..962ea3db39 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -51,7 +51,7 @@ Microsoft recommends that organizations move away from MSCHAPv2-based connection For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. > [!TIP] -> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before installing the Windows 11, version 22H2 update. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. > [!NOTE] > MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: From 2e513a20104d0a12af300f252d1b92981d5dc879 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 14:39:56 -0500 Subject: [PATCH 057/324] Update credential-guard-known-issues.md --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 962ea3db39..d863d5b342 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -9,7 +9,7 @@ ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article -ms.date: 01/26/2022 +ms.date: 11/28/2022 appliesto: - ✅ Windows 10 - ✅ Windows 11 From 30e66f5ac86ea71a3b77182cb7b8fc9e14075af4 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 15:19:09 -0500 Subject: [PATCH 058/324] updates --- windows/security/TOC.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 8cfebcc879..250dc19e5d 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -312,12 +312,13 @@ href: identity-protection/windows-credential-theft-mitigation-guide-abstract.md - name: Enterprise Certificate Pinning href: identity-protection/enterprise-certificate-pinning.md - - name: Protect derived domain credentials with Credential Guard - href: identity-protection/credential-guard/credential-guard.md + - name: Credential Guard items: + - name: Protect derived domain credentials with Credential Guard + href: identity-protection/credential-guard/credential-guard.md - name: How Credential Guard works href: identity-protection/credential-guard/credential-guard-how-it-works.md - - name: Credential Guard Requirements + - name: Requirements href: identity-protection/credential-guard/credential-guard-requirements.md - name: Manage Credential Guard href: identity-protection/credential-guard/credential-guard-manage.md @@ -327,11 +328,11 @@ href: identity-protection/credential-guard/credential-guard-protection-limits.md - name: Considerations when using Credential Guard href: identity-protection/credential-guard/credential-guard-considerations.md - - name: "Credential Guard: Additional mitigations" + - name: Additional mitigations href: identity-protection/credential-guard/additional-mitigations.md - - name: "Credential Guard: Known issues" + - name: Known issues href: identity-protection/credential-guard/credential-guard-known-issues.md - - name: Protect Remote Desktop credentials with Remote Credential Guard + - name: Remote Credential Guard href: identity-protection/remote-credential-guard.md - name: Configuring LSA Protection href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json From 83e965b8ee175f04e6847bcceb3f68d2872c01dc Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 28 Nov 2022 15:38:03 -0500 Subject: [PATCH 059/324] Update copy-a-gpo-to-create-a-new-gpo.md --- .../windows-firewall/copy-a-gpo-to-create-a-new-gpo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md index f1dfaa8500..219e8ac7ac 100644 --- a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md @@ -43,7 +43,7 @@ To complete this procedure, you must be a member of the Domain Administrators gr 4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**. - ![Screenshot that shows Copy Paste GPO.](/images/grouppolicy-paste.png) + ![Screenshot that shows Copy Paste GPO.](images/grouppolicy-paste.png) 5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler. From 3b995230d5666710b4895f256d455f28ffa98707 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 28 Nov 2022 15:43:09 -0500 Subject: [PATCH 060/324] Update copy-a-gpo-to-create-a-new-gpo.md --- .../windows-firewall/copy-a-gpo-to-create-a-new-gpo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md index 219e8ac7ac..9dc64b2ee1 100644 --- a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md @@ -43,7 +43,7 @@ To complete this procedure, you must be a member of the Domain Administrators gr 4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**. - ![Screenshot that shows Copy Paste GPO.](images/grouppolicy-paste.png) + ![Screenshot that shows Copy Paste GPO.](images/grouppolicy-paste.png) 5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler. From ce709b0228e12483998fcca27c38ae93401312a0 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Mon, 28 Nov 2022 15:24:40 -0700 Subject: [PATCH 061/324] Update windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md Line 46: Change markup to custom Markdown to automatically include the gray border. --- .../windows-firewall/copy-a-gpo-to-create-a-new-gpo.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md index 9dc64b2ee1..cae3c81088 100644 --- a/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ b/windows/security/threat-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md @@ -43,7 +43,7 @@ To complete this procedure, you must be a member of the Domain Administrators gr 4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**. - ![Screenshot that shows Copy Paste GPO.](images/grouppolicy-paste.png) + :::image type="content" alt-text="Screenshot that shows Copy Paste GPO." source="images/grouppolicy-paste.png"::: 5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler. From c25d3042f9b6354b9647b21f81071271a7cc158b Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 28 Nov 2022 20:02:55 -0500 Subject: [PATCH 062/324] MDT code block standardization plus style updates --- .../assign-applications-using-roles-in-mdt.md | 54 +- ...d-environment-for-windows-10-deployment.md | 209 ++++--- .../configure-mdt-deployment-share-rules.md | 49 +- .../configure-mdt-for-userexit-scripts.md | 33 +- .../configure-mdt-settings.md | 30 +- .../create-a-windows-10-reference-image.md | 522 ++++++++++-------- .../deploy-a-windows-10-image-using-mdt.md | 433 ++++++++------- ...d-with-the-microsoft-deployment-toolkit.md | 130 +++-- ...prepare-for-windows-deployment-with-mdt.md | 136 +++-- ...sh-a-windows-7-computer-with-windows-10.md | 96 ++-- ...s-7-computer-with-a-windows-10-computer.md | 126 +++-- .../set-up-mdt-for-bitlocker.md | 71 ++- ...ows-10-deployment-in-a-test-environment.md | 45 +- ...0-with-the-microsoft-deployment-toolkit.md | 80 +-- .../use-orchestrator-runbooks-with-mdt.md | 182 +++--- ...stage-windows-10-deployment-information.md | 96 ++-- .../use-web-services-in-mdt.md | 134 +++-- 17 files changed, 1383 insertions(+), 1043 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md index c267cbdf68..80c99d9d57 100644 --- a/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md +++ b/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt.md @@ -9,43 +9,49 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Assign applications using roles in MDT This article will show you how to add applications to a role in the MDT database and then assign that role to a computer. For the purposes of this article, the application we're adding is Adobe Reader XI. In addition to using computer-specific entries in the database, you can use roles in MDT to group settings together. -## Create and assign a role entry in the database +## Create and assign a role entry in the database -1. On MDT01, using Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration** and then expand **Database**. -2. In the **Database** node, right-click **Role**, select **New**, and create a role entry with the following settings: - 1. Role name: Standard PC - 2. Applications / Lite Touch Applications: - 3. Install - Adobe Reader XI - x86 +1. On MDT01, using Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration** and then expand **Database**. + +2. In the **Database** node, right-click **Role**, select **New**, and create a role entry with the following settings: + + 1. Role name: Standard PC + 2. Applications / Lite Touch Applications: + 3. Install - Adobe Reader XI - x86 ![figure 12.](../images/mdt-09-fig12.png) Figure 12. The Standard PC role with the application added -## Associate the role with a computer in the database +## Associate the role with a computer in the database After creating the role, you can associate it with one or more computer entries. -1. Using Deployment Workbench, expand **MDT Production**, expand **Advanced Configuration**, expand **Database**, and select **Computers**. -2. In the **Computers** node, double-click the **PC00075** entry, and add the following setting: - - Roles: Standard PC + +1. Using Deployment Workbench, expand **MDT Production**, expand **Advanced Configuration**, expand **Database**, and select **Computers**. + +2. In the **Computers** node, double-click the **PC00075** entry, and add the following setting: + - Roles: Standard PC ![figure 13.](../images/mdt-09-fig13.png) Figure 13. The Standard PC role added to PC00075 (having ID 1 in the database). -## Verify database access in the MDT simulation environment +## Verify database access in the MDT simulation environment When the database is populated, you can use the MDT simulation environment to simulate a deployment. The applications aren't installed, but you can see which applications would be installed if you did a full deployment of the computer. -1. On PC0001, log on as **CONTOSO\\MDT\_BA**. -2. Modify the C:\\MDT\\CustomSettings.ini file to look like below: - ``` +1. On PC0001, log on as **CONTOSO\\MDT\_BA**. + +2. Modify the C:\\MDT\\CustomSettings.ini file to look like below: + + ```ini [Settings] Priority=CSettings, CRoles, RApplications, Default [Default] @@ -108,9 +114,9 @@ When the database is populated, you can use the MDT simulation environment to si Order=Sequence ``` -3. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press **Enter** after each command: +3. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press **Enter** after each command: - ``` powershell + ```powershell Set-Location C:\MDT .\Gather.ps1 @@ -122,10 +128,10 @@ Figure 14. ZTIGather.log displaying the application GUID belonging to the Adobe ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) -
    [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) -
    [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) -
    [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) -
    [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) -
    [Use web services in MDT](use-web-services-in-mdt.md) -
    [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) \ No newline at end of file +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md index 1e3e971ecc..043e8f7ab8 100644 --- a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md +++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment.md @@ -10,17 +10,18 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Build a distributed environment for Windows 10 deployment -**Applies to** -- Windows 10 +**Applies to:** + +- Windows 10 Perform the steps in this article to build a distributed environment for Windows 10 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments. -Four computers are used in this article: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 and MDT02 are domain member computers running Windows Server 2019, and PC0006 is a blank device where we'll deploy Windows 10. The second deployment server (MDT02) will be configured for a remote site (Stockholm) by replicating the deployment share on MDT01 at the original site (New York). All devices are members of the domain contoso.com for the fictitious Contoso Corporation. +Four computers are used in this article: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 and MDT02 are domain member computers running Windows Server 2019, and PC0006 is a blank device where we'll deploy Windows 10. The second deployment server (MDT02) will be configured for a remote site (Stockholm) by replicating the deployment share on MDT01 at the original site (New York). All devices are members of the domain contoso.com for the fictitious Contoso Corporation. For the purposes of this article, we assume that MDT02 is prepared with the same network and storage capabilities that were specified for MDT01, except that MDT02 is located on a different subnet than MDT01. For more information on the infrastructure setup for this article, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). @@ -28,7 +29,8 @@ For the purposes of this article, we assume that MDT02 is prepared with the same Computers used in this article. ->HV01 is also used in this topic to host the PC0006 virtual machine. +> [!NOTE] +> HV01 is also used in this topic to host the PC0006 virtual machine. ## Replicate deployment shares @@ -36,7 +38,7 @@ Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be do > [!NOTE] > Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target. - + ### Linked deployment shares in MDT LDS is a built-in feature in MDT for replicating content. However, LDS works best with strong connections such as LAN connections with low latency. For most WAN links, DFS-R is the better option. @@ -55,9 +57,9 @@ On **MDT01**: 1. Install the DFS Replication role on MDT01 by entering the following at an elevated Windows PowerShell prompt: -```powershell -Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools -``` + ```powershell + Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools + ``` 2. Wait for installation to complete, and then verify that the installation was successful. See the following output: @@ -75,9 +77,9 @@ On **MDT02**: 1. Perform the same procedure on MDT02 by entering the following at an elevated Windows PowerShell prompt: -```powershell -Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools -``` + ```powershell + Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools + ``` 2. Wait for installation to complete, and then verify that the installation was successful. See the following output: @@ -95,10 +97,10 @@ On **MDT02**: 1. Create and share the **D:\\MDTProduction** folder using default permissions by entering the following at an elevated command prompt: - ```powershell - mkdir d:\MDTProduction - New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction" - ``` + ```powershell + mkdir d:\MDTProduction + New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction" + ``` 2. You should see the following output: @@ -112,11 +114,11 @@ On **MDT02**: ### Configure the deployment share -When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT that can be done by using the DefaultGateway property. +When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT that can be done by using the **DefaultGateway** property. On **MDT01**: -1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the client's default gateway in New York and Stockholm, respectively (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (that is, server) to use. +1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the `Boostrap.ini` file as follows. Under `[DefaultGateway]` enter the IP addresses for the client's default gateway in New York and Stockholm, respectively (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (that is, server) to use. ```ini [Settings] @@ -138,130 +140,167 @@ On **MDT01**: UserPassword=pass@word1 SkipBDDWelcome=YES ``` - >[!NOTE] - >The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). - -2. Save the Bootstrap.ini file. + + > [!NOTE] + > The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). + +2. Save the `Bootstrap.ini` file. + 3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. Use the default settings for the Update Deployment Share Wizard. This process will take a few minutes. + 4. After the update is complete, use the Windows Deployment Services console on MDT01. In the **Boot Images** node, right-click the **MDT Production x64** boot image and select **Replace Image**. + 5. Browse and select the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings. ![figure 5.](../images/mdt-10-fig05.png) Replacing the updated boot image in WDS. - >[!TIP] - >If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console. + > [!TIP] + > If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console. - ## Replicate the content +## Replicate the content - Once the MDT01 and MDT02 servers are prepared, you're ready to configure the actual replication. +Once the MDT01 and MDT02 servers are prepared, you're ready to configure the actual replication. - ### Create the replication group +### Create the replication group -6. On MDT01, using DFS Management (dfsmgmt.msc), right-click **Replication**, and select **New Replication Group**. -7. On the **Replication Group Type** page, select **Multipurpose replication group**, and select **Next**. -8. On the **Name and Domain** page, assign the **MDTProduction** name, and select **Next**. -9. On the **Replication Group Members** page, select **Add**, add **MDT01** and **MDT02**, and then select **Next**. +1. On MDT01, using DFS Management (dfsmgmt.msc), right-click **Replication**, and select **New Replication Group**. + +2. On the **Replication Group Type** page, select **Multipurpose replication group**, and select **Next**. + +3. On the **Name and Domain** page, assign the **MDTProduction** name, and select **Next**. + +4. On the **Replication Group Members** page, select **Add**, add **MDT01** and **MDT02**, and then select **Next**. ![figure 6.](../images/mdt-10-fig06.png) Adding the Replication Group Members. -10. On the **Topology Selection** page, select the **Full mesh** option and select **Next**. -11. On the **Replication Group Schedule and Bandwidth** page, accept the default settings and select **Next**. -12. On the **Primary Member** page, select **MDT01** and select **Next**. -13. On the **Folders to Replicate** page, select **Add**, enter **D:\\MDTProduction** as the folder to replicate, select **OK**, and then select **Next**. -14. On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and select **Edit**. -15. On the **Edit** page, select the **Enabled** option, type in **D:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, select **OK**, and then select **Next**. -16. On the **Review Settings and Create Replication Group** page, select **Create**. -17. On the **Confirmation** page, select **Close**. +5. On the **Topology Selection** page, select the **Full mesh** option and select **Next**. - ### Configure replicated folders +6. On the **Replication Group Schedule and Bandwidth** page, accept the default settings and select **Next**. + +7. On the **Primary Member** page, select **MDT01** and select **Next**. + +8. On the **Folders to Replicate** page, select **Add**, enter **D:\\MDTProduction** as the folder to replicate, select **OK**, and then select **Next**. + +9. On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and select **Edit**. + +10. On the **Edit** page, select the **Enabled** option, type in **D:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, select **OK**, and then select **Next**. + +11. On the **Review Settings and Create Replication Group** page, select **Create**. + +12. On the **Confirmation** page, select **Close**. + +### Configure replicated folders + +1. On **MDT01**, using DFS Management, expand **Replication** and then select **MDTProduction**. + +2. In the middle pane, right-click the **MDT01** member and select **Properties**. + +3. On the **MDT01 (MDTProduction) Properties** page, configure the following and then select **OK**: + + 1. In the **Staging** tab, set the quota to **20480 MB**. + + 2. In the **Advanced** tab, set the quota to **8192 MB**. -18. On **MDT01**, using DFS Management, expand **Replication** and then select **MDTProduction**. -19. In the middle pane, right-click the **MDT01** member and select **Properties**. -20. On the **MDT01 (MDTProduction) Properties** page, configure the following and then select **OK**: - 1. In the **Staging** tab, set the quota to **20480 MB**. - 2. In the **Advanced** tab, set the quota to **8192 MB**. In this scenario the size of the deployment share is known, but you might need to change the values for your environment. A good rule of thumb is to get the size of the 16 largest files and make sure they fit in the staging area. Below is a Windows PowerShell example that calculates the size of the 16 largest files in the D:\\MDTProduction deployment share: - - ``` powershell + + ```powershell (Get-ChildItem D:\MDTProduction -Recurse | Sort-Object Length -Descending | Select-Object -First 16 | Measure-Object -Property Length -Sum).Sum /1GB ``` -21. In the middle pane, right-click the **MDT02** member and select **Properties**. -22. On the **MDT02 (MDTProduction) Properties** page, configure the following and then select **OK**: - 1. In the **Staging** tab, set the quota to **20480 MB**. - 2. In the **Advanced** tab, set the quota to **8192 MB**. +4. In the middle pane, right-click the **MDT02** member and select **Properties**. + +5. On the **MDT02 (MDTProduction) Properties** page, configure the following and then select **OK**: + 1. In the **Staging** tab, set the quota to **20480 MB**. + + 2. In the **Advanced** tab, set the quota to **8192 MB**. > [!NOTE] > It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly. -23. Verify that MDT01 and MDT02 are members of the MDTProduction replication group, with MDT01 being primary as follows using an elevated command prompt: +6. Verify that MDT01 and MDT02 are members of the MDTProduction replication group, with MDT01 being primary as follows using an elevated command prompt: -```cmd -C:\> dfsradmin membership list /rgname:MDTProduction /attr:MemName,IsPrimary -MemName IsPrimary -MDT01 Yes -MDT02 No -``` + ```cmd + C:\> dfsradmin membership list /rgname:MDTProduction /attr:MemName,IsPrimary + MemName IsPrimary + MDT01 Yes + MDT02 No + ``` ### Verify replication On **MDT02**: 1. Wait until you start to see content appear in the **D:\\MDTProduction** folder. + 2. Using DFS Management, expand **Replication**, right-click **MDTProduction**, and select **Create Diagnostics Report**. + 3. In the Diagnostics Report Wizard, on the **Type of Diagnostics Report or Test** page, choose **Health report** and select **Next**. + 4. On the **Path and Name** page, accept the default settings and select **Next**. + 5. On the **Members to Include** page, accept the default settings and select **Next**. + 6. On the **Options** page, accept the default settings and select **Next**. + 7. On the **Review Settings and Create Report** page, select **Create**. + 8. Open the report in Internet Explorer, and if necessary, select the **Allow blocked content** option. -![figure 9.](../images/mdt-10-fig09.png) + ![figure 9.](../images/mdt-10-fig09.png) + The DFS Replication Health Report. -The DFS Replication Health Report. - ->If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**. + > [!NOTE] + > If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**. ## Configure Windows Deployment Services (WDS) in a remote site Like you did in the previous article for MDT01, you need to add the MDT Production Lite Touch x64 Boot image to Windows Deployment Services on MDT02. For the following steps, we assume that WDS has already been installed on MDT02. + 1. On MDT02, using the WDS console, right-click **Boot Images** and select **Add Boot Image**. + 2. Browse to the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** file and add the image with the default settings. ## Deploy a Windows 10 client to the remote site -Now you should have a solution ready for deploying the Windows 10 client to the remote site: Stockholm, using the MDTProduction deployment share replica on MDT02. You can test this deployment with the following optional procedure. +Now you should have a solution ready for deploying the Windows 10 client to the remote site: Stockholm, using the MDTProduction deployment share replica on MDT02. You can test this deployment with the following optional procedure. ->For demonstration purposes, the following procedure uses a virtual machine (PC0006) hosted by the Hyper-V server HV01. To use the remote site server (MDT02) the VM must be assigned a default gateway that matches the one you entered in the Boostrap.ini file. +> [!NOTE] +> For demonstration purposes, the following procedure uses a virtual machine (PC0006) hosted by the Hyper-V server HV01. To use the remote site server (MDT02) the VM must be assigned a default gateway that matches the one you entered in the `Boostrap.ini` file. -1. Create a virtual machine with the following settings: - 1. Name: PC0006 - 2. Location: C:\\VMs - 3. Generation: 2 - 4. Memory: 2048 MB - 5. Hard disk: 60 GB (dynamic disk) +1. Create a virtual machine with the following settings: + + 1. **Name**: PC0006 + 2. **Location**: C:\\VMs + 3. **Generation**: 2 + 4. **Memory**: 2048 MB + 5. **Hard disk**: 60 GB (dynamic disk) 6. Install an operating system from a network-based installation server -2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from the WDS server. -3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: - 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image - 2. Computer Name: PC0006 - 3. Applications: Select the Install - Adobe Reader -4. Setup will now start and perform the following steps: - 1. Install the Windows 10 Enterprise operating system. - 2. Install applications. - 3. Update the operating system using your local Windows Server Update Services (WSUS) server. + +2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from the WDS server. + +3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: + + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + 2. Computer Name: PC0006 + 3. Applications: Select the Install - Adobe Reader + +4. Setup will now start and perform the following steps: + + 1. Install the Windows 10 Enterprise operating system. + 2. Install applications. + 3. Update the operating system using your local Windows Server Update Services (WSUS) server. ![pc0001.](../images/pc0006.png) ## Related articles -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    -[Configure MDT settings](configure-mdt-settings.md) \ No newline at end of file +- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) +- [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) +- [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +- [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md index 6c254caad5..eb84fdcd77 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules.md @@ -9,23 +9,24 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Configure MDT deployment share rules In this article, you'll learn how to configure the MDT rules engine to reach out to other resources, including external scripts, databases, and web services, for additional information instead of storing settings directly in the rules engine. The rules engine in MDT is powerful: most of the settings used for operating system deployments are retrieved and assigned via the rules engine. In its simplest form, the rules engine is the CustomSettings.ini text file. -## Assign settings +## Assign settings When using MDT, you can assign setting in three distinct ways: -- You can pre-stage the information before deployment. -- You can prompt the user or technician for information. -- You can have MDT generate the settings automatically. + +- You can pre-stage the information before deployment. +- You can prompt the user or technician for information. +- You can have MDT generate the settings automatically. In order to illustrate these three options, let's look at some sample configurations. -## Sample configurations +## Sample configurations Before adding the more advanced components like scripts, databases, and web services, consider the commonly used configurations below; they demonstrate the power of the rules engine. @@ -33,7 +34,7 @@ Before adding the more advanced components like scripts, databases, and web serv If you have a small test environment, or simply want to assign settings to a limited number of machines, you can edit the rules to assign settings directly for a given MAC Address. When you have many machines, it makes sense to use the database instead. -``` +```ini [Settings] Priority=MacAddress, Default [Default] @@ -48,7 +49,7 @@ In the preceding sample, you set the PC00075 computer name for a machine with a Another way to assign a computer name is to identify the machine via its serial number. -``` +```ini [Settings] Priority=SerialNumber, Default [Default] @@ -63,7 +64,7 @@ In this sample, you set the PC00075 computer name for a machine with a serial nu You also can configure the rules engine to use a known property, like a serial number, to generate a computer name on the fly. -``` +```ini [Settings] Priority=Default [Default] @@ -72,15 +73,15 @@ OSDComputerName=PC-%SerialNumber% ``` In this sample, you configure the rules to set the computer name to a prefix (PC-) and then the serial number. If the serial number of the machine is CND0370RJ7, the preceding configuration sets the computer name to PC-CND0370RJ7. -**Note** -Be careful when using the serial number to assign computer names. A serial number can contain more than 15 characters, but the Windows setup limits a computer name to 15 characters. - +> [!NOTE] +> Be careful when using the serial number to assign computer names. A serial number can contain more than 15 characters, but the Windows setup limits a computer name to 15 characters. + ### Generate a limited computer name based on a serial number To avoid assigning a computer name longer than 15 characters, you can configure the rules in more detail by adding VBScript functions, as follows: -``` +```ini [Settings] Priority=Default [Default] @@ -94,7 +95,7 @@ In the preceding sample, you still configure the rules to set the computer name In the rules, you find built-in properties that use a Windows Management Instrumentation (WMI) query to determine whether the machine you're deploying is a laptop, desktop, or server. In this sample, we assume you want to add laptops to different OUs in Active Directory. Note that ByLaptopType isn't a reserved word; rather, it's the name of the section to read. -``` +```ini [Settings] Priority=ByLaptopType, Default [Default] @@ -107,16 +108,10 @@ MachineObjectOU=OU=Laptops,OU=Contoso,DC=contoso,DC=com ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) - -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md index 0ef50cfcd2..19adc65b02 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts.md @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Configure MDT for UserExit scripts @@ -20,7 +20,7 @@ In this article, you'll learn how to configure the MDT rules engine to use a Use You can call a UserExit by referencing the script in your rules. Then you can configure a property to be set to the result of a function of the VBScript. In this example, we have a VBScript named Setname.vbs (provided in the book sample files, in the UserExit folder). -``` +```ini [Settings] Priority=Default [Default] @@ -35,7 +35,7 @@ The UserExit=Setname.vbs calls the script and then assigns the computer name to The Setname.vbs script takes the MAC Address passed from the rules. The script then does some string manipulation to add a prefix (PC) and remove the semicolons from the MAC Address. -``` +```vb Function UserExit(sType, sWhen, sDetail, bSkip) UserExit = Success End Function @@ -48,23 +48,18 @@ Function SetName(sMac) SetName = "PC" & re.Replace(sMac, "") End Function ``` + The first three lines of the script make up a header that all UserExit scripts have. The interesting part is the lines between Function and End Function. Those lines add a prefix (PC), remove the colons from the MAC Address, and return the value to the rules by setting the SetName value. ->[!NOTE] ->The purpose of this sample isn't to recommend that you use the MAC Address as a base for computer naming, but to show you how to take a variable from MDT, pass it to an external script, make some changes to it, and then return the new value to the deployment process. - +> [!NOTE] +> The purpose of this sample isn't to recommend that you use the MAC Address as a base for computer naming, but to show you how to take a variable from MDT, pass it to an external script, make some changes to it, and then return the new value to the deployment process. + ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) - -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md index 6270caa911..cfb17a3eee 100644 --- a/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md +++ b/windows/deployment/deploy-windows-mdt/configure-mdt-settings.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Configure MDT settings @@ -24,20 +24,20 @@ The computers used in this article. ## In this section -- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) -- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) -- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) -- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) -- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) -- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) -- [Use web services in MDT](use-web-services-in-mdt.md) -- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) ## Related articles -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) +- [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) +- [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) +- [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md index 864d74b4d8..b26c222f91 100644 --- a/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image.md @@ -9,31 +9,33 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Create a Windows 10 reference image -**Applies to** +**Applies to:** + - Windows 10 Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this article, you 'll learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT). You 'll create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this article, you 'll have a Windows 10 reference image that can be used in your deployment solution. ->[!NOTE] ->For more information about the server, client, and network infrastructure used in this guide, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). +> [!NOTE] +> For more information about the server, client, and network infrastructure used in this guide, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). For the purposes of this article, we'll use three computers: DC01, MDT01, and HV01. - - DC01 is a domain controller for the contoso.com domain. - - MDT01 is a contoso.com domain member server. - - HV01 is a Hyper-V server that will be used to build the reference image. - - ![devices.](../images/mdt-08-fig01.png) +- DC01 is a domain controller for the contoso.com domain. +- MDT01 is a contoso.com domain member server. +- HV01 is a Hyper-V server that will be used to build the reference image. + + ![devices.](../images/mdt-08-fig01.png) Computers used in this article. ## The reference image The reference image described in this guide is designed primarily for deployment to physical devices. However, the reference image is typically created on a virtual platform, before being automatically run through the System Preparation (Sysprep) tool process and captured to a Windows Imaging (WIM) file. The reasons for creating the reference image on a virtual platform are: + - To reduce development time and can use snapshots to test different configurations quickly. - To rule out hardware issues. You get the best possible image, and if you've a problem, it's not likely to be hardware related. - To ensure that you won't have unwanted applications that could be installed as part of a driver install but not removed by the Sysprep process. @@ -47,24 +49,30 @@ With Windows 10, there's no hard requirement to create reference images. However On **MDT01**: -- Sign in as contoso\\administrator using a password of pass@word1 (credentials from the [prepare for deployment](prepare-for-windows-deployment-with-mdt.md) article). -- Start the MDT deployment workbench, and pin this workbench to the taskbar for easy access. -- Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. -- Use the following settings for the New Deployment Share Wizard: - - Deployment share path: **D:\\MDTBuildLab** - - Share name: **MDTBuildLab$** - - Deployment share description: **MDT Build Lab** -- Accept the default selections on the Options page and select **Next**. -- Review the Summary page, select **Next**, wait for the deployment share to be created, then select **Finish**. -- Verify that you can access the \\\\MDT01\\MDTBuildLab$ share. +1. Sign in as **contoso\\administrator** using a password of **pass@word1** (credentials from the [prepare for deployment](prepare-for-windows-deployment-with-mdt.md) article). + +2. Start the MDT deployment workbench, and pin this workbench to the taskbar for easy access. + +3. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. + +4. Use the following settings for the New Deployment Share Wizard: + + - Deployment share path: **D:\\MDTBuildLab** + - Share name: **MDTBuildLab$** + - Deployment share description: **MDT Build Lab** + +5. Accept the default selections on the Options page and select **Next**. + +6. Review the Summary page, select **Next**, wait for the deployment share to be created, then select **Finish**. + +7. Verify that you can access the **\\\\MDT01\\MDTBuildLab$** share. ![figure 2.](../images/mdt-08-fig02.png) - The Deployment Workbench with the MDT Build Lab deployment share. ### Enable monitoring -To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share, select **Properties**, select the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional. +To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share, select **Properties**, select the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional. ### Configure permissions for the deployment share @@ -72,10 +80,11 @@ In order to read files in the deployment share and write the reference image bac On **MDT01**: -1. Ensure you're signed in as **contoso\\administrator**. -2. Modify the NTFS permissions for the **D:\\MDTBuildLab** folder by running the following command in an elevated Windows PowerShell prompt: +1. Ensure you're signed in as **contoso\\administrator**. - ``` powershell +2. Modify the NTFS permissions for the **D:\\MDTBuildLab** folder by running the following command in an elevated Windows PowerShell prompt: + + ```powershell icacls "D:\MDTBuildLab" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' grant-smbshareaccess -Name MDTBuildLab$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force ``` @@ -88,9 +97,9 @@ This section will show you how to populate the MDT deployment share with the Win MDT supports adding both full source Windows 10 DVDs (ISOs) and custom images that you've created. In this case, you create a reference image, so you add the full source setup files from Microsoft. ->[!NOTE] ->Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM. - +> [!NOTE] +> Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM. + ### Add Windows 10 Enterprise x64 (full source) On **MDT01**: @@ -100,16 +109,21 @@ On **MDT01**: ![ISO.](../images/iso-data.png) 2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**. + 3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. + 4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files - Source directory: (location of your source files) - - Destination directory name: W10EX64RTM -5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. See the following example. + - Destination directory name: **W10EX64RTM** + +5. After adding the operating system, in the **Operating Systems** > **Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. See the following example. ![Default image.](../images/deployment-workbench01.png) ->Depending on the DVD you used, there might be multiple editions available. For the purposes of this guide, we are using the Windows 10 Enterprise image, but other images will also work. +> [!NOTE] +> Depending on the DVD you used, there might be multiple editions available. For the purposes of this guide, we are using the Windows 10 Enterprise image, but other images will also work. ## Add applications @@ -120,18 +134,22 @@ On **MDT01**: First, create an MDT folder to store the Microsoft applications that will be installed: 1. In the MDT Deployment Workbench, expand **Deployment Shares \\ MDT Build Lab \\ Applications** + 2. Right-click **Applications** and then select **New Folder**. + 3. Under **Folder name**, type **Microsoft**. + 4. Select **Next** twice, and then select **Finish**. -The steps in this section use a strict naming standard for your MDT applications. -- Use the "Install - " prefix for typical application installations that run a setup installer of some kind, -- Use the "Configure - " prefix when an application configures a setting in the operating system. -- You also add an " - x86", " - x64", or "- x86-x64" suffix to indicate the application's architecture (some applications have installers for both architectures). - -Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency. +The steps in this section use a strict naming standard for your MDT applications. -By storing configuration items as MDT applications, it's easy to move these objects between various solutions, or between test and production environments. +- Use the **Install -** prefix for typical application installations that run a setup installer of some kind. +- Use the **Configure -** prefix when an application configures a setting in the operating system. +- You also add an **- x86**, **- x64**, or **- x86-x64** suffix to indicate the application's architecture (some applications have installers for both architectures). + +Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency. + +By storing configuration items as MDT applications, it's easy to move these objects between various solutions, or between test and production environments. In example sections, you 'll add the following applications: @@ -142,28 +160,30 @@ In example sections, you 'll add the following applications: >The 64-bit version of Microsoft Office 365 Pro Plus is recommended unless you need legacy app support. For more information, see [Choose between the 64-bit or 32-bit version of Office](https://support.office.com/article/choose-between-the-64-bit-or-32-bit-version-of-office-2dee7807-8f95-4d0c-b5fe-6c6f49b8d261) Download links: + - [Office Deployment Tool](https://www.microsoft.com/download/details.aspx?id=49117) - [Microsoft Visual C++ Redistributable 2019 - x86](https://aka.ms/vs/16/release/VC_redist.x86.exe) - [Microsoft Visual C++ Redistributable 2019 - x64](https://aka.ms/vs/16/release/VC_redist.x64.exe) -Download all three items in this list to the D:\\Downloads folder on MDT01. +Download all three items in this list to the D:\\Downloads folder on MDT01. ->[!NOTE] ->For the purposes of this lab, we'll leave the MSVC files in the D:\\Downloads folder and the Office365 files will be extracted to a child folder. If you prefer, you can place each application in its own separate child folder, and then modify the $ApplicationSourcePath below as needed (instead of just D:\\Downloads). +> [!NOTE] +> For the purposes of this lab, we'll leave the MSVC files in the D:\\Downloads folder and the Office365 files will be extracted to a child folder. If you prefer, you can place each application in its own separate child folder, and then modify the $ApplicationSourcePath below as needed (instead of just D:\\Downloads). + +> [!NOTE] +> All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](https://go.microsoft.com/fwlink/p/?LinkId=619523). Visual C++ 2015, 2017 and 2019 all share the same redistributable files. ->[!NOTE] ->All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](https://go.microsoft.com/fwlink/p/?LinkId=619523). Visual C++ 2015, 2017 and 2019 all share the same redistributable files. - ### Create configuration file: Microsoft Office 365 Professional Plus x64 -1. After downloading the most current version of the Office Deployment tool from the Microsoft Download Center using the link provided above, run the self-extracting executable file and extract the files to **D:\\Downloads\\Office365**. The Office Deployment Tool (setup.exe) and several sample configuration.xml files will be extracted. +1. After downloading the most current version of the Office Deployment tool from the Microsoft Download Center using the link provided above, run the self-extracting executable file and extract the files to **D:\\Downloads\\Office365**. The Office Deployment Tool (setup.exe) and several sample configuration.xml files will be extracted. + 2. Using a text editor (such as Notepad), create an XML file in the D:\\Downloads\\Office365 directory with the installation settings for Microsoft 365 Apps for enterprise that are appropriate for your organization. The file uses an XML format, so the file you create must have an extension of .xml but the file can have any filename. For example, you can use the following configuration.xml file, which provides these configuration settings: - - Install the 64-bit version of Microsoft 365 Apps for enterprise in English directly from the Office Content Delivery Network (CDN) on the internet. + - Install the 64-bit version of Microsoft 365 Apps for enterprise in English directly from the Office Content Delivery Network (CDN) on the internet. > [!NOTE] - > 64-bit is now the default and recommended edition. - - Use the General Availability Channel and get updates directly from the Office CDN on the internet. + > 64-bit is now the default and recommended edition. + - Use the General Availability Channel and get updates directly from the Office CDN on the internet. - Perform a silent installation. You won't see anything that shows the progress of the installation and you won't see any error messages. ```xml @@ -180,25 +200,28 @@ Download all three items in this list to the D:\\Downloads folder on MDT01. When you use these settings, anytime you build the reference image you'll be installing the most up-to-date General Availability Channel version of Microsoft 365 Apps for enterprise. - >[!TIP] - >You can also use the web-based interface of the [Office Customization Tool](https://config.office.com/) to help you create your configuration.xml file. - - For more information, see [Configuration options for the Office Deployment Tool](/deployoffice/configuration-options-for-the-office-2016-deployment-tool) and [Overview of the Office Deployment Tool](/DeployOffice/overview-of-the-office-2016-deployment-tool). + > [!TIP] + > You can also use the web-based interface of the [Office Customization Tool](https://config.office.com/) to help you create your configuration.xml file. + + For more information, see [Configuration options for the Office Deployment Tool](/deployoffice/configuration-options-for-the-office-2016-deployment-tool) and [Overview of the Office Deployment Tool](/DeployOffice/overview-of-the-office-2016-deployment-tool). 3. Ensure the configuration.xml file is in the D:\\Downloads\\Office365 folder. See the following example of the extracted files plus the configuration.xml file in the Downloads\\Office365 folder: ![folder.](../images/office-folder.png) - Assuming you've named the file "configuration.xml" as shown above, we'll use the command "**setup.exe /configure configuration.xml**" when we create the application in MDT. This command execution will perform the installation of Microsoft 365 Apps for enterprise using the configuration settings in the configuration.xml file. Don't perform this step yet. +Assuming you've named the file `configuration.xml` as shown above, we'll use the command **`setup.exe /configure configuration.xml`** when we create the application in MDT. This command execution will perform the installation of Microsoft 365 Apps for enterprise using the configuration settings in the configuration.xml file. Don't perform this step yet. - >[!IMPORTANT] - >After Microsoft 365 Apps for enterprise is installed on the reference image, do NOT open any Office programs. if you open an Office program, you're prompted to sign-in, which activates the installation of Microsoft 365 Apps for enterprise. Even if you don't sign in and you close the Sign in to set up Office dialog box, a temporary product key is installed. You don't want any kind of product key for Microsoft 365 Apps for enterprise installed as part of your reference image. +> [!IMPORTANT] +> After Microsoft 365 Apps for enterprise is installed on the reference image, do NOT open any Office programs. if you open an Office program, you're prompted to sign-in, which activates the installation of Microsoft 365 Apps for enterprise. Even if you don't sign in and you close the Sign in to set up Office dialog box, a temporary product key is installed. You don't want any kind of product key for Microsoft 365 Apps for enterprise installed as part of your reference image. Additional information + - Microsoft 365 Apps for enterprise is updated on a monthly basis with security updates and other quality updates (bug fixes), and possibly new features (depending on which update channel you're using). That means that once you've deployed your reference image, Microsoft 365 Apps for enterprise will most likely need to download and install the latest updates that have been released since you created your reference image. -- **Note**: With the installing Office Deployment Tool being used as part of the reference image, Microsoft 365 Apps for enterprise is installed immediately after the reference image is deployed to the user's device, rather than including Office apps part of the reference image. This way the user will have the most up-to-date version of Microsoft 365 Apps for enterprise right away and won't have to download any new updates (which is most likely what would happen if Microsoft 365 Apps for enterprise was installed as part of the reference image.) - - When you're creating your reference image, instead of installing Microsoft 365 Apps for enterprise directly from the Office CDN on the internet, you can install Microsoft 365 Apps for enterprise from a location on your local network, such as a file share. To do that, you would use the Office Deployment Tool in /download mode to download the installation files to that file share. Then you could use the Office Deployment Tool in /configure mode to install Microsoft 365 Apps for enterprise from that location on to your reference image. As part of that process, you'll need to point to that location in your configuration.xml file so that the Office Deployment Tool knows where to get the Microsoft 365 Apps for enterprise files. If you decide to do this step, the next time you create a new reference image, you'll want to be sure to use the Office Deployment Tool to download the most up-to-date installation files for Microsoft 365 Apps for enterprise to that location on your internal network. That way your new reference image will have a more up-to-date installation of Microsoft 365 Apps for enterprise. + > [!NOTE] + > With the installing Office Deployment Tool being used as part of the reference image, Microsoft 365 Apps for enterprise is installed immediately after the reference image is deployed to the user's device, rather than including Office apps part of the reference image. This way the user will have the most up-to-date version of Microsoft 365 Apps for enterprise right away and won't have to download any new updates (which is most likely what would happen if Microsoft 365 Apps for enterprise was installed as part of the reference image.) + +- When you're creating your reference image, instead of installing Microsoft 365 Apps for enterprise directly from the Office CDN on the internet, you can install Microsoft 365 Apps for enterprise from a location on your local network, such as a file share. To do that, you would use the Office Deployment Tool in /download mode to download the installation files to that file share. Then you could use the Office Deployment Tool in /configure mode to install Microsoft 365 Apps for enterprise from that location on to your reference image. As part of that process, you'll need to point to that location in your configuration.xml file so that the Office Deployment Tool knows where to get the Microsoft 365 Apps for enterprise files. If you decide to do this step, the next time you create a new reference image, you'll want to be sure to use the Office Deployment Tool to download the most up-to-date installation files for Microsoft 365 Apps for enterprise to that location on your internal network. That way your new reference image will have a more up-to-date installation of Microsoft 365 Apps for enterprise. ### Connect to the deployment share using Windows PowerShell @@ -206,15 +229,16 @@ If you need to add many applications, you can take advantage of the PowerShell s On **MDT01**: -1. Ensure you're signed in as **contoso\\Administrator**. -2. Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt: +1. Ensure you're signed in as **contoso\\Administrator**. +2. Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt: - ``` powershell + ```powershell Import-Module "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1" New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "D:\MDTBuildLab" ``` ->[!TIP] ->Use "Get-Command -module MicrosoftDeploymentToolkit" to see a list of available cmdlets + +> [!TIP] +> Use `Get-Command -module MicrosoftDeploymentToolkit` to see a list of available cmdlets ### Create the install: Microsoft Office 365 Pro Plus - x64 @@ -222,10 +246,11 @@ In these steps, we assume that you've downloaded the Office Deployment Tool. You On **MDT01**: -1. Ensure you're signed on as **contoso\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: +1. Ensure you're signed on as **contoso\\Administrator**. - ``` powershell +2. Create the application by running the following commands in an elevated PowerShell prompt: + + ```powershell $ApplicationName = "Install - Office365 ProPlus - x64" $CommandLine = "setup.exe /configure configuration.xml" $ApplicationSourcePath = "D:\Downloads\Office365" @@ -233,7 +258,8 @@ On **MDT01**: ``` Upon successful installation, the following text is displayed: - ``` + + ```output VERBOSE: Performing the operation "import" on target "Application". VERBOSE: Beginning application import VERBOSE: Copying application source files from D:\Downloads\Office365 to D:\MDTBuildLab\Applications\Install - @@ -248,17 +274,18 @@ On **MDT01**: ### Create the install: Microsoft Visual C++ Redistributable 2019 - x86 ->[!NOTE] ->We have abbreviated "Microsoft Visual C++ Redistributable" in the $ApplicationName below as "MSVC" to avoid the path name exceeding the maxiumum allowed length of 248 characters. +> [!NOTE] +> We have abbreviated "Microsoft Visual C++ Redistributable" in the $ApplicationName below as "MSVC" to avoid the path name exceeding the maxiumum allowed length of 248 characters. In these steps, we assume that you've downloaded Microsoft Visual C++ Redistributable 2019 - x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads. On **MDT01**: -1. Ensure you're signed on as **contoso\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: +1. Ensure you're signed on as **contoso\\Administrator**. - ``` powershell +2. Create the application by running the following commands in an elevated PowerShell prompt: + + ```powershell $ApplicationName = "Install - MSVC 2019 - x86" $CommandLine = "vc_redist.x86.exe /Q" $ApplicationSourcePath = "D:\Downloads" @@ -266,7 +293,8 @@ On **MDT01**: ``` Upon successful installation, the following text is displayed: - ``` + + ```output VERBOSE: Performing the operation "import" on target "Application". VERBOSE: Beginning application import VERBOSE: Copying application source files from D:\Downloads to D:\MDTBuildLab\Applications\Install - MSVC 2019 - x86 @@ -284,10 +312,11 @@ In these steps, we assume that you've downloaded Microsoft Visual C++ Redistribu On **MDT01**: -1. Ensure you're signed on as **contoso\\Administrator**. -2. Create the application by running the following commands in an elevated PowerShell prompt: +1. Ensure you're signed on as **contoso\\Administrator**. - ``` powershell +2. Create the application by running the following commands in an elevated PowerShell prompt: + + ```powershell $ApplicationName = "Install - MSVC 2019 - x64" $CommandLine = "vc_redist.x64.exe /Q" $ApplicationSourcePath = "D:\Downloads" @@ -310,17 +339,19 @@ To create a Windows 10 reference image task sequence, the process is as follows: On **MDT01**: 1. When you're using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 10**. + 2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - 1. Task sequence ID: REFW10X64-001 - 2. Task sequence name: Windows 10 Enterprise x64 RTM Default Image - 3. Task sequence comments: Reference Build - 4. Template: Standard Client Task Sequence - 5. Select OS: Windows 10 Enterprise x64 RTM Default Image - 6. Specify Product Key: Don't specify a product key at this time - 7. Full Name: Contoso - 8. Organization: Contoso - 9. Internet Explorer home page: http://www.contoso.com - 10. Admin Password: Don't specify an Administrator Password at this time + + 1. **Task sequence ID**: REFW10X64-001 + 2. **Task sequence name**: Windows 10 Enterprise x64 RTM Default Image + 3. **Task sequence comments**: Reference Build + 4. **Template**: Standard Client Task Sequence + 5. **Select OS**: Windows 10 Enterprise x64 RTM Default Image + 6. **Specify Product Key**: Don't specify a product key at this time + 7. **Full Name**: Contoso + 8. **Organization**: Contoso + 9. **Internet Explorer home page**: `http://www.contoso.com` + 10. **Admin Password**: Don't specify an Administrator Password at this time ### Edit the Windows 10 task sequence @@ -329,81 +360,99 @@ The steps below walk you through the process of editing the Windows 10 reference On **MDT01**: 1. In the **Task Sequences / Windows 10** folder, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence, and select **Properties**. + 2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings: - 1. **State Restore > Windows Update (Pre-Application Installation)** action: Enable this action by clicking the **Options** tab and clearing the **Disable this step** check box. - - 2. **State Restore > Windows Update (Post-Application Installation)** action: Also enable this action. - 3. **State Restore**: After the **Tattoo** action, add a new **Group** action (select **Add** then select **New Group**) with the following setting: - - Name: **Custom Tasks (Pre-Windows Update)** - 4. **State Restore**: After **Windows Update (Post-Application Installation)** action, rename **Custom Tasks** to **Custom Tasks (Post-Windows Update)**. - - **Note**: The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating. - 5. **State Restore > Custom Tasks (Pre-Windows Update)**: Add a new **Install Roles and Features** action with the following settings: - 1. Name: Install - Microsoft NET Framework 3.5.1 - 2. Select the operating system for which roles are to be installed: Windows 10 - 3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0) - - >[!IMPORTANT] - >This is probably the most important step when creating a reference image. Many applications need the .NET Framework, and we strongly recommend having it available in the image. The one thing that makes this different from other components is that .NET Framework 3.5.1 is not included in the WIM file. It's installed from the **Sources\\SxS** folder on the media, and that makes it more difficult to add after the image has been deployed. - + - **State Restore > Windows Update (Pre-Application Installation)** action: Enable this action by clicking the **Options** tab and clearing the **Disable this step** check box. + + - **State Restore > Windows Update (Post-Application Installation)** action: Also enable this action. + + - **State Restore**: After the **Tattoo** action, add a new **Group** action (select **Add** then select **New Group**) with the following setting: + - Name: **Custom Tasks (Pre-Windows Update)** + + - **State Restore**: After **Windows Update (Post-Application Installation)** action, rename **Custom Tasks** to **Custom Tasks (Post-Windows Update)**. + > [!NOTE] + > The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating. + + - **State Restore > Custom Tasks (Pre-Windows Update)**: Add a new **Install Roles and Features** action with the following settings: + + - **Name**: Install - Microsoft NET Framework 3.5.1 + + - **Select the operating system for which roles are to be installed**: Windows 10 + + - **Select the roles and features that should be installed**: .NET Framework 3.5 (includes .NET 2.0 and 3.0) + + > [!IMPORTANT] + > This is probably the most important step when creating a reference image. Many applications need the .NET Framework, and we strongly recommend having it available in the image. The one thing that makes this different from other components is that .NET Framework 3.5.1 is not included in the WIM file. It's installed from the **Sources\\SxS** folder on the media, and that makes it more difficult to add after the image has been deployed. + ![task sequence.](../images/fig8-cust-tasks.png) The task sequence after creating the Custom Tasks (Pre-Windows Update) group and adding the Install - Microsoft NET Framework 3.5.1 action. - 6. **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings: - 1. Name: Microsoft Visual C++ Redistributable 2019 - x86 - 2. Install a Single Application: browse to **Install - MSVC 2019 - x86** - 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well. + - **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings: + + - **Name**: Microsoft Visual C++ Redistributable 2019 - x86 + + - **Install a Single Application**: browse to **Install - MSVC 2019 - x86** + + - Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well. + 3. Select **OK**. - ![apps.](../images/mdt-apps.png) - + ![apps.](../images/mdt-apps.png) ### Optional configuration: Add a suspend action The goal when creating a reference image is to automate everything. But sometimes you've a special configuration or application setup that is too time-consuming to automate. If you need to do some manual configuration, you can add a little-known feature called Lite Touch Installation (LTI) Suspend. If you add the LTISuspend.wsf script as a custom action in the task sequence, it will suspend the task sequence until you select the Resume Task Sequence shortcut icon on the desktop. In addition to using the LTI Suspend feature for manual configuration or installation, you can also use it simply for verifying a reference image before you allow the task sequence to continue and use Sysprep and capture the virtual machine. ![figure 8.](../images/fig8-suspend.png) - A task sequence with optional Suspend action (LTISuspend.wsf) added. ![figure 9.](../images/fig9-resumetaskseq.png) - The Windows 10 desktop with the Resume Task Sequence shortcut. ### Edit the Unattend.xml file for Windows 10 Enterprise When using MDT, you don't need to edit the Unattend.xml file often because most configurations are taken care of by MDT. However if, for example, you want to configure Internet Explorer behavior, then you can edit the Unattend.xml. Editing the Unattend.xml for basic Internet Explorer settings is easy, but for more advanced settings, you 'll want to use the Internet Explorer Administration Kit (IEAK). ->[!WARNING] ->Don't use **SkipMachineOOBE** or **SkipUserOOBE** in your Unattend.xml file. These settings are deprecated and can have unintended effects if used. +> [!WARNING] +> Don't use **SkipMachineOOBE** or **SkipUserOOBE** in your Unattend.xml file. These settings are deprecated and can have unintended effects if used. + +> [!NOTE] +> You also can use the Unattend.xml to enable components in Windows 10, like the Telnet Client or Hyper-V client. Normally we prefer to do this via the **Install Roles and Features** action, or using Deployment Image Servicing and Management (DISM) command-line tools, because then we can add that as an application, being dynamic, having conditions, and so forth. Also, if you're adding packages via Unattend.xml, it's version specific, so Unattend.xml must match the exact version of the operating system you're servicing. ->[!NOTE] ->You also can use the Unattend.xml to enable components in Windows 10, like the Telnet Client or Hyper-V client. Normally we prefer to do this via the **Install Roles and Features** action, or using Deployment Image Servicing and Management (DISM) command-line tools, because then we can add that as an application, being dynamic, having conditions, and so forth. Also, if you're adding packages via Unattend.xml, it's version specific, so Unattend.xml must match the exact version of the operating system you're servicing. - Follow these steps to configure Internet Explorer settings in Unattend.xml for the Windows 10 Enterprise x64 RTM Default Image task sequence: On **MDT01**: 1. When you're using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. + 2. In the **OS Info** tab, select **Edit Unattend.xml**. MDT now generates a catalog file. This file generation process will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. - > [!IMPORTANT] - > The ADK version 1903 has a [known issue](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903: - > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. - > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). - > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). - > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. + > [!IMPORTANT] + > The ADK version 1903 has a [known issue](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error **Could not load file or assembly** in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903: + > + > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. + > + > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). + > + > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). + > + > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. 3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. + 4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values: - - DisableDevTools: true + + - **DisableDevTools**: true + 5. Save the Unattend.xml file, and close Windows SIM. + > [!NOTE] > If errors are reported that certain display values are incorrect, you can ignore this message or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1. + 6. On the Windows 10 Enterprise x64 RTM Default Image Properties, select **OK**. ![figure 10.](../images/fig10-unattend.png) - Windows System Image Manager with the Windows 10 Unattend.xml. ## Configure the MDT deployment share rules @@ -412,16 +461,17 @@ Understanding rules is critical to successfully using MDT. Rules are configured ### MDT deployment share rules overview -In MDT, there are always two rule files: the **CustomSettings.ini** file and the **Bootstrap.ini** file. You can add almost any rule to either. However, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file. For this reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you select OK. +In MDT, there are always two rule files: the **CustomSettings.ini** file and the **Bootstrap.ini** file. You can add almost any rule to either. However, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file. For this reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you select OK. To configure the rules for the MDT Build Lab deployment share: On **MDT01**: -1. Using the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Properties**. -2. Select the **Rules** tab and replace the existing content with the following information (edit the settings as needed to match your deployment). For example, If you don't have a WSUS server in your environment, delete the **WSUSServer** line from the configuration: +1. Using the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Properties**. - ``` +2. Select the **Rules** tab and replace the existing content with the following information (edit the settings as needed to match your deployment). For example, If you don't have a WSUS server in your environment, delete the **WSUSServer** line from the configuration: + + ```ini [Settings] Priority=Default @@ -456,12 +506,11 @@ On **MDT01**: ``` ![figure 11.](../images/mdt-rules.png) - The server-side rules for the MDT Build Lab deployment share. - -3. Select **Edit Bootstrap.ini** and modify using the following information: - ``` +3. Select **Edit Bootstrap.ini** and modify using the following information: + + ```ini [Settings] Priority=Default @@ -474,32 +523,38 @@ On **MDT01**: SkipBDDWelcome=YES ``` - >[!NOTE] - >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it's acceptable to do so in this situation. Obviously if you're not using the same password (pass@word3) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini. - + > [!NOTE] + > For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it's acceptable to do so in this situation. Obviously if you're not using the same password (pass@word3) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini. + 4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x86**. + 5. In the **Lite Touch Boot Image Settings** area, configure the following settings: - 1. Image description: MDT Build Lab x86 - 2. ISO file name: MDT Build Lab x86.iso + + - **Image description**: MDT Build Lab x86 + - **ISO file name**: MDT Build Lab x86.iso + 6. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. + 7. In the **Lite Touch Boot Image Settings** area, configure the following settings: - 1. Image description: MDT Build Lab x64 - 2. ISO file name: MDT Build Lab x64.iso + + - **Image description**: MDT Build Lab x64 + - **ISO file name**: MDT Build Lab x64.iso + 8. Select **OK**. ->[!NOTE] ->In MDT, the x86 boot image can deploy both x86 and x64 operating systems (except on computers based on Unified Extensible Firmware Interface). - +> [!NOTE] +> In MDT, the x86 boot image can deploy both x86 and x64 operating systems (except on computers based on Unified Extensible Firmware Interface). + ### Update the deployment share After the deployment share has been configured, it needs to be updated. This update-process is the one when the Windows PE boot images are created. -1. In the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Update Deployment Share**. -2. Use the default options for the Update Deployment Share Wizard. +1. In the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Update Deployment Share**. +2. Use the default options for the Update Deployment Share Wizard. + +> [!NOTE] +> The update process will take 5 to 10 minutes. ->[!NOTE] ->The update process will take 5 to 10 minutes. - ### The rules explained Now that the MDT Build Lab deployment share (the share used to create the reference images) has been configured, it's time to explain the various settings used in the Bootstrap.ini and CustomSettings.ini files. @@ -508,14 +563,14 @@ The Bootstrap.ini and CustomSettings.ini files work together. The Bootstrap.ini The CustomSettings.ini file is normally stored on the server, in the Deployment share\\Control folder, but also can be stored on the media (when using offline media). ->[!NOTE] ->The settings, or properties, that are used in the rules (CustomSettings.ini and Bootstrap.ini) are listed in the MDT documentation, in the Microsoft Deployment Toolkit Reference / Properties / Property Definition section. - +> [!NOTE] +> The settings, or properties, that are used in the rules (CustomSettings.ini and Bootstrap.ini) are listed in the MDT documentation, in the Microsoft Deployment Toolkit Reference / Properties / Property Definition section. + ### The Bootstrap.ini file The Bootstrap.ini file is available via the deployment share's Properties dialog box, or via the D:\\MDTBuildLab\\Control folder on MDT01. -``` +```ini [Settings] Priority=Default [Default] @@ -527,23 +582,26 @@ SkipBDDWelcome=YES ``` So, what are these settings? -- **Priority.** This setting determines the order in which different sections are read. This Bootstrap.ini has only one section, named \[Default\]. -- **DeployRoot.** This location is of the deployment share. Normally, this value is set by MDT, but you need to update the DeployRoot value if you move to another server or other share. If you don't specify a value, the Windows Deployment Wizard prompts you for a location. -- **UserDomain, UserID, and UserPassword.** These values are used for automatic sign in to the deployment share. Again, if they aren't specified, the wizard prompts you. - >[!WARNING] - >Caution is advised. These values are stored in clear text on the boot image. Use them only for the MDT Build Lab deployment share and not for the MDT Production deployment share that you learn to create in the next topic. - -- **SkipBDDWelcome.** Even if it's nice to be welcomed every time we start a deployment, we prefer to skip the initial welcome page of the Windows Deployment Wizard. +- **Priority**: This setting determines the order in which different sections are read. This Bootstrap.ini has only one section, named \[Default\]. + +- **DeployRoot**: This location is of the deployment share. Normally, this value is set by MDT, but you need to update the DeployRoot value if you move to another server or other share. If you don't specify a value, the Windows Deployment Wizard prompts you for a location. + +- **UserDomain, UserID, and UserPassword**: These values are used for automatic sign in to the deployment share. Again, if they aren't specified, the wizard prompts you. + + > [!WARNING] + > Caution is advised. These values are stored in clear text on the boot image. Use them only for the MDT Build Lab deployment share and not for the MDT Production deployment share that you learn to create in the next topic. + +- **SkipBDDWelcome**: Even if it's nice to be welcomed every time we start a deployment, we prefer to skip the initial welcome page of the Windows Deployment Wizard. + +> [!NOTE] +> All properties beginning with "Skip" control only whether to display that pane in the Windows Deployment Wizard. Most of the panes also require you to actually set one or more values. ->[!NOTE] ->All properties beginning with "Skip" control only whether to display that pane in the Windows Deployment Wizard. Most of the panes also require you to actually set one or more values. - ### The CustomSettings.ini file The CustomSettings.ini file, whose content you see on the Rules tab of the deployment share Properties dialog box, contains most of the properties used in the configuration. -``` +```ini [Settings] Priority=Default [Default] @@ -575,82 +633,114 @@ SkipRoles=YES SkipCapture=NO SkipFinalSummary=YES ``` -- **Priority.** Has the same function as in Bootstrap.ini. Priority determines the order in which different sections are read. This CustomSettings.ini has only one section, named \[Default\]. In general, if you've multiple sections that set the same value, the value from the first section (higher priority) wins. The rare exceptions are listed in the ZTIGather.xml file. -- **\_SMSTSORGNAME.** The organization name displayed in the task sequence progress bar window during deployment. -- **UserDataLocation.** Controls the settings for user state backup. You don't need to use when building and capturing a reference image. -- **DoCapture.** Configures the task sequence to run the System Preparation (Sysprep) tool and capture the image to a file when the operating system is installed. -- **OSInstall.** Must be set to Y or YES (the code just looks for the Y character) for the setup to proceed. -- **AdminPassword.** Sets the local Administrator account password. -- **TimeZoneName.** Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003). - >[!NOTE] - >The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names. - -- **JoinWorkgroup.** Configures Windows to join a workgroup. -- **HideShell.** Hides the Windows Shell during deployment. This hide-operation is especially useful for Windows 10 deployments in which the deployment wizard will otherwise appear behind the tiles. -- **FinishAction.** Instructs MDT what to do when the task sequence is complete. -- **DoNotCreateExtraPartition.** Configures the task sequence not to create the extra partition for BitLocker. There's no need to do this configuration for your reference image. -- **WSUSServer.** Specifies which Windows Server Update Services (WSUS) server (and port, if needed) to use during the deployment. Without this option MDT will use Microsoft Update directly, which will increase deployment time and limit your options of controlling which updates are applied. -- **SLSHARE.** Instructs MDT to copy the log files to a server share if something goes wrong during deployment, or when a deployment is successfully completed. -- **ApplyGPOPack.** Allows you to deploy local group policies created by Microsoft Security Compliance Manager (SCM). -- **SkipAdminPassword.** Skips the pane that asks for the Administrator password. -- **SkipProductKey.** Skips the pane that asks for the product key. -- **SkipComputerName.** Skips the Computer Name pane. -- **SkipDomainMemberShip.** Skips the Domain Membership pane. If set to Yes, you need to configure either the JoinWorkgroup value or the JoinDomain, DomainAdmin, DomainAdminDomain, and DomainAdminPassword properties. -- **SkipUserData.** Skips the pane for user state migration. -- **SkipLocaleSelection.** Skips the pane for selecting language and keyboard settings. -- **SkipTimeZone.** Skips the pane for setting the time zone. -- **SkipApplications.** Skips the Applications pane. -- **SkipBitLocker.** Skips the BitLocker pane. -- **SkipSummary.** Skips the initial Windows Deployment Wizard summary pane. -- **SkipRoles.** Skips the Install Roles and Features pane. -- **SkipCapture.** Skips the Capture pane. -- **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to select OK before the machine shuts down. +- **Priority**: Has the same function as in Bootstrap.ini. Priority determines the order in which different sections are read. This CustomSettings.ini has only one section, named \[Default\]. In general, if you've multiple sections that set the same value, the value from the first section (higher priority) wins. The rare exceptions are listed in the ZTIGather.xml file. + +- **\_SMSTSORGNAME**: The organization name displayed in the task sequence progress bar window during deployment. + +- **UserDataLocation**: Controls the settings for user state backup. You don't need to use when building and capturing a reference image. + +- **DoCapture**: Configures the task sequence to run the System Preparation (Sysprep) tool and capture the image to a file when the operating system is installed. + +- **OSInstall**: Must be set to Y or YES (the code just looks for the Y character) for the setup to proceed. + +- **AdminPassword**: Sets the local Administrator account password. + +- **TimeZoneName**: Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003). + + > [!NOTE] + > The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names. + +- **JoinWorkgroup**: Configures Windows to join a workgroup. + +- **HideShell**: Hides the Windows Shell during deployment. This hide-operation is especially useful for Windows 10 deployments in which the deployment wizard will otherwise appear behind the tiles. + +- **FinishAction**: Instructs MDT what to do when the task sequence is complete. + +- **DoNotCreateExtraPartition**: Configures the task sequence not to create the extra partition for BitLocker. There's no need to do this configuration for your reference image. + +- **WSUSServer**: Specifies which Windows Server Update Services (WSUS) server (and port, if needed) to use during the deployment. Without this option MDT will use Microsoft Update directly, which will increase deployment time and limit your options of controlling which updates are applied. + +- **SLSHARE**: Instructs MDT to copy the log files to a server share if something goes wrong during deployment, or when a deployment is successfully completed. + +- **ApplyGPOPack**: Allows you to deploy local group policies created by Microsoft Security Compliance Manager (SCM). + +- **SkipAdminPassword**: Skips the pane that asks for the Administrator password. + +- **SkipProductKey**: Skips the pane that asks for the product key. + +- **SkipComputerName**: Skips the Computer Name pane. + +- **SkipDomainMemberShip**: Skips the Domain Membership pane. If set to Yes, you need to configure either the JoinWorkgroup value or the JoinDomain, DomainAdmin, DomainAdminDomain, and DomainAdminPassword properties. + +- **SkipUserData**: Skips the pane for user state migration. + +- **SkipLocaleSelection**: Skips the pane for selecting language and keyboard settings. + +- **SkipTimeZone**: Skips the pane for setting the time zone. + +- **SkipApplications**: Skips the Applications pane. + +- **SkipBitLocker**: Skips the BitLocker pane. + +- **SkipSummary**: Skips the initial Windows Deployment Wizard summary pane. + +- **SkipRoles**: Skips the Install Roles and Features pane. + +- **SkipCapture**: Skips the Capture pane. + +- **SkipFinalSummary**: Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to select OK before the machine shuts down. ## Build the Windows 10 reference image As previously described, this section requires a Hyper-V host. For more information, see [Hyper-V requirements](prepare-for-windows-deployment-with-mdt.md#hyper-v-requirements). -Once you've created your task sequence, you're ready to create the Windows 10 reference image. This image creation will be performed by launching the task sequence from a virtual machine that will then automatically perform the reference image creation and capture process. +Once you've created your task sequence, you're ready to create the Windows 10 reference image. This image creation will be performed by launching the task sequence from a virtual machine that will then automatically perform the reference image creation and capture process. The steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then run the reference image task sequence image to create and capture the Windows 10 reference image. 1. Copy D:\\MDTBuildLab\\Boot\\MDT Build Lab x86.iso on MDT01 to C:\\ISO on your Hyper-V host (HV01). - >[!NOTE] - >Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image. + > [!NOTE] + > Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image. On **HV01**: - -2. Create a new virtual machine with the following settings: + +1. Create a new virtual machine with the following settings: + 1. Name: REFW10X64-001 2. Store the virtual machine in a different location: C:\VM 3. Generation 1 4. Memory: 1024 MB 5. Network: Must be able to connect to \\MDT01\MDTBuildLab$ - 7. Hard disk: 60 GB (dynamic disk) - 8. Install OS with image file: C:\\ISO\\MDT Build Lab x86.iso -1. Before you start the VM, add a checkpoint for REFW10X64-001, and name it **Clean with MDT Build Lab x86 ISO**. + 6. Hard disk: 60 GB (dynamic disk) + 7. Install OS with image file: C:\\ISO\\MDT Build Lab x86.iso - >[!NOTE] - >Checkpoints are useful if you need to restart the process and want to make sure you can start clean. - -4. Start the REFW10X64-001 virtual machine and connect to it. +2. Before you start the VM, add a checkpoint for REFW10X64-001, and name it **Clean with MDT Build Lab x86 ISO**. - >[!NOTE] - >Up to this point we haven't discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW10X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share. In the current scenario, this connectivity is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11. + > [!NOTE] + > Checkpoints are useful if you need to restart the process and want to make sure you can start clean. + +3. Start the REFW10X64-001 virtual machine and connect to it. + + > [!NOTE] + > Up to this point we haven't discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW10X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share. In the current scenario, this connectivity is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11. After booting into Windows PE, complete the Windows Deployment Wizard with the following settings: - 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image - 2. Specify whether to capture an image: Capture an image of this reference computer - - Location: \\\\MDT01\\MDTBuildLab$\\Captures - 3. File name: REFW10X64-001.wim + + - **Select a task sequence to execute on this computer**: Windows 10 Enterprise x64 RTM Default Image + + - **Specify whether to capture an image**: Capture an image of this reference computer + + - Location: \\\\MDT01\\MDTBuildLab$\\Captures + + - **File name**: REFW10X64-001.wim ![capture image.](../images/captureimage.png) - The Windows Deployment Wizard for the Windows 10 reference image. -5. The setup now starts and does the following steps: +4. The setup now starts and does the following steps: + 1. Installs the Windows 10 Enterprise operating system. 2. Installs the added applications, roles, and features. 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. @@ -666,21 +756,21 @@ After some time, you 'll have a Windows 10 Enterprise x64 image that is fully pa ## Troubleshooting > [!IMPORTANT] -> If you encounter errors applying the image when using a BIOS firmware type, see [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This +> If you encounter errors applying the image when using a BIOS firmware type, see [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). If you [enabled monitoring](#enable-monitoring), you can check the progress of the task sequence. ![monitoring.](../images/mdt-monitoring.png) -If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE, you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. +If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE, you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. After some time, you 'll have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. ## Related articles -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    -[Configure MDT settings](configure-mdt-settings.md) +- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) +- [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) +- [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) +- [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +- [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index a4990f1916..f92a6f30dc 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -11,31 +11,32 @@ ms.topic: article ms.technology: itpro-deploy ms.collection: - highpri -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Deploy a Windows 10 image using MDT -**Applies to** -- Windows 10 +**Applies to:** -This article will show you how to take your reference image for Windows 10 (that was [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). +- Windows 10 + +This article will show you how to take your reference image for Windows 10 (that was [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). We'll prepare for this deployment by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We'll configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules. -For the purposes of this article, we'll use four computers: DC01, MDT01, HV01 and PC0005. +For the purposes of this article, we'll use four computers: DC01, MDT01, HV01 and PC0005. -- DC01 is a domain controller -- MDT01 is a domain member server -- HV01 is a Hyper-V server +- DC01 is a domain controller +- MDT01 is a domain member server +- HV01 is a Hyper-V server - PC0005 is a blank device to which we'll deploy Windows 10 -MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment. +MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment. ![devices.](../images/mdt-07-fig01.png) ->[!NOTE] ->For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). +> [!NOTE] +> For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). ## Step 1: Configure Active Directory permissions @@ -43,7 +44,7 @@ These steps will show you how to configure an Active Directory account with the On **DC01**: -1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on **DC01**. This script configures permissions to allow the **MDT_JD** account to manage computer accounts in the contoso > Computers organizational unit. +1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on **DC01**. This script configures permissions to allow the **MDT_JD** account to manage computer accounts in the contoso > Computers organizational unit. 2. Create the **MDT_JD** service account by running the following command from an elevated **Windows PowerShell prompt**: @@ -85,7 +86,9 @@ On **MDT01**: The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image: 1. Ensure you're signed on as: contoso\administrator. + 2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. + 3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and select **Next**. 4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and select **Next**. @@ -93,6 +96,7 @@ The steps for creating the deployment share for production are the same as when 5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and select **Next**. 6. On the **Options** page, accept the default settings and select **Next** twice, and then select **Finish**. + 7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. ### Configure permissions for the production deployment share @@ -101,11 +105,12 @@ To read files in the deployment share, you need to assign NTFS and SMB permissio On **MDT01**: -1. Ensure you're signed in as **contoso\\administrator**. -2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt: +1. Ensure you're signed in as **contoso\\administrator**. - ``` powershell - icacls "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' +2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt: + + ```powershell + icacls.exe "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' grant-smbshareaccess -Name MDTProduction$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force ``` @@ -117,21 +122,22 @@ The next step is to add a reference image into the deployment share with the set In these steps, we assume that you've completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) article, so you've a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01. -1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. -2. Right-click the **Windows 10** folder and select **Import Operating System**. +1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. -3. On the **OS Type** page, select **Custom image file** and select **Next**. +2. Right-click the **Windows 10** folder and select **Import Operating System**. -4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and select **Next**. +3. On the **OS Type** page, select **Custom image file** and select **Next**. -5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and select **Next**. +4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and select **Next**. -6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, select **Next** twice, and then select **Finish**. -7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. +5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and select **Next**. ->[!NOTE] ->The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. - +6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, select **Next** twice, and then select **Finish**. + +7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. + +> [!NOTE] +> The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. ![imported OS.](../images/fig2-importedos.png) @@ -144,8 +150,11 @@ When you configure your MDT Build Lab deployment share, you can also add applica On **MDT01**: 1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2200320282_en_US.exe) to **D:\\setup\\adobe** on MDT01. + 2. Extract the .exe file that you downloaded to a .msi (ex: .\AcroRdrDC2200320282_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). + 3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. + 4. Right-click the **Applications** node, and create a new folder named **Adobe**. 5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**. @@ -161,22 +170,22 @@ On **MDT01**: 10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, select **Next** twice, and then select **Finish**. ![acroread image.](../images/acroread.png) - The Adobe Reader application added to the Deployment Workbench. ## Step 5: Prepare the drivers repository In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: -- Lenovo ThinkPad T420 -- Dell Latitude 7390 -- HP EliteBook 8560w -- Microsoft Surface Pro + +- Lenovo ThinkPad T420 +- Dell Latitude 7390 +- HP EliteBook 8560w +- Microsoft Surface Pro For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers. ->[!NOTE] ->You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time. - +> [!NOTE] +> You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time. + ### Create the driver source structure in the file system The key to successful management of drivers for MDT, and for any other deployment solution, is to have a good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use. @@ -186,41 +195,50 @@ On **MDT01**: > [!IMPORTANT] > In the steps below, it's critical that the folder names used for various computer makes and models exactly match the results of **wmic computersystem get model,manufacturer** on the target system. -1. Using File Explorer, create the **D:\\drivers** folder. -2. In the **D:\\drivers** folder, create the following folder structure: - 1. WinPE x86 - 2. WinPE x64 - 3. Windows 10 x64 -3. In the new Windows 10 x64 folder, create the following folder structure: - - Dell Inc. - - Latitude E7450 - - Hewlett-Packard - - HP EliteBook 8560w - - Lenovo - - ThinkStation P500 (30A6003TUS) - - Microsoft Corporation - - Surface Laptop +1. Using File Explorer, create the **D:\\drivers** folder. + +2. In the **D:\\drivers** folder, create the following folder structure: + + 1. WinPE x86 + 2. WinPE x64 + 3. Windows 10 x64 + +3. In the new Windows 10 x64 folder, create the following folder structure: + + - Dell Inc. + - Latitude E7450 + - Hewlett-Packard + - HP EliteBook 8560w + - Lenovo + - ThinkStation P500 (30A6003TUS) + - Microsoft Corporation + - Surface Laptop > [!NOTE] > Even if you're not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use. - + ### Create the logical driver structure in MDT When you import drivers to the MDT driver repository, MDT creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This mimic is done by creating logical folders in the Deployment Workbench. -1. On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node. -2. In the **Out-Of-Box Drivers** node, create the following folder structure: - 1. WinPE x86 - 2. WinPE x64 - 3. Windows 10 x64 -3. In the **Windows 10 x64** folder, create the following folder structure: - - Dell Inc. - - Latitude E7450 - - Hewlett-Packard - - HP EliteBook 8560w - - Lenovo - - 30A6003TUS - - Microsoft Corporation - - Surface Laptop + +1. On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node. + +2. In the **Out-Of-Box Drivers** node, create the following folder structure: + + 1. WinPE x86 + 2. WinPE x64 + 3. Windows 10 x64 + +3. In the **Windows 10 x64** folder, create the following folder structure: + + - Dell Inc. + - Latitude E7450 + - Hewlett-Packard + - HP EliteBook 8560w + - Lenovo + - 30A6003TUS + - Microsoft Corporation + - Surface Laptop The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in Windows PowerShell: @@ -230,36 +248,40 @@ Get-WmiObject -Class:Win32_ComputerSystem Or, you can use this command in a normal command prompt: -```console -wmic csproduct get name +```cmd +wmic.exe csproduct get name ``` If you want a more standardized naming convention, try the **ModelAliasExit.vbs script** from the Deployment Guys blog post, entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](/archive/blogs/deploymentguys/using-and-extending-model-aliases-for-hardware-specific-application-installation). ![drivers.](../images/fig4-oob-drivers.png) - The Out-of-Box Drivers structure in the Deployment Workbench. ### Create the selection profiles for boot image drivers By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles. -The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. + +The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can't locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. On **MDT01**: -1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. -2. In the New Selection Profile Wizard, create a selection profile with the following settings: - 1. Selection Profile name: WinPE x86 - 2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers. - 3. Select **Next**, **Next** and **Finish**. -3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**. -4. In the New Selection Profile Wizard, create a selection profile with the following settings: - 1. Selection Profile name: WinPE x64 - 2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers. - 3. Select **Next**, **Next** and **Finish**. +1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. + +2. In the **New Selection Profile Wizard**, create a selection profile with the following settings: + + - **Selection Profile name**: WinPE x86 + - **Folders**: Select the WinPE x86 folder in Out-of-Box Drivers. + - Select **Next**, **Next** and **Finish**. + +3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**. + +4. In the New Selection Profile Wizard, create a selection profile with the following settings: + + - **Selection Profile name**: WinPE x64 + - **Folders**: Select the WinPE x64 folder in Out-of-Box Drivers. + - Select **Next**, **Next** and **Finish**. ![figure 5.](../images/fig5-selectprofile.png) - Creating the WinPE x64 selection profile. ### Extract and import drivers for the x64 boot image @@ -269,11 +291,17 @@ Windows PE supports all the hardware models that we have, but here you learn to On **MDT01**: 1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)). -2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. - a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates. -3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. -4. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. -5. In the Deployment Workbench, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**, and use the following Driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**. + +2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. + + > [!NOTE] + > Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates. + +3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. + +4. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. + +5. In the Deployment Workbench, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**, and use the following Driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**. ### Download, extract, and import drivers @@ -281,8 +309,7 @@ On **MDT01**: For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6. -> [!div class="mx-imgBorder"] -> ![ThinkStation image.](../images/thinkstation.png) +![ThinkStation image.](../images/thinkstation.png) To get the updates, download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can also download the drivers by searching PC Support on the [Lenovo website](https://go.microsoft.com/fwlink/p/?LinkId=619543). @@ -292,7 +319,7 @@ On **MDT01**: 1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Lenovo** node. -2. Right-click the **30A6003TUS** folder and select **Import Drivers** and use the following Driver source directory to import drivers: +2. Right-click the **30A6003TUS** folder and select **Import Drivers** and use the following Driver source directory to import drivers: **D:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)** @@ -308,9 +335,9 @@ On **MDT01**: 1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell Inc.** node. -2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: +2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 10 x64\\Dell Inc.\\Latitude E7450** + **`D:\Drivers\Windows 10 x64\Dell Inc.\Latitude E7450`** ### For the HP EliteBook 8560w @@ -320,11 +347,11 @@ In these steps, we assume you've downloaded and extracted the drivers for the HP On **MDT01**: -1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Hewlett-Packard** node. +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Hewlett-Packard** node. -2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers** and use the following Driver source directory to import drivers: +2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers** and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** + **`D:\Drivers\Windows 10 x64\Hewlett-Packard\HP EliteBook 8560w`** ### For the Microsoft Surface Laptop @@ -332,11 +359,11 @@ For the Microsoft Surface Laptop model, you find the drivers on the Microsoft we On **MDT01**: -1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Microsoft** node. +1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Microsoft** node. -2. Right-click the **Surface Laptop** folder and select **Import Drivers**; and use the following Driver source directory to import drivers: +2. Right-click the **Surface Laptop** folder and select **Import Drivers**; and use the following Driver source directory to import drivers: - **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** + **`D:\Drivers\Windows 10 x64\Microsoft\Surface Laptop`** ## Step 6: Create the deployment task sequence @@ -349,6 +376,7 @@ On **MDT01**: 1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 10**. 2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-001 - Task sequence name: Windows 10 Enterprise x64 RTM Custom Image - Task sequence comments: Production Image @@ -366,26 +394,27 @@ On **MDT01**: 2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: - 1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: - 1. Name: Set DriverGroup001 - 2. Task Sequence Variable: DriverGroup001 - 3. Value: Windows 10 x64\\%Make%\\%Model% + 1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: - 2. Configure the **Inject Drivers** action with the following settings: - - Choose a selection profile: Nothing - - Install all drivers from the selection profile + - **Name**: Set DriverGroup001 + - **Task Sequence Variable**: DriverGroup001 + - **Value**: Windows 10 x64\\%Make%\\%Model% - > [!NOTE] - > The configuration above indicates that MDT should only use drivers from the folder specified by the DriverGroup001 property, which is defined by the "Choose a selection profile: Nothing" setting, and that MDT shouldn't use plug and play to determine which drivers to copy, which is defined by the "Install all drivers from the selection profile" setting. - - 3. State Restore. Enable the **Windows Update (Pre-Application Installation)** action. + 2. Configure the **Inject Drivers** action with the following settings: - 4. State Restore. Enable the **Windows Update (Post-Application Installation)** action. + - **Choose a selection profile**: Nothing + - Install all drivers from the selection profile + + > [!NOTE] + > The configuration above indicates that MDT should only use drivers from the folder specified by the DriverGroup001 property, which is defined by the "Choose a selection profile: Nothing" setting, and that MDT shouldn't use plug and play to determine which drivers to copy, which is defined by the "Install all drivers from the selection profile" setting. + + 3. State Restore. Enable the **Windows Update (Pre-Application Installation)** action. + + 4. State Restore. Enable the **Windows Update (Post-Application Installation)** action. 3. Select **OK**. ![drivergroup.](../images/fig6-taskseq.png) - The task sequence for production deployment. ## Step 7: Configure the MDT production deployment share @@ -400,9 +429,10 @@ In this section, you'll learn how to configure the MDT Build Lab deployment shar On **MDT01**: 1. Right-click the **MDT Production** deployment share and select **Properties**. + 2. Select the **Rules** tab and replace the existing rules with the following information (modify the domain name, WSUS server, and administrative credentials to match your environment): - ``` + ```ini [Settings] Priority=Default @@ -441,7 +471,7 @@ On **MDT01**: 3. Select **Edit Bootstrap.ini** and modify using the following information: - ``` + ```ini [Settings] Priority=Default @@ -461,11 +491,11 @@ On **MDT01**: - Image description: MDT Production x86 - ISO file name: MDT Production x86.iso - + > [!NOTE] - > + > > Because you're going to use Pre-Boot Execution Environment (PXE) later to deploy the machines, you don't need the ISO file; however, we recommend creating ISO files because they're useful when troubleshooting deployments and for quick tests. - + 6. On the **Drivers and Patches** sub tab, select the **WinPE x86** selection profile and select the **Include all drivers from the selection profile** option. 7. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. @@ -483,9 +513,9 @@ On **MDT01**: 11. Select **OK**. - >[!NOTE] - >It will take a while for the Deployment Workbench to create the monitoring database and web service. - + > [!NOTE] + > It will take a while for the Deployment Workbench to create the monitoring database and web service. + ![figure 8.](../images/mdt-07-fig08.png) The Windows PE tab for the x64 boot image. @@ -494,13 +524,13 @@ On **MDT01**: The rules for the MDT Production deployment share are different from those rules for the MDT Build Lab deployment share. The biggest differences are that you deploy the machines into a domain instead of a workgroup. -You can optionally remove the **UserID** and **UserPassword** entries from Bootstrap.ini so that users performing PXE boot are prompted to provide credentials with permission to connect to the deployment share. Setting **SkipBDDWelcome=NO** enables the welcome screen that displays options to run the deployment wizard, run DaRT tools (if installed), exit to a Windows PE command prompt, set the keyboard layout, or configure a static IP address. In this example, we're skipping the welcome screen and providing credentials. +You can optionally remove the **UserID** and **UserPassword** entries from Bootstrap.ini so that users performing PXE boot are prompted to provide credentials with permission to connect to the deployment share. Setting **SkipBDDWelcome=NO** enables the welcome screen that displays options to run the deployment wizard, run DaRT tools (if installed), exit to a Windows PE command prompt, set the keyboard layout, or configure a static IP address. In this example, we're skipping the welcome screen and providing credentials. ### The Bootstrap.ini file This file is the MDT Production Bootstrap.ini: -``` +```ini [Settings] Priority=Default @@ -516,7 +546,7 @@ SkipBDDWelcome=YES This file is the CustomSettings.ini file with the new join domain information: -``` +```ini [Settings] Priority=Default @@ -555,14 +585,15 @@ EventService=http://MDT01:9800 ``` Some properties to use in the MDT Production rules file are as follows: -- **JoinDomain.** The domain to join. -- **DomainAdmin.** The account to use when joining the machine to the domain. -- **DomainAdminDomain.** The domain for the join domain account. -- **DomainAdminPassword.** The password for the join domain account. -- **MachineObjectOU.** The organizational unit (OU) to which to add the computer account. -- **ScanStateArgs.** Arguments for the User State Migration Tool (USMT) ScanState command. -- **USMTMigFiles(\*).** List of USMT templates (controlling what to back up and restore). -- **EventService.** Activates logging information to the MDT monitoring web service. + +- **JoinDomain.** The domain to join. +- **DomainAdmin.** The account to use when joining the machine to the domain. +- **DomainAdminDomain.** The domain for the join domain account. +- **DomainAdminPassword.** The password for the join domain account. +- **MachineObjectOU.** The organizational unit (OU) to which to add the computer account. +- **ScanStateArgs.** Arguments for the User State Migration Tool (USMT) ScanState command. +- **USMTMigFiles(\*).** List of USMT templates (controlling what to back up and restore). +- **EventService.** Activates logging information to the MDT monitoring web service. > [!NOTE] > For more information about localization support, see the following articles: @@ -578,7 +609,6 @@ If your organization has a Microsoft Software Assurance agreement, you also can If you've licensing for MDOP and DaRT, you can add DaRT to the boot images using the steps in this section. If you don't have DaRT licensing, or don't want to use it, skip to the next section, [Update the Deployment Share](#update-the-deployment-share). To enable the remote connection feature in MDT, you need to do the following steps: - > [!NOTE] > DaRT 10 is part of [MDOP 2015](/microsoft-desktop-optimization-pack/#how-to-get-mdop). > @@ -592,34 +622,33 @@ On **MDT01**: ![DaRT image.](../images/dart.png) -2. Copy the two tools CAB files from **C:\\Program Files\\Microsoft DaRT\\v10** (**Toolsx86.cab** and **Toolsx64.cab**) to the production deployment share at **D:\\MDTProduction\\Tools\\x86** and **D:\\MDTProduction\\Tools\\x64**, respectively. +3. Copy the two tools CAB files from **C:\\Program Files\\Microsoft DaRT\\v10** (**Toolsx86.cab** and **Toolsx64.cab**) to the production deployment share at **D:\\MDTProduction\\Tools\\x86** and **D:\\MDTProduction\\Tools\\x64**, respectively. -3. In the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. +4. In the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. -4. On the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. +5. On the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. -5. On the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox. +6. On the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox. ![DaRT selection.](../images/mdt-07-fig09.png) - Selecting the DaRT 10 feature in the deployment share. -8. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. +7. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. -9. In the **Features** sub tab, in addition to the default selected feature pack, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. +8. In the **Features** sub tab, in addition to the default selected feature pack, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. -10. Select **OK**. +9. Select **OK**. ### Update the deployment share Like the MDT Build Lab deployment share, the MDT Production deployment share needs to be updated after it has been configured. This update-process is the one during which the Windows PE boot images are created. -1. Right-click the **MDT Production** deployment share and select **Update Deployment Share**. +1. Right-click the **MDT Production** deployment share and select **Update Deployment Share**. -2. Use the default options for the Update Deployment Share Wizard. +2. Use the default options for the Update Deployment Share Wizard. ->[!NOTE] ->The update process will take 5 to 10 minutes. +> [!NOTE] +> The update process will take 5 to 10 minutes. ## Step 8: Deploy the Windows 10 client image @@ -638,7 +667,6 @@ On **MDT01**: 3. Browse to the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** file and add the image with the default settings. ![figure 9.](../images/mdt-07-fig10.png) - The boot image added to the WDS console. ### Deploy the Windows 10 client @@ -657,19 +685,18 @@ On **HV01**: - Hard disk: 60 GB (dynamic disk) - Installation Options: Install an operating system from a network-based installation server -2. Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The VM will now load the Windows PE boot image from the WDS server. +2. Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The VM will now load the Windows PE boot image from the WDS server. ![figure 10.](../images/mdt-07-fig11.png) - The initial PXE boot process of PC0005. -3. After Windows PE has booted, complete the Windows Deployment Wizard using the following setting: +3. After Windows PE has booted, complete the Windows Deployment Wizard using the following setting: - Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image - Computer Name: **PC0005** - Applications: Select the **Install - Adobe Reader** checkbox. -4. Setup now begins and does the following steps: +4. Setup now begins and does the following steps: - Installs the Windows 10 Enterprise operating system. - Installs the added application. @@ -689,14 +716,13 @@ Since you've enabled the monitoring on the MDT Production deployment share, you On **MDT01**: -1. In the Deployment Workbench, expand the **MDT Production** deployment share folder. +1. In the Deployment Workbench, expand the **MDT Production** deployment share folder. -2. Select the **Monitoring** node, and wait until you see PC0005. +2. Select the **Monitoring** node, and wait until you see PC0005. -3. Double-click PC0005, and review the information. +3. Double-click PC0005, and review the information. ![figure 11.](../images/mdt-07-fig13.png) - The Monitoring node, showing the deployment progress of PC0005. ### Use information in the Event Viewer @@ -704,7 +730,6 @@ On **MDT01**: When monitoring is enabled, MDT also writes information to the event viewer on MDT01. This information can be used to trigger notifications via scheduled tasks when deployment is completed. For example, you can configure scheduled tasks to send an email when a certain event is created in the event log. ![figure 12.](../images/mdt-07-fig14.png) - The Event Viewer showing a successful deployment of PC0005. ## Multicast deployments @@ -721,13 +746,15 @@ Setting up MDT for multicast is straightforward. You enable multicast on the dep On **MDT01**: -1. In the Deployment Workbench, right-click the **MDT Production** deployment share folder and select **Properties**. -2. On the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and select **OK**. -3. Right-click the **MDT Production** deployment share folder and select **Update Deployment Share**. -4. After updating the deployment share, use the Windows Deployment Services console to, verify that the multicast namespace was created. +1. In the Deployment Workbench, right-click the **MDT Production** deployment share folder and select **Properties**. + +2. On the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and select **OK**. + +3. Right-click the **MDT Production** deployment share folder and select **Update Deployment Share**. + +4. After updating the deployment share, use the Windows Deployment Services console to, verify that the multicast namespace was created. ![figure 13.](../images/mdt-07-fig15.png) - The newly created multicast namespace. ## Use offline media to deploy Windows 10 @@ -742,19 +769,19 @@ To filter what is being added to the media, you create a selection profile. When On **MDT01**: -1. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click **Selection Profiles**, and select **New Selection Profile**. +1. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click **Selection Profiles**, and select **New Selection Profile**. -2. Use the following settings for the New Selection Profile Wizard: +2. Use the following settings for the New Selection Profile Wizard: - - General Settings - - Selection profile name: Windows 10 Offline Media + - General Settings + - **Selection profile name**: Windows 10 Offline Media - - Folders - - Applications / Adobe - - Operating Systems / Windows 10 - - Out-Of-Box Drivers / WinPE x64 - - Out-Of-Box Drivers / Windows 10 x64 - - Task Sequences / Windows 10 + - Folders + - Applications / Adobe + - Operating Systems / Windows 10 + - Out-Of-Box Drivers / WinPE x64 + - Out-Of-Box Drivers / Windows 10 x64 + - Task Sequences / Windows 10 ![offline media.](../images/mdt-offline-media.png) @@ -762,17 +789,18 @@ On **MDT01**: In these steps, you generate offline media from the MDT Production deployment share. To filter what is being added to the media, you use the previously created selection profile. -1. On MDT01, using File Explorer, create the **D:\\MDTOfflineMedia** folder. +1. On MDT01, using File Explorer, create the **D:\\MDTOfflineMedia** folder. - >[!NOTE] - >When creating offline media, you need to create the target folder first. It's crucial that you don't create a subfolder inside the deployment share folder because it will break the offline media. - -2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click the **Media** node, and select **New Media**. + > [!NOTE] + > When creating offline media, you need to create the target folder first. It's crucial that you don't create a subfolder inside the deployment share folder because it will break the offline media. -3. Use the following settings for the New Media Wizard: - - General Settings - - Media path: **D:\\MDTOfflineMedia** - - Selection profile: **Windows 10 Offline Media** +2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click the **Media** node, and select **New Media**. + +3. Use the following settings for the New Media Wizard: + + - General Settings + - Media path: **D:\\MDTOfflineMedia** + - Selection profile: **Windows 10 Offline Media** ### Configure the offline media @@ -780,24 +808,25 @@ Offline media has its own rules, its own Bootstrap.ini and CustomSettings.ini fi On **MDT01**: -1. Copy the CustomSettings.ini file from the **D:\MDTProduction\Control** folder to **D:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files. +1. Copy the CustomSettings.ini file from the **D:\MDTProduction\Control** folder to **D:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files. -2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**. +2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**. -3. In the **General** tab, configure the following: +3. In the **General** tab, configure the following: - Clear the Generate x86 boot image check box. - ISO file name: Windows 10 Offline Media.iso -4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. +4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. -5. On the **General** sub tab, configure the following settings: - - In the **Lite Touch Boot Image Settings** area: - - Image description: MDT Production x64 - - In the **Windows PE Customizations** area, set the Scratch space size to 128. +5. On the **General** sub tab, configure the following settings: -6. On the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. + - In the **Lite Touch Boot Image Settings** area: + - **Image description**: MDT Production x64 + - In the **Windows PE Customizations** area, set the Scratch space size to 128. -7. Select **OK**. +6. On the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. + +7. Select **OK**. ### Generate the offline media @@ -805,30 +834,36 @@ You've now configured the offline media deployment share, however the share hasn On **MDT01**: -1. In the Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node. +1. In the Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node. -2. Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **D:\\MDTOfflineMedia\\Content** folder. The process might require several minutes. +2. Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **D:\\MDTOfflineMedia\\Content** folder. The process might require several minutes. ### Create a bootable USB stick The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it's often more efficient to use USB sticks instead since they're faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.) ->[!TIP] ->In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. You can place the image on a different drive (ex: E:\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.swm) and then modify E:\Deploy\Control\OperatingSystems.xml to point to it. Alternatively to keep using the USB you must split the .wim file, which can be done using DISM:
     
    Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800.
     
    Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm.
     
    To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (`True`), so this must be changed and the offline media content updated. +> [!TIP] +> In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. You can place the image on a different drive (ex: E:\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.swm) and then modify E:\Deploy\Control\OperatingSystems.xml to point to it. Alternatively to keep using the USB you must split the .wim file, which can be done using DISM: +> +> **`Dism.exe /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800.`** +> +> Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm. +> +> To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (`True`), so this must be changed and the offline media content updated. Follow these steps to create a bootable USB stick from the offline media content: -1. On a physical machine running Windows 7 or later, insert the USB stick you want to use. +1. On a physical machine running Windows 7 or later, insert the USB stick you want to use. -2. Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick. +2. Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick. -3. Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**. +3. Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**. -4. In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F. +4. In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F. -5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter). +5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter). -6. In the Diskpart utility, type **active**, and then type **exit**. +6. In the Diskpart utility, type **active**, and then type **exit**. ## Unified Extensible Firmware Interface (UEFI)-based deployments @@ -840,9 +875,9 @@ The partitions when deploying an UEFI-based machine. ## Related articles -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    -[Configure MDT settings](configure-mdt-settings.md)
    +- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) +- [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) +- [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +- [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index 701f10efc1..a178e2f7e5 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -11,19 +11,20 @@ ms.topic: article ms.technology: itpro-deploy ms.collection: - highpri -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Get started with MDT -**Applies to** +**Applies to:** + - Windows 10 This article provides an overview of the features, components, and capabilities of the [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/). When you have finished reviewing this information, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). ## About MDT -MDT is a unified collection of tools, processes, and guidance for automating desktop and server deployment. You can use it to create reference images or as a complete deployment solution. MDT is one of the most important tools available to IT professionals today. +MDT is a unified collection of tools, processes, and guidance for automating desktop and server deployment. You can use it to create reference images or as a complete deployment solution. MDT is one of the most important tools available to IT professionals today. In addition to reducing deployment time and standardizing desktop and server images, MDT enables you to more easily manage security and ongoing configurations. MDT builds on top of the core deployment tools in the [Windows Assessment and Deployment Kit](/windows-hardware/get-started/adk-install) (Windows ADK) with more guidance and features designed to reduce the complexity and time required for deployment in an enterprise environment. @@ -37,39 +38,58 @@ MDT supports the deployment of Windows 10, and Windows 7, Windows 8.1, and Windo MDT has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it's considered fundamental to Windows operating system and enterprise application deployment. MDT has many useful features, such as: -- **Windows Client support.** Supports Windows 7, Windows 8.1, and Windows 10. -- **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. -- **Additional operating systems support.** Supports Windows Thin PC and [Windows Embedded POSReady 7](https://www.microsoft.com/en-us/download/details.aspx?id=26558), and Windows 8.1 Embedded Industry. -- **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. -- **GPT support.** Supports deployment to machines that require the new GPT partition table format. This feature is related to UEFI. -- **Enhanced Windows PowerShell support.** Provides support for running PowerShell scripts. + +- **Windows Client support**: Supports Windows 7, Windows 8.1, and Windows 10. + +- **Windows Server support**: Supports Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. + +- **Additional operating systems support**: Supports Windows Thin PC and [Windows Embedded POSReady 7](https://www.microsoft.com/download/details.aspx?id=26558), and Windows 8.1 Embedded Industry. + +- **UEFI support**: Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. + +- **GPT support**: Supports deployment to machines that require the new GPT partition table format. This feature is related to UEFI. + +- **Enhanced Windows PowerShell support**: Provides support for running PowerShell scripts. ![figure 2.](../images/mdt-05-fig02.png) - The deployment share mounted as a standard PSDrive allows for administration using PowerShell. -- **Add local administrator accounts.** Allows you to add multiple user accounts to the local Administrators group on the target computers, either via settings or the deployment wizard. -- **Automated participation in CEIP and WER.** Provides configuration for participation in Windows Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER). -- **Deploy Windows RE.** Enables deployment of a customized Windows Recovery Environment (Windows RE) as part of the task sequence. -- **Deploy to VHD.** Provides ready-made task sequence templates for deploying Windows into a virtual hard disk (VHD) file. -- **Improved deployment wizard.** Provides more progress information and a cleaner UI for the Lite Touch Deployment Wizard. -- **Monitoring.** Allows you to see the status of currently running deployments. -- **Apply GPO Pack.** Allows you to deploy local group policy objects created by Microsoft Security Compliance Manager (SCM). -- **Partitioning routines.** Provides improved partitioning routines to ensure that deployments work regardless of the current hard drive structure. -- **Offline BitLocker.** Provides the capability to have BitLocker enabled during the Windows Preinstallation Environment (Windows PE) phase, thus saving hours of encryption time. -- **USMT offline user-state migration.** Provides support for running the User State Migration Tool (USMT) capture offline, during the Windows PE phase of the deployment. +- **Add local administrator accounts**: Allows you to add multiple user accounts to the local Administrators group on the target computers, either via settings or the deployment wizard. + +- **Automated participation in CEIP and WER**: Provides configuration for participation in Windows Customer Experience Improvement Program (CEIP) and Windows Error Reporting (WER). + +- **Deploy Windows RE**: Enables deployment of a customized Windows Recovery Environment (Windows RE) as part of the task sequence. + +- **Deploy to VHD**: Provides ready-made task sequence templates for deploying Windows into a virtual hard disk (VHD) file. + +- **Improved deployment wizard**: Provides more progress information and a cleaner UI for the Lite Touch Deployment Wizard. + +- **Monitoring**: Allows you to see the status of currently running deployments. + +- **Apply GPO Pack**: Allows you to deploy local group policy objects created by Microsoft Security Compliance Manager (SCM). + +- **Partitioning routines**: Provides improved partitioning routines to ensure that deployments work regardless of the current hard drive structure. + +- **Offline BitLocker**: Provides the capability to have BitLocker enabled during the Windows Preinstallation Environment (Windows PE) phase, thus saving hours of encryption time. + +- **USMT offline user-state migration**: Provides support for running the User State Migration Tool (USMT) capture offline, during the Windows PE phase of the deployment. ![figure 3.](../images/mdt-05-fig03.png) - The offline USMT backup in action. -- **Install or uninstall Windows roles or features.** Enables you to select roles and features as part of the deployment wizard. MDT also supports uninstall of roles and features. -- **Microsoft System Center Orchestrator integration.** Provides the capability to use Orchestrator runbooks as part of the task sequence. -- **Support for DaRT.** Supports optional integration of the DaRT components into the boot image. -- **Support for Microsoft Office.** Provides added support for deploying Microsoft Office. -- **Support for Modern UI app package provisioning.** Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later. -- **Extensibility.** Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts. -- **Upgrade task sequence.** Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, see the [Microsoft Deployment Toolkit resource page](/mem/configmgr/mdt/). +- **Install or uninstall Windows roles or features**: Enables you to select roles and features as part of the deployment wizard. MDT also supports uninstall of roles and features. + +- **Microsoft System Center Orchestrator integration**: Provides the capability to use Orchestrator runbooks as part of the task sequence. + +- **Support for DaRT**: Supports optional integration of the DaRT components into the boot image. + +- **Support for Microsoft Office**: Provides added support for deploying Microsoft Office. + +- **Support for Modern UI app package provisioning**: Provisions applications based on the new Windows app package standard, which is used in Windows 8 and later. + +- **Extensibility**: Provides the capability to extend MDT far beyond the built-in features by adding custom scripts, web services, System Center Orchestrator runbooks, PowerShell scripts, and VBScripts. + +- **Upgrade task sequence**: Provides a new upgrade task sequence template that you can use to upgrade existing Windows 7, Windows 8, and Windows 8.1 systems directly to Windows 10, automatically preserving all data, settings, applications, and drivers. For more information about using this new upgrade task sequence, see the [Microsoft Deployment Toolkit resource page](/mem/configmgr/mdt/). ## MDT Lite Touch components @@ -88,6 +108,7 @@ A deployment share is essentially a folder on the server that is shared and cont ## Rules The rules (CustomSettings.ini and Bootstrap.ini) make up the brain of MDT. The rules control the Windows Deployment Wizard on the client and, for example, can provide the following settings to the machine being deployed: + - Computer name - Domain to join, and organizational unit (OU) in Active Directory to hold the computer object - Whether to enable BitLocker @@ -95,13 +116,11 @@ The rules (CustomSettings.ini and Bootstrap.ini) make up the brain of MDT. The r You can manage hundreds of settings in the rules. For more information, see the [Microsoft Deployment Toolkit resource center](/mem/configmgr/mdt/). ![figure 5.](../images/mdt-05-fig05.png) - Example of an MDT rule. In this example, the new computer name is being calculated based on PC- plus the first seven (Left) characters from the serial number ## Boot images -Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment -share on the server and start the deployment. +Boot images are the Windows Preinstallation Environment (Windows PE) images that are used to start the deployment. They can be started from a CD or DVD, an ISO file, a USB device, or over the network using a Pre-Boot Execution Environment (PXE) server. The boot images connect to the deployment share on the server and start the deployment. ## Operating systems @@ -124,33 +143,44 @@ With the Deployment Workbench, you can add any Microsoft packages that you want Task sequences are the heart and soul of the deployment solution. When creating a task sequence, you need to select a template. The templates are located in the Templates folder in the MDT installation directory, and they determine which default actions are present in the sequence. You can think of a task sequence as a list of actions that need to be executed in a certain order. Each action can also have conditions. Some examples of actions are as follows: -- **Gather.** Reads configuration settings from the deployment server. -- **Format and Partition.** Creates the partition(s) and formats them. -- **Inject Drivers.** Finds out which drivers the machine needs and downloads them from the central driver repository. -- **Apply Operating System.** Uses ImageX to apply the image. -- **Windows Update.** Connects to a WSUS server and updates the machine. + +- **Gather**: Reads configuration settings from the deployment server. +- **Format and Partition**: Creates the partition(s) and formats them. +- **Inject Drivers**: Finds out which drivers the machine needs and downloads them from the central driver repository. +- **Apply Operating System**: Uses ImageX to apply the image. +- **Windows Update**: Connects to a WSUS server and updates the machine. ## Task sequence templates MDT comes with nine default task sequence templates. You can also create your own templates. As long as you store them in the Templates folder, they'll be available when you create a new task sequence. -- **Sysprep and Capture task sequence.** Used to run the System Preparation (Sysprep) tool and capture an image of a reference computer. + +- **Sysprep and Capture task sequence**: Used to run the System Preparation (Sysprep) tool and capture an image of a reference computer. > [!NOTE] > It's preferable to use a complete build and capture instead of the Sysprep and Capture task sequence. A complete build and capture can be automated, whereas Sysprep and Capture can't. - -- **Standard Client task sequence.** The most frequently used task sequence. Used for creating reference images and for deploying clients in production. -- **Standard Client Replace task sequence.** Used to run User State Migration Tool (USMT) backup and the optional full Windows Imaging (WIM) backup action. Can also be used to do a secure wipe of a machine that is going to be decommissioned. -- **Custom task sequence.** As the name implies, a custom task sequence with only one default action (one Install Application action). -- **Standard Server task sequence.** The default task sequence for deploying operating system images to servers. The main difference between this template and the Standard Client task sequence template is that it doesn't contain any USMT actions because USMT isn't supported on servers. -- **Lite Touch OEM task sequence.** Used to preload operating systems images on the computer hard drive. Typically used by computer original equipment manufacturers (OEMs) but some enterprise organizations also use this feature. -- **Post OS Installation task sequence.** A task sequence prepared to run actions after the operating system has been deployed. Useful for server deployments but not often used for client deployments. -- **Deploy to VHD Client task sequence.** Similar to the Standard Client task sequence template but also creates a virtual hard disk (VHD) file on the target computer and deploys the image to the VHD file. -- **Deploy to VHD Server task sequence.** Same as the Deploy to VHD Client task sequence but for servers. -- **Standard Client Upgrade task sequence.** A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers. + +- **Standard Client task sequence**: The most frequently used task sequence. Used for creating reference images and for deploying clients in production. + +- **Standard Client Replace task sequence**: Used to run User State Migration Tool (USMT) backup and the optional full Windows Imaging (WIM) backup action. Can also be used to do a secure wipe of a machine that is going to be decommissioned. + +- **Custom task sequence**: As the name implies, a custom task sequence with only one default action (one Install Application action). + +- **Standard Server task sequence**: The default task sequence for deploying operating system images to servers. The main difference between this template and the Standard Client task sequence template is that it doesn't contain any USMT actions because USMT isn't supported on servers. + +- **Lite Touch OEM task sequence**: Used to preload operating systems images on the computer hard drive. Typically used by computer original equipment manufacturers (OEMs) but some enterprise organizations also use this feature. + +- **Post OS Installation task sequence**: A task sequence prepared to run actions after the operating system has been deployed. Useful for server deployments but not often used for client deployments. + +- **Deploy to VHD Client task sequence**: Similar to the Standard Client task sequence template but also creates a virtual hard disk (VHD) file on the target computer and deploys the image to the VHD file. + +- **Deploy to VHD Server task sequence**: Same as the Deploy to VHD Client task sequence but for servers. + +- **Standard Client Upgrade task sequence**: A simple task sequence template used to perform an in-place upgrade from Windows 7, Windows 8, or Windows 8.1 directly to Windows 10, automatically preserving existing data, settings, applications, and drivers. ## Selection profiles Selection profiles, which are available in the Advanced Configuration node, provide a way to filter content in the Deployment Workbench. Selection profiles are used for several purposes in the Deployment Workbench and in Lite Touch deployments. For example, they can be used to: + - Control which drivers and packages are injected into the Lite Touch (and generic) boot images. - Control which drivers are injected during the task sequence. - Control what is included in any media that you create. @@ -161,8 +191,8 @@ Selection profiles, which are available in the Advanced Configuration node, prov MDT uses many log files during operating system deployments. By default the logs are client side, but by configuring the deployment settings, you can have MDT store them on the server, as well. -**Note** -The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). +> [!NOTE] +> The easiest way to view log files is to use Configuration Manager Trace (CMTrace), which is included in the [Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). ## Monitoring @@ -170,4 +200,4 @@ On the deployment share, you also can enable monitoring. After you enable monito ## See next -[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) +- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 874e591992..e5eb7ae010 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -11,13 +11,14 @@ ms.topic: article ms.technology: itpro-deploy ms.collection: - highpri -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Prepare for deployment with MDT -**Applies to** -- Windows 10 +**Applies to:** + +- Windows 10 This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 10 with the Microsoft Deployment Toolkit (MDT). It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the file system and in Active Directory. @@ -28,25 +29,34 @@ The procedures in this guide use the following names and infrastructure. ### Network and servers For the purposes of this article, we'll use three server computers: **DC01**, **MDT01**, and **HV01**. -- All servers are running Windows Server 2019. - - You can use an earlier version of Windows Server with minor modifications to some procedures. - - Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is required to perform the procedures in this guide. -- **DC01** is a domain controller, DHCP server, and DNS server for contoso.com, representing the fictitious Contoso Corporation. + +- All servers are running Windows Server 2019. + + - You can use an earlier version of Windows Server with minor modifications to some procedures. + +- **DC01** is a domain controller, DHCP server, and DNS server for **contoso.com**, representing the fictitious Contoso Corporation. + - **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200 GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server. - - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. + + - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. + - **HV01** is a Hyper-V host computer that is used to build a Windows 10 reference image. - - See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01. + - See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01. ### Client computers Several client computers are referenced in this guide with hostnames of PC0001 to PC0007. - **PC0001**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. + - Client name: PC0001 - IP Address: DHCP + - **PC0002**: A computer running Windows 7 SP1 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios. + - Client name: PC0002 - IP Address: DHCP + - **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 7 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively. ### Storage requirements @@ -59,15 +69,15 @@ If you don't have access to a Hyper-V server, you can install Hyper-V on a Windo ### Network requirements -All server and client computers referenced in this guide are on the same subnet. This isn't required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. +All server and client computers referenced in this guide are on the same subnet. This isn't required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. ### Domain credentials The following generic credentials are used in this guide. You should replace these credentials as they appear in each procedure with your credentials. -**Active Directory domain name**: contoso.com
    -**Domain administrator username**: administrator
    -**Domain administrator password**: pass@word1 +- **Active Directory domain name**: contoso.com +- **Domain administrator username**: administrator +- **Domain administrator password**: pass@word1 ### Organizational unit structure @@ -82,33 +92,39 @@ These steps assume that you have the MDT01 member server running and configured On **MDT01**: Visit the [Download and install the Windows ADK](/windows-hardware/get-started/adk-install) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you'll need to create this folder): + - [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042) - [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2087112) - [The Windows System Image Manager (WSIM) 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334) - (Optional) [The MDT_KB4564442 patch for BIOS firmware](https://download.microsoft.com/download/3/0/6/306AC1B2-59BE-43B8-8C65-E141EF287A5E/KB4564442/MDT_KB4564442.exe) - - This patch is needed to resolve a bug that causes detection of BIOS-based machines as UEFI-based machines. If you have a UEFI deployment, you don't need this patch. + - This patch is needed to resolve a bug that causes detection of BIOS-based machines as UEFI-based machines. If you have a UEFI deployment, you don't need this patch. ->[!TIP] ->You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties). +> [!TIP] +> You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties). 1. On **MDT01**, ensure that you're signed in as an administrator in the CONTOSO domain. - - For the purposes of this guide, we're using a Domain Admin account of **administrator** with a password of pass@word1. You can use your own administrator username and password as long as you properly adjust all steps in this guide that use these login credentials. + + - For the purposes of this guide, we're using a Domain Admin account of **administrator** with a password of **pass@word1**. You can use your own administrator username and password as long as you properly adjust all steps in this guide that use these login credentials. + 2. Start the **ADK Setup** (D:\\Downloads\\ADK\\adksetup.exe), select **Next** twice to accept the default installation parameters, select **Accept** to accept the license agreement, and then on the **Select the features you want to install** page accept the default list of features by clicking **Install**. This will install deployment tools and the USMT. Verify that the installation completes successfully before moving to the next step. + 3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), select **Next** twice to accept the default installation parameters, select **Accept** to accept the license agreement, and then on the **Select the features you want to install** page select **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully before moving to the next step. + 4. Extract the **WSIM 1903 update** (D:\\Downloads\ADK\\WSIM1903.zip) and then run the **UpdateWSIM.bat** file. - You can confirm that the update is applied by viewing properties of the ImageCat.exe and ImgMgr.exe files at **C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM** and verifying that the **Details** tab displays a **File version** of **10.0.18362.144** or later. -5. If you downloaded the optional MDT_KB4564442 patch for BIOS based deployment, see [this support article](https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) for instructions on how to install the patch. + +5. If you downloaded the optional MDT_KB4564442 patch for BIOS based deployment, see [this support article](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) for instructions on how to install the patch. ## Install and initialize Windows Deployment Services (WDS) On **MDT01**: 1. Open an elevated Windows PowerShell prompt and enter the following command: - + ```powershell Install-WindowsFeature -Name WDS -IncludeManagementTools - WDSUTIL /Verbose /Progress /Initialize-Server /Server:MDT01 /RemInst:"D:\RemoteInstall" - WDSUTIL /Set-Server /AnswerClients:All + WDSUTIL.exe /Verbose /Progress /Initialize-Server /Server:MDT01 /RemInst:"D:\RemoteInstall" + WDSUTIL.exe /Set-Server /AnswerClients:All ``` ## Optional: Install Windows Server Update Services (WSUS) @@ -117,26 +133,32 @@ If you wish to use MDT as a WSUS server using the Windows Internal Database (WID To install WSUS on MDT01, enter the following at an elevated Windows PowerShell prompt: - ```powershell - Install-WindowsFeature -Name UpdateServices, UpdateServices-WidDB, UpdateServices-Services, UpdateServices-RSAT, UpdateServices-API, UpdateServices-UI - cmd /c "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS - ``` +```powershell +Install-WindowsFeature -Name UpdateServices, UpdateServices-WidDB, UpdateServices-Services, UpdateServices-RSAT, UpdateServices-API, UpdateServices-UI +"C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS +``` ->To use the WSUS that you have installed on MDT01, you must also [configure Group Policy](../update/waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) on DC01 and perform the neccessary post-installation configuration of WSUS on MDT01. +> [!NOTE] +> To use the WSUS that you have installed on MDT01, you must also [configure Group Policy](../update/waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) on DC01 and perform the necessary post-installation configuration of WSUS on MDT01. ## Install MDT ->[!NOTE] ->MDT installation requires the following: ->- The Windows ADK for Windows 10 (installed in the previous procedure) ->- Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; type **$host** to check) ->- Microsoft .NET Framework +> [!NOTE] +> MDT installation requires the following: +> +> - The Windows ADK for Windows 10 (installed in the previous procedure) +> - Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; enter `$host` to check) +> - Microsoft .NET Framework On **MDT01**: -1. Visit the [MDT resource page](/mem/configmgr/mdt/) and select **Download MDT**. -2. Save the **MicrosoftDeploymentToolkit_x64.msi** file to the D:\\Downloads\\MDT folder on MDT01. - - **Note**: As of the publishing date for this guide, the current version of MDT is 8456 (6.3.8456.1000), but a later version will also work. +1. Visit the [MDT resource page](/mem/configmgr/mdt/) and select **Download MDT**. + +2. Save the **MicrosoftDeploymentToolkit_x64.msi** file to the D:\\Downloads\\MDT folder on MDT01. + + > [!NOTE] + > As of the publishing date for this guide, the current version of MDT is 8456 (6.3.8456.1000), but a later version will also work. + 3. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings. ## Create the OU structure @@ -186,20 +208,27 @@ To use the Active Directory Users and Computers console (instead of PowerShell): On **DC01**: -1. Using the Active Directory Users and Computers console (dsa.msc), in the contoso.com domain level, create a top-level OU named **Contoso**. -2. In the **Contoso** OU, create the following OUs: - 1. Accounts - 2. Computers - 3. Groups -3. In the **Contoso / Accounts** OU, create the following underlying OUs: - 1. Admins - 2. Service Accounts - 3. Users -4. In the **Contoso / Computers** OU, create the following underlying OUs: - 1. Servers - 2. Workstations -5. In the **Contoso / Groups** OU, create the following OU: - 1. Security Groups +1. Using the Active Directory Users and Computers console (dsa.msc), in the contoso.com domain level, create a top-level OU named **Contoso**. + +2. In the **Contoso** OU, create the following OUs: + + - Accounts + - Computers + - Groups + +3. In the **Contoso / Accounts** OU, create the following underlying OUs: + + - Admins + - Service Accounts + - Users + +4. In the **Contoso / Computers** OU, create the following underlying OUs: + + - Servers + - Workstations + +5. In the **Contoso / Groups** OU, create the following OU: + - Security Groups The final result of either method is shown below. The **MDT_BA** account will be created next. @@ -212,6 +241,7 @@ To create an MDT build account, open an elevated Windows PowerShell prompt on DC ```powershell New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true ``` + If you have the Active Directory Users and Computers console open you can refresh the view and see this new account in the **Contoso\Accounts\Service Accounts** OU as shown in the screenshot above. ## Create and share the logs folder @@ -220,8 +250,9 @@ By default MDT stores the log files locally on the client. In order to capture a On **MDT01**: -1. Sign in as **CONTOSO\\administrator**. -2. Create and share the **D:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: +1. Sign in as **CONTOSO\\administrator**. + +2. Create and share the **D:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: ```powershell New-Item -Path D:\Logs -ItemType directory @@ -235,7 +266,7 @@ See the following example: ## Use CMTrace to read log files (optional) -The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](/sccm/core/support/cmtrace)), which is available as part of the [Microsoft System 2012 R2 Center Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). You should also download this tool. +The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](/sccm/core/support/cmtrace)), which is available as part of the [Microsoft System 2012 R2 Center Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). You should also download this tool. You can use Notepad (example below): ![figure 8.](../images/mdt-05-fig09.png) @@ -252,8 +283,9 @@ When you've completed all the steps in this section to prepare for deployment, s ## Appendix -**Sample files** +### Sample files The following sample files are also available to help automate some MDT deployment tasks. This guide doesn't use these files, but they're made available here so you can see how some tasks can be automated with Windows PowerShell. + - [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. - [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. diff --git a/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md index 13c28f34bf..b38d0d58a8 100644 --- a/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md +++ b/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10.md @@ -9,17 +9,19 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Refresh a Windows 7 computer with Windows 10 -**Applies to** -- Windows 10 +**Applies to:** + +- Windows 10 This article will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](/mem/configmgr/mdt/). -For the purposes of this article, we'll use three computers: DC01, MDT01, and PC0001. +For the purposes of this article, we'll use three computers: DC01, MDT01, and PC0001. + - DC01 is a domain controller for the contoso.com domain. - MDT01 is domain member server that hosts your deployment share. - PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to a new version of Windows 10, with data and settings restored. The example used here is a computer running Windows 7 SP1. @@ -27,7 +29,6 @@ For the purposes of this article, we'll use three computers: DC01, MDT01, and PC Both DC01 and MDT01 are running Windows Server 2019; however any supported version of Windows Server can be used. For more information on the setup for this article, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). ![computers.](../images/mdt-04-fig01.png "Computers used in this topic") - The computers used in this article. ## The computer refresh process @@ -36,26 +37,26 @@ A computer refresh isn't the same as an in-place upgrade because a computer refr For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh, you will: -1. Back up data and settings locally, in a backup folder. -2. Wipe the partition, except for the backup folder. -3. Apply the new operating system image. -4. Install other applications. -5. Restore data and settings. +1. Back up data and settings locally, in a backup folder. +2. Wipe the partition, except for the backup folder. +3. Apply the new operating system image. +4. Install other applications. +5. Restore data and settings. During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are linked in the file system, which allows for fast migration, even when there's many files. ->[!NOTE] ->In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario. - +> [!NOTE] +> In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario. + ### Multi-user migration By default, ScanState in USMT backs up all profiles on the machine, including local computer profiles. If you have a computer that has been in your environment for a while, it likely has several domain-based profiles on it, including those of former users. You can limit which profiles are backed up by configuring command-line switches to ScanState (added as rules in MDT). -For example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\* +For example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: `ScanStateArgs=/ue:*\* /ui:CONTOSO\*` + +> [!NOTE] +> You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. ->[!NOTE] ->You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. - ### Support for additional settings In addition to the command-line switches that control which profiles to migrate, [XML templates](../usmt/understanding-migration-xml-files.md) control exactly what data is being migrated. You can control data within and outside the user profiles. @@ -72,45 +73,50 @@ In this section, we assume that you've already performed the prerequisite proced - [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) -It's also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to the latest version of Windows 10. For demonstration purposes, we'll be refreshing a Windows 7 SP1 PC to Windows 10, version 1909. - +It's also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to the latest version of Windows 10. For demonstration purposes, we'll be refreshing a Windows 7 SP1 PC to Windows 10, version 1909. + ### Upgrade (refresh) a Windows 7 SP1 client ->[!IMPORTANT] ->Domain join details [specified in the deployment share rules](deploy-a-windows-10-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 7 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-10-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer. +> [!IMPORTANT] +> Domain join details [specified in the deployment share rules](deploy-a-windows-10-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 7 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-10-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in **Contoso** > **Computers** > **Workstations**. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer. + +1. On PC0001, sign in as **contoso\\Administrator** and start the Lite Touch Deploy Wizard by opening **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. -1. On PC0001, sign in as **contoso\\Administrator** and start the Lite Touch Deploy Wizard by opening **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. 2. Complete the deployment guide using the following settings: - - * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image - * Computer name: <default> - * Specify where to save a complete computer backup: Don't back up the existing computer - >[!NOTE] - >Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run. - * Select one or more applications to install: Install - Adobe Reader + + - Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + + - **Computer name**: *\* + + - **Specify where to save a complete computer backup**: Don't back up the existing computer + + > [!NOTE] + > Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run. + + - **Select one or more applications to install**: Install - Adobe Reader ![Computer refresh.](../images/fig2-taskseq.png "Start the computer refresh") -4. Setup starts and performs the following actions: - - * Backs up user settings and data using USMT. - * Installs the Windows 10 Enterprise x64 operating system. - * Installs any added applications. - * Updates the operating system using your local Windows Server Update Services (WSUS) server. - * Restores user settings and data using USMT. +3. Setup starts and performs the following actions: -5. You can monitor progress of the deployment using the deployment workbench on MDT01. See the following example: + - Backs up user settings and data using USMT. + - Installs the Windows 10 Enterprise x64 operating system. + - Installs any added applications. + - Updates the operating system using your local Windows Server Update Services (WSUS) server. + - Restores user settings and data using USMT. + +4. You can monitor progress of the deployment using the deployment workbench on MDT01. See the following example: ![monitor deployment.](../images/monitor-pc0001.png) -6. After the refresh process completes, sign in to the Windows 10 computer and verify that user accounts, data and settings were migrated. +5. After the refresh process completes, sign in to the Windows 10 computer and verify that user accounts, data and settings were migrated. ## Related articles -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
    -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    -[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    -[Configure MDT settings](configure-mdt-settings.md) +- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) +- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) +- [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) +- [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md) +- [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md index 8476e0e4ed..b240a4f426 100644 --- a/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md +++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer.md @@ -10,26 +10,27 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Replace a Windows 7 computer with a Windows 10 computer -**Applies to** -- Windows 10 +**Applies to:** -A computer replace scenario for Windows 10 is similar to a computer refresh for Windows 10. However, because you're replacing a device, you can't store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings. +- Windows 10 + +A computer replace scenario for Windows 10 is similar to a computer refresh for Windows 10. However, because you're replacing a device, you can't store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings. + +For the purposes of this article, we'll use four computers: DC01, MDT01, PC0002, and PC0007. -For the purposes of this article, we'll use four computers: DC01, MDT01, PC0002, and PC0007. - DC01 is a domain controller for the contoso.com domain. - MDT01 is domain member server that hosts your deployment share. -- PC0002 is an old computer running Windows 7 SP1 that will be replaced by PC0007. +- PC0002 is an old computer running Windows 7 SP1 that will be replaced by PC0007. - PC0007 is a new computer will have the Windows 10 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain. For more details on the setup for this article, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). ![The computers used in this topic.](../images/mdt-03-fig01.png) - The computers used in this article. >HV01 is also used in this topic to host the PC0007 virtual machine for demonstration purposes, however typically PC0007 is a physical computer. @@ -43,7 +44,9 @@ The computers used in this article. On **MDT01**: 1. Open the Deployment Workbench, under **Deployment Shares** right-click **MDT Production**, select **Properties**, and then select the **Rules** tab. + 2. Change the **SkipUserData=YES** option to **NO**, and select **OK**. + 3. Right-click on **MDT Production** and select **Update Deployment Share**. Then select **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default settings. ### Create and share the MigData folder @@ -51,23 +54,25 @@ On **MDT01**: On **MDT01**: 1. Create and share the **D:\\MigData** folder by running the following three commands in an elevated Windows PowerShell prompt: - ``` powershell + + ```powershell New-Item -Path D:\MigData -ItemType directory New-SmbShare -Name MigData$ -Path D:\MigData -ChangeAccess EVERYONE icacls D:\MigData /grant '"MDT_BA":(OI)(CI)(M)' ``` - ### Create a backup only (replace) task sequence -2. In Deployment Workbench, under the **MDT Production** deployment share, select the **Task Sequences** node and create a new folder named **Other**. +### Create a backup only (replace) task sequence -3. Right-click the **Other** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: +1. In Deployment Workbench, under the **MDT Production** deployment share, select the **Task Sequences** node and create a new folder named **Other**. - * Task sequence ID: REPLACE-001 - * Task sequence name: Backup Only Task Sequence - * Task sequence comments: Run USMT to back up user data and settings - * Template: Standard Client Replace Task Sequence +2. Right-click the **Other** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: -4. In the **Other** folder, double-click **Backup Only Task Sequence**, and then in the **Task Sequence** tab, review the sequence. Notice that it only contains a subset of the normal client task sequence actions. + - Task sequence ID: REPLACE-001 + - Task sequence name: Backup Only Task Sequence + - Task sequence comments: Run USMT to back up user data and settings + - Template: Standard Client Replace Task Sequence + +3. In the **Other** folder, double-click **Backup Only Task Sequence**, and then in the **Task Sequence** tab, review the sequence. Notice that it only contains a subset of the normal client task sequence actions. ![The Backup Only Task Sequence action list.](../images/mdt-03-fig02.png "The Backup Only Task Sequence action list") @@ -77,36 +82,39 @@ On **MDT01**: During a computer replace, the following are the high-level steps that occur: -1. On the computer you're replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Windows Imaging (WIM) backup. -2. On the new computer, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. +1. On the computer you're replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Windows Imaging (WIM) backup. + +2. On the new computer, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. ### Run the replace task sequence On **PC0002**: -1. Sign in as **CONTOSO\\Administrator** and verify that you have write access to the **\\\\MDT01\\MigData$** share. -2. Run **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**. -3. Complete the Windows Deployment Wizard using the following settings: +1. Sign in as **CONTOSO\\Administrator** and verify that you have write access to the **\\\\MDT01\\MigData$** share. - 1. Select a task sequence to execute on this computer: Backup Only Task Sequence - * Specify where to save your data and settings: Specify a location - * Location: \\\\MDT01\\MigData$\\PC0002 - - >[!NOTE] - >If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead. - - 2. Specify where to save a complete computer backup: Don't back up the existing computer +2. Run **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**. + +3. Complete the **Windows Deployment Wizard** using the following settings: + + - **Select a task sequence to execute on this computer**: Backup Only Task Sequence + + - **Specify where to save your data and settings**: Specify a location + + - **Location**: \\\\MDT01\\MigData$\\PC0002 + + > [!NOTE] + > If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead. + + - **Specify where to save a complete computer backup**: Don't back up the existing computer The task sequence will now run USMT (Scanstate.exe) to capture user data and settings of the computer. ![The new task sequence.](../images/mdt-03-fig03.png "The new task sequence") - The new task sequence running the Capture User State action on PC0002. -4. On **MDT01**, verify that you have a USMT.MIG compressed backup file in the **D:\\MigData\\PC0002\\USMT** folder. +4. On **MDT01**, verify that you have a USMT.MIG compressed backup file in the **D:\\MigData\\PC0002\\USMT** folder. ![The USMT backup.](../images/mdt-03-fig04.png "The USMT backup") - The USMT backup of PC0002. ### Deploy the replacement computer @@ -115,37 +123,37 @@ To demonstrate deployment of the replacement computer, HV01 is used to host a vi On **HV01**: -1. Create a virtual machine with the following settings: +1. Create a virtual machine with the following settings: - * Name: PC0007 - * Location: C:\\VMs - * Generation: 2 - * Memory: 2048 MB - * Hard disk: 60 GB (dynamic disk) - * Install an operating system from a network-based installation server + - **Name**: PC0007 + - **Location**: C:\\VMs + - **Generation**: 2 + - **Memory**: 2048 MB + - **Hard disk**: 60 GB (dynamic disk) + - Install an operating system from a network-based installation server -2. Start the PC0007 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from MDT01 (or MDT02 if at a remote site). +2. Start the PC0007 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from MDT01 (or MDT02 if at a remote site). ![The initial PXE boot process.](../images/mdt-03-fig05.png "The initial PXE boot process") The initial PXE boot process of PC0007. -3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: +3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: - * Select a task sequence to execute on this computer: - * Windows 10 Enterprise x64 RTM Custom Image - * Computer Name: PC0007 - * Move Data and Settings: Don't move user data and settings. - * User Data (Restore) > Specify a location: \\\\MDT01\\MigData$\\PC0002 - * Applications: Adobe > Install - Adobe Reader + - Select a task sequence to execute on this computer: + - Windows 10 Enterprise x64 RTM Custom Image + - **Computer Name**: PC0007 + - **Move Data and Settings**: Don't move user data and settings. + - **User Data (Restore)** > **Specify a location**: \\\\MDT01\\MigData$\\PC0002 + - **Applications**: Adobe > Install - Adobe Reader -4. Setup now starts and does the following actions: +4. Setup now starts and does the following actions: - * Partitions and formats the disk. - * Installs the Windows 10 Enterprise operating system. - * Installs the application. - * Updates the operating system via your local Windows Server Update Services (WSUS) server. - * Restores the USMT backup from PC0002. + - Partitions and formats the disk. + - Installs the Windows 10 Enterprise operating system. + - Installs the application. + - Updates the operating system via your local Windows Server Update Services (WSUS) server. + - Restores the USMT backup from PC0002. You can view progress of the process by clicking the Monitoring node in the Deployment Workbench on MDT01. @@ -153,9 +161,9 @@ You can view progress of the process by clicking the Monitoring node in the Depl ## Related articles -[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    -[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    -[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    -[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    -[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    -[Configure MDT settings](configure-mdt-settings.md) +- [Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) +- [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md) +- [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) +- [Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md index c4b88adeaf..b8460e77a7 100644 --- a/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md +++ b/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker.md @@ -10,7 +10,7 @@ author: frankroj ms.topic: article ms.custom: seo-marvel-mar2020 ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Set up MDT for BitLocker @@ -18,6 +18,7 @@ ms.date: 10/28/2022 This article will show you how to configure your environment for BitLocker, the disk volume encryption built into Windows 10 Enterprise and Windows 10 Pro, using MDT. BitLocker in Windows 10 has two requirements in regard to an operating system deployment: - A protector, which can either be stored in the Trusted Platform Module (TPM) chip, or stored as a password. Technically, you can also use a USB stick to store the protector, but it's not a practical approach as the USB stick can be lost or stolen. We, therefore, recommend that you instead use a TPM chip and/or a password. + - Multiple partitions on the hard drive. To configure your environment for BitLocker, you'll need to do the following actions: @@ -29,10 +30,8 @@ To configure your environment for BitLocker, you'll need to do the following act > [!NOTE] > Even though it is not a BitLocker requirement, we recommend configuring BitLocker to store the recovery password in Active Directory. For more information about this feature, see [Backing Up BitLocker and TPM Recovery Information to AD DS](/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds). -If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. - -> [!NOTE] -> Backing up TPM to Active Directory was supported only on Windows 10 version 1507 and 1511. +> +> If you have access to Microsoft BitLocker Administration and Monitoring (MBAM), which is part of Microsoft Desktop Optimization Pack (MDOP), you have additional management features for BitLocker. For the purposes of this article, we'll use DC01, a domain controller that is a member of the domain contoso.com for the fictitious Contoso Corporation. For more information on the setup for this article, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](./prepare-for-windows-deployment-with-mdt.md). @@ -54,18 +53,24 @@ The BitLocker Recovery information on a computer object in the contoso.com domai The BitLocker Drive Encryption Administration Utilities are added as features via Server Manager (or Windows PowerShell): 1. On DC01, log on as **CONTOSO\\Administrator**, and, using Server Manager, select **Add roles and features**. + 2. On the **Before you begin** page, select **Next**. + 3. On the **Select installation type** page, select **Role-based or feature-based installation**, and select **Next**. + 4. On the **Select destination server** page, select **DC01.contoso.com** and select **Next**. + 5. On the **Select server roles** page, select **Next**. + 6. On the **Select features** page, expand **Remote Server Administration Tools**, expand **Feature Administration Tools**, select the following features, and then select **Next**: + 1. BitLocker Drive Encryption Administration Utilities 2. BitLocker Drive Encryption Tools 3. BitLocker Recovery Password Viewer + 7. On the **Confirm installation selections** page, select **Install**, and then select **Close**. ![figure 3.](../images/mdt-09-fig03.png) - Selecting the BitLocker Drive Encryption Administration Utilities. ### Create the BitLocker Group Policy @@ -73,32 +78,41 @@ Selecting the BitLocker Drive Encryption Administration Utilities. Following these steps, you enable the backup of BitLocker and TPM recovery information to Active Directory. You also enable the policy for the TPM validation profile. 1. On DC01, using Group Policy Management, right-click the **Contoso** organizational unit (OU), and select **Create a GPO in this domain, and Link it here**. + 2. Assign the name **BitLocker Policy** to the new Group Policy. -3. Expand the **Contoso** OU, right-click the **BitLocker Policy**, and select **Edit**. Configure the following policy settings: - Computer Configuration / Policies / Administrative Templates / Windows Components / BitLocker Drive Encryption / Operating System Drives - 1. Enable the **Choose how BitLocker-protected operating system drives can be recovered** policy, and configure the following settings: - 1. Allow data recovery agent (default) - 2. Save BitLocker recovery information to Active Directory Domain Services (default) - 3. Don't enable BitLocker until recovery information is stored in AD DS for operating system drives - 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy. - 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy. + +3. Expand the **Contoso** OU, right-click the **BitLocker Policy**, and select **Edit**. Configure the following policy settings found under **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** + + 1. Enable the **Choose how BitLocker-protected operating system drives can be recovered** policy, and configure the following settings: + + - Allow data recovery agent (default) + - Save BitLocker recovery information to Active Directory Domain Services (default) + - Don't enable BitLocker until recovery information is stored in AD DS for operating system drives + + 2. Enable the **Configure TPM platform validation profile for BIOS-based firmware configurations** policy. + + 3. Enable the **Configure TPM platform validation profile for native UEFI firmware configurations** policy. > [!NOTE] -> If you consistently get the error "Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system." after encrypting a computer with BitLocker, you might have to change the various "Configure TPM platform validation profile" Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using. +> If you consistently get the error: +> +> **Windows BitLocker Drive Encryption Information. The system boot information has changed since BitLocker was enabled. You must supply a BitLocker recovery password to start this system.** +> +> after encrypting a computer with BitLocker, you might have to change the various **Configure TPM platform validation profile** Group Policies, as well. Whether or not you need to do this will depend on the hardware you are using. ### Set permissions in Active Directory for BitLocker In addition to the Group Policy created previously, you need to configure permissions in Active Directory to be able to store the TPM recovery information. In these steps, we assume you've downloaded the [Add-TPMSelfWriteACE.vbs script](https://raw.githubusercontent.com/DeploymentArtist/DF4/master/BitLocker%20and%20TPM/Add-TPMSelfWriteACE.vbs) to C:\\Setup\\Scripts on DC01. 1. On DC01, start an elevated PowerShell prompt (run as Administrator). + 2. Configure the permissions by running the following command: - ```dos - cscript C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs + ```cmd + cscript.exe C:\Setup\Scripts\Add-TPMSelfWriteACE.vbs ``` ![figure 4.](../images/mdt-09-fig04.png) - Running the Add-TPMSelfWriteACE.vbs script on DC01. ## Add BIOS configuration tools from Dell, HP, and Lenovo @@ -113,7 +127,7 @@ If you want to automate enabling the TPM chip as part of the deployment process, The HP tools are part of HP System Software Manager. The executable file from HP is named BiosConfigUtility.exe. This utility uses a configuration file for the BIOS settings. Here's a sample command to enable TPM and set a BIOS password using the BiosConfigUtility.exe tool: -```dos +```cmd BIOSConfigUtility.EXE /SetConfig:TPMEnable.REPSET /NewAdminPassword:Password1234 ``` @@ -135,7 +149,7 @@ Embedded Security Device Availability The Lenovo tools are a set of VBScripts available as part of the Lenovo BIOS Setup using Windows Management Instrumentation Deployment Guide. Lenovo also provides a separate download of the scripts. Here's a sample command to enable TPM using the Lenovo tools: -```dos +```cmd cscript.exe SetConfig.vbs SecurityChip Active ``` @@ -146,21 +160,24 @@ When configuring a task sequence to run any BitLocker tool, either directly or u In the following task sequence, we added five actions: - **Check TPM Status.** Runs the ZTICheckforTPM.wsf script to determine if TPM is enabled. Depending on the status, the script will set the TPMEnabled and TPMActivated properties to either true or false. + - **Configure BIOS for TPM.** Runs the vendor tools (in this case, HP, Dell, and Lenovo). To ensure this action is run only when necessary, add a condition so the action is run only when the TPM chip isn't already activated. Use the properties from the ZTICheckforTPM.wsf. > [!NOTE] > It is common for organizations to wrap these tools in scripts to get additional logging and error handling. - **Restart computer.** Self-explanatory, reboots the computer. + - **Check TPM Status.** Runs the ZTICheckforTPM.wsf script one more time. + - **Enable BitLocker.** Runs the built-in action to activate BitLocker. ## Related articles -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
    -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md)
    -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md)
    -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
    -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)
    -[Use web services in MDT](use-web-services-in-mdt.md)
    -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md index 39b4f39cc5..b9a293d1de 100644 --- a/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md +++ b/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment.md @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Simulate a Windows 10 deployment in a test environment @@ -19,7 +19,9 @@ This article will walk you through the process of creating a simulated environme ## Test environment - A Windows 10 client named **PC0001** will be used to simulate deployment. The client is joined to the contoso.com domain and has access to the Internet to required download tools and scripts. + - It's assumed that you've performed (at least) the following procedures so that you have an MDT service account and an MDT production deployment share: + - [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) - [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) - [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) @@ -29,6 +31,7 @@ This article will walk you through the process of creating a simulated environme On **PC0001**: 1. Sign as **contoso\\Administrator**. + 2. Copy the following to a PowerShell script named gather.ps1 and copy it to a directory named **C:\MDT** on PC0001. ```powershell @@ -48,15 +51,22 @@ On **PC0001**: ``` 3. Download and install the free [Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717) on PC0001 so that you have access to the Configuration Manager Trace (cmtrace.exe) tool. + 4. Using Local Users and Groups (lusrmgr.msc), add the **contoso\\MDT\_BA** user account to the local **Administrators** group. + 5. Sign off, and then sign on to PC0001 as **contoso\\MDT\_BA**. + 6. Open the **\\\\MDT01\\MDTProduction$\\Scripts** folder and copy the following files to **C:\\MDT**: - 1. ZTIDataAccess.vbs - 2. ZTIGather.wsf - 3. ZTIGather.xml - 4. ZTIUtility.vbs + + - ZTIDataAccess.vbs + - ZTIGather.wsf + - ZTIGather.xml + - ZTIUtility.vbs + 7. From the **\\\\MDT01\\MDTProduction$\\Control** folder, copy the CustomSettings.ini file to **C:\\MDT**. + 8. In the **C:\\MDT** folder, create a subfolder named **X64**. + 9. From the **\\\\MDT01\\MDTProduction$\\Tools\\X64** folder, copy the Microsoft.BDD.Utility.dll file to **C:\\MDT\\X64**. ![files.](../images/mdt-09-fig06.png) @@ -64,27 +74,30 @@ On **PC0001**: The C:\\MDT folder with the files added for the simulation environment. 10. Type the following at an elevated Windows PowerShell prompt: - ``` powershell + + ```powershell Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope Process -Force Set-Location C:\MDT .\Gather.ps1 ``` + When prompted, press **R** to run the gather script. 11. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder using CMTrace. - **Note** - Warnings or errors regarding the Wizard.hta are expected. If the log file looks okay, you're ready to try a real deployment. - + + > [!NOTE] + > Warnings or errors regarding the Wizard.hta are expected. If the log file looks okay, you're ready to try a real deployment. + ![ztigather.](../images/mdt-09-fig07.png) The ZTIGather.log file from PC0001. ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md)
    -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md)
    -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md)
    -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md)
    -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md)
    -[Use web services in MDT](use-web-services-in-mdt.md)
    -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md index f7438e3a79..83c7037743 100644 --- a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -9,76 +9,90 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Perform an in-place upgrade to Windows 10 with MDT -**Applies to** -- Windows 10 +**Applies to:** -The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. +- Windows 10 ->[!TIP] ->In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple. +The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. + +> [!TIP] +> In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple. In-place upgrade differs from [computer refresh](refresh-a-windows-7-computer-with-windows-10.md) in that you can't use a custom image to perform the in-place upgrade. In this article, we'll add a default Windows 10 image to the production deployment share specifically to perform an in-place upgrade. -Three computers are used in this article: DC01, MDT01, and PC0002. +Three computers are used in this article: DC01, MDT01, and PC0002. - DC01 is a domain controller for the contoso.com domain -- MDT01 is a domain member server +- MDT01 is a domain member server - PC0002 is a domain member computer running Windows 7 SP1, targeted for the Windows 10 upgrade ![computers.](../images/mdt-upgrade.png) - The computers used in this article. ->[!NOTE] ->For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). - +> [!NOTE] +> For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). +> >If you have already completed all the steps in [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 10 Enterprise x64 (full source)](#add-windows-10-enterprise-x64-full-source). ## Create the MDT production deployment share On **MDT01**: -1. Ensure you're signed on as: contoso\administrator. +1. Ensure you're signed on as **contoso\administrator**. + 2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. + 3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and select **Next**. + 4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and select **Next**. + 5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and select **Next**. + 6. On the **Options** page, accept the default settings and select **Next** twice, and then select **Finish**. + 7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. ## Add Windows 10 Enterprise x64 (full source) ->If you have already have a Windows 10 [reference image](create-a-windows-10-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section. +> [!NOTE] +> If you have already have a Windows 10 [reference image](create-a-windows-10-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section. On **MDT01**: 1. Sign in as contoso\\administrator and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. + 2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. + 3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. + 4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files - - Source directory: (location of your source files) - - Destination directory name: W10EX64RTM + - **Source directory**: (location of your source files) + - **Destination directory name**: `W10EX64RTM` + 5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. ## Create a task sequence to upgrade to Windows 10 Enterprise On **MDT01**: -1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, then create a folder named **Windows 10**. -2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: W10-X64-UPG - - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade - - Template: Standard Client Upgrade Task Sequence - - Select OS: Windows 10 Enterprise x64 RTM Default Image - - Specify Product Key: Don't specify a product key at this time - - Organization: Contoso - - Admin Password: Don't specify an Administrator password at this time +1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, then create a folder named **Windows 10**. + +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the **New Task Sequence Wizard**: + + - **Task sequence ID**: W10-X64-UPG + - **Task sequence name**: Windows 10 Enterprise x64 RTM Upgrade + - **Template**: Standard Client Upgrade Task Sequence + - **Select OS**: Windows 10 Enterprise x64 RTM Default Image + - **Specify Product Key**: Don't specify a product key at this time + - **Organization**: Contoso + - **Admin Password**: Don't specify an Administrator password at this time ## Perform the Windows 10 upgrade @@ -87,24 +101,24 @@ To initiate the in-place upgrade, perform the following steps on PC0002 (the dev On **PC0002**: 1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** -2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then select **Next**. + +2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then select **Next**. + 3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader + 4. On the **Ready** tab, select **Begin** to start the task sequence. - When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. + +When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. ![upgrade1.](../images/upgrademdt-fig5-winupgrade.png) -
    - ![upgrade2.](../images/mdt-upgrade-proc.png) -
    - ![upgrade3.](../images/mdt-post-upg.png) After the task sequence completes, the computer will be fully upgraded to Windows 10. ## Related articles -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
    -[Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/) +- [Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md) +- [Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/) diff --git a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md index f4fe3ef970..141bdd8589 100644 --- a/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt.md @@ -9,39 +9,50 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy +ms.date: 11/28/2022 --- # Use Orchestrator runbooks with MDT This article will show you how to integrate Microsoft System Center 2012 R2 Orchestrator with MDT to replace the existing web services that are used in deployment solutions. + MDT can integrate with System Center 2012 R2 Orchestrator, which is a component that ties the Microsoft System Center products together, as well as other products from both Microsoft and third-party vendors. The difference between using Orchestrator and "normal" web services, is that with Orchestrator you have a rich drag-and-drop style interface when building the solution, and little or no coding is required. ->[!Note] ->If you are licensed to use Orchestrator, we highly recommend that you start using it. To find out more about licensing options for System Center 2012 R2 and Orchestrator, visit the [System Center 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=619553) website. - -## Orchestrator terminology +> [!NOTE] +> If you are licensed to use Orchestrator, we highly recommend that you start using it. To find out more about licensing options for System Center 2012 R2 and Orchestrator, visit the [System Center 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=619553) website. + +## Orchestrator terminology Before diving into the core details, here's a quick course in Orchestrator terminology: -- **Orchestrator Server.** This is a server that executes runbooks. -- **Runbooks.** A runbook is similar to a task sequence; it's a series of instructions based on conditions. Runbooks consist of workflow activities; an activity could be Copy File, Get User from Active Directory, or even Write to Database. -- **Orchestrator Designer.** This is where you build the runbooks. In brief, you do that by creating an empty runbook, dragging in the activities you need, and then connecting them in a workflow with conditions and subscriptions. -- **Subscriptions.** These are variables that come from an earlier activity in the runbook. So if you first execute an activity in which you type in a computer name, you can then subscribe to that value in the next activity. All these variables are accumulated during the execution of the runbook. -- **Orchestrator Console.** This is the Microsoft Silverlight-based web page you can use interactively to execute runbooks. The console listens to TCP port 81 by default. -- **Orchestrator web services.** These are the web services you use in the Microsoft Deployment Toolkit to execute runbooks during deployment. The web services listen to TCP port 82 by default. -- **Integration packs.** These provide additional workflow activities you can import to integrate with other products or solutions, like the rest of Active Directory, other System Center 2012 R2 products, or Microsoft Exchange Server, to name a few. -**Note** -To find and download additional integration packs, see [Integration Packs for System Center 2012 - Orchestrator](/previous-versions/system-center/packs/hh295851(v=technet.10)). +- **Orchestrator Server**: This is a server that executes runbooks. + +- **Runbooks**: A runbook is similar to a task sequence; it's a series of instructions based on conditions. Runbooks consist of workflow activities; an activity could be Copy File, Get User from Active Directory, or even Write to Database. + +- **Orchestrator Designer**: This is where you build the runbooks. In brief, you do that by creating an empty runbook, dragging in the activities you need, and then connecting them in a workflow with conditions and subscriptions. + +- **Subscriptions**: These are variables that come from an earlier activity in the runbook. So if you first execute an activity in which you type in a computer name, you can then subscribe to that value in the next activity. All these variables are accumulated during the execution of the runbook. + +- **Orchestrator Console**: This is the Microsoft Silverlight-based web page you can use interactively to execute runbooks. The console listens to TCP port 81 by default. + +- **Orchestrator web services**: These are the web services you use in the Microsoft Deployment Toolkit to execute runbooks during deployment. The web services listen to TCP port 82 by default. + +- **Integration packs**: These provide additional workflow activities you can import to integrate with other products or solutions, like the rest of Active Directory, other System Center 2012 R2 products, or Microsoft Exchange Server, to name a few. + +> [!NOTE] +> To find and download additional integration packs, see [Integration Packs for System Center 2012 - Orchestrator](/previous-versions/system-center/packs/hh295851(v=technet.10)). -## Create a sample runbook +## Create a sample runbook This section assumes you have Orchestrator 2012 R2 installed on a server named OR01. In this section, you create a sample runbook, which is used to log some of the MDT deployment information into a text file on OR01. 1. On OR01, using File Explorer, create the **E:\\Logfile** folder, and grant Users modify permissions (NTFS). + 2. In the **E:\\Logfile** folder, create the DeployLog.txt file. - **Note** - Make sure File Explorer is configured to show known file extensions so the file isn't named DeployLog.txt.txt. - + + > [!NOTE] + > Make sure File Explorer is configured to show known file extensions so the file isn't named DeployLog.txt.txt. + ![figure 23.](../images/mdt-09-fig23.png) Figure 23. The DeployLog.txt file. @@ -53,11 +64,16 @@ This section assumes you have Orchestrator 2012 R2 installed on a server named O Figure 24. Folder created in the Runbooks node. 4. In the **Runbooks** node, right-click the **1.0 MDT** folder, and select **New / Runbook**. + 5. On the ribbon bar, select **Check Out**. + 6. Right-click the **New Runbook** label, select **Rename**, and assign the name **MDT Sample**. + 7. Add (using a drag-and-drop operation) the following items from the **Activities** list to the middle pane: - 1. Runbook Control / Initialize Data - 2. Text File Management / Append Line + + - Runbook Control / Initialize Data + - Text File Management / Append Line + 8. Connect **Initialize Data** to **Append Line**. ![figure 25.](../images/mdt-09-fig25.png) @@ -65,6 +81,7 @@ This section assumes you have Orchestrator 2012 R2 installed on a server named O Figure 25. Activities added and connected. 9. Right-click the **Initialize Data** activity, and select **Properties** + 10. On **the Initialize Data Properties** page, select **Add**, change **Parameter 1** to **OSDComputerName**, and then select **Finish**. ![figure 26.](../images/mdt-09-fig26.png) @@ -72,8 +89,11 @@ This section assumes you have Orchestrator 2012 R2 installed on a server named O Figure 26. The Initialize Data Properties window. 11. Right-click the **Append Line** activity, and select **Properties**. + 12. On the **Append Line Properties** page, in the **File** text box, type **E:\\Logfile\\DeployLog.txt**. + 13. In the **File** encoding drop-down list, select **ASCII**. + 14. In the **Append** area, right-click inside the **Text** text box and select **Expand**. ![figure 27.](../images/mdt-09-fig27.png) @@ -87,7 +107,9 @@ This section assumes you have Orchestrator 2012 R2 installed on a server named O Figure 28. Subscribing to data. 16. In the **Published Data** window, select the **OSDComputerName** item, and select **OK**. + 17. After the **{OSDComputerName from "Initialize Data"}** text, type in **has been deployed at** and, once again, right-click and select **Subscribe / Published Data**. + 18. In the **Published Data** window, select the **Show common Published Data** check box, select the **Activity end time** item, and select **OK**. ![figure 29.](../images/mdt-09-fig29.png) @@ -95,14 +117,21 @@ This section assumes you have Orchestrator 2012 R2 installed on a server named O Figure 29. The expanded text box after all subscriptions have been added. 19. On the **Append Line Properties** page, select **Finish**. - ## Test the demo MDT runbook - After the runbook is created, you're ready to test it. -20. On the ribbon bar, select **Runbook Tester**. -21. Select **Run**, and in the **Initialize Data Parameters** dialog box, use the following setting and then select **OK**: - - OSDComputerName: PC0010 -22. Verify that all activities are green (for more information, see each target). -23. Close the **Runbook Tester**. -24. On the ribbon bar, select **Check In**. +## Test the demo MDT runbook + +After the runbook is created, you're ready to test it. + +1. On the ribbon bar, select **Runbook Tester**. + +2. Select **Run**, and in the **Initialize Data Parameters** dialog box, use the following setting and then select **OK**: + + - **OSDComputerName**: PC0010 + +3. Verify that all activities are green (for more information, see each target). + +4. Close the **Runbook Tester**. + +5. On the ribbon bar, select **Check In**. ![figure 30.](../images/mdt-09-fig30.png) @@ -110,23 +139,33 @@ Figure 30. All tests completed. ## Use the MDT demo runbook from MDT -1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node, and create a folder named **Orchestrator**. -2. Right-click the **Orchestrator** node, and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - 1. Task sequence ID: OR001 - 2. Task sequence name: Orchestrator Sample - 3. Task sequence comments: <blank> - 4. Template: Custom Task Sequence -3. In the **Orchestrator** node, double-click the **Orchestrator Sample** task sequence, and then select the **Task Sequence** tab. -4. Remove the default **Application Install** action. -5. Add a **Gather** action and select the **Gather only local data (do not process rules)** option. -6. After the **Gather** action, add a **Set Task Sequence Variable** action with the following settings: - 1. Name: Set Task Sequence Variable - 2. Task Sequence Variable: OSDComputerName - 3. Value: %hostname% -7. After the **Set Task Sequence Variable** action, add a new **Execute Orchestrator Runbook** action with the following settings: - 1. Orchestrator Server: OR01.contoso.com - 2. Use Browse to select **1.0 MDT / MDT Sample**. -8. Select **OK**. +1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, select the **Task Sequences** node, and create a folder named **Orchestrator**. + +2. Right-click the **Orchestrator** node, and select **New Task Sequence**. Use the following settings for the **New Task Sequence Wizard**: + + - **Task sequence ID**: OR001 + - **Task sequence name**: Orchestrator Sample + - **Task sequence comments**: *\* + - **Template**: Custom Task Sequence + +3. In the **Orchestrator** node, double-click the **Orchestrator Sample** task sequence, and then select the **Task Sequence** tab. + +4. Remove the default **Application Install** action. + +5. Add a **Gather** action and select the **Gather only local data (do not process rules)** option. + +6. After the **Gather** action, add a **Set Task Sequence Variable** action with the following settings: + + - **Name**: Set Task Sequence Variable + - **Task Sequence Variable**: OSDComputerName + - **Value**: %hostname% + +7. After the **Set Task Sequence Variable** action, add a new **Execute Orchestrator Runbook** action with the following settings: + + - **Orchestrator Server**: OR01.contoso.com + - Use **Browse** to select **1.0 MDT / MDT Sample**. + +8. Select **OK**. ![figure 31.](../images/mdt-09-fig31.png) @@ -135,22 +174,29 @@ Figure 31. The ready-made task sequence. ## Run the orchestrator sample task sequence Since this task sequence just starts a runbook, you can test the task sequence on the PC0001 client that you used for the MDT simulation environment. -**Note** -Make sure the account you're using has permissions to run runbooks on the Orchestrator server. For more information about runbook permissions, see [Runbook Permissions](/previous-versions/system-center/system-center-2012-R2/hh403774(v=sc.12)). - -1. On PC0001, log on as **CONTOSO\\MDT\_BA**. -2. Using an elevated command prompt (run as Administrator), type the following command: - ``` syntax - cscript \\MDT01\MDTProduction$\Scripts\Litetouch.vbs +> [!NOTE] +> Make sure the account you're using has permissions to run runbooks on the Orchestrator server. For more information about runbook permissions, see [Runbook Permissions](/previous-versions/system-center/system-center-2012-R2/hh403774(v=sc.12)). + +1. On PC0001, log on as **CONTOSO\\MDT\_BA**. + +2. Using an elevated command prompt (run as Administrator), type the following command: + + ```cmd + cscript.exe \\MDT01\MDTProduction$\Scripts\Litetouch.vbs ``` -3. Complete the Windows Deployment Wizard using the following information: - 1. Task Sequence: Orchestrator Sample - 2. Credentials: - 1. User Name: MDT\_BA - 2. Password: P@ssw0rd - 3. Domain: CONTOSO -4. Wait until the task sequence is completed and then verify that the DeployLog.txt file in the E:\\Logfile folder on OR01 was updated. + +3. Complete the **Windows Deployment Wizard** using the following information: + + 1. **Task Sequence**: Orchestrator Sample + + 2. **Credentials**: + + - **User Name**: MDT\_BA + - **Password**: P@ssw0rd + - **Domain**: CONTOSO + +4. Wait until the task sequence is completed and then verify that the DeployLog.txt file in the E:\\Logfile folder on OR01 was updated. ![figure 32.](../images/mdt-09-fig32.png) @@ -158,16 +204,10 @@ Figure 32. The ready-made task sequence. ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md index f4d4812ffe..61bd481d35 100644 --- a/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md +++ b/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information.md @@ -9,69 +9,81 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Use the MDT database to stage Windows 10 deployment information This article is designed to teach you how to use the MDT database to pre-stage information on your Windows 10 deployment in a Microsoft SQL Server 2012 SP1 Express database, rather than include the information in a text file (CustomSettings.ini). You can use this process, for example, to add the client machines you want to deploy, specify their computer names and IP addresses, indicate applications to be deployed, and determine many more settings for the machines. -## Database prerequisites +## Database prerequisites MDT can use either SQL Server Express or full SQL Server. However, since the deployment database isn't large, even in large enterprise environments, we recommend using the free SQL Server 2012 SP1 Express database in your environment. ->[!NOTE] ->Be sure to enable Named Pipes when configuring the SQL Server 2012 SP1 Express database. Although it is a legacy protocol, Named Pipes has proven to work well when connecting from Windows Preinstallation Environment (Windows PE) to the SQL Server database. - -## Create the deployment database +> [!NOTE] +> Be sure to enable Named Pipes when configuring the SQL Server 2012 SP1 Express database. Although it is a legacy protocol, Named Pipes has proven to work well when connecting from Windows Preinstallation Environment (Windows PE) to the SQL Server database. + +## Create the deployment database The MDT database is by default created and managed from the Deployment Workbench. In these steps, we assume you have installed SQL Server 2012 SP1 Express on MDT01. ->[!NOTE] ->Since SQL Server 2012 SP1 Express runs by default on a separate instance (SQLEXPRESS), the SQL Server Browser service must be running, and the firewall configured to allow traffic to it. Port 1433 TCP and port 1434 UDP need to be opened for inbound traffic on MDT01. - -1. On MDT01, using Deployment Workbench, expand the MDT Production deployment share, expand **Advanced Configuration**, right-click **Database**, and select **New Database**. -2. In the New DB Wizard, on the **SQL Server Details** page, enter the following settings and select **Next**: - 1. SQL Server Name: MDT01 - 2. Instance: SQLEXPRESS - 3. Port: <blank> - 4. Network Library: Named Pipes -3. On the **Database** page, select **Create a new database**; in the **Database** field, type **MDT** and select **Next**. -4. On the **SQL Share** page, in the **SQL Share** field, type **Logs$** and select **Next**. Select **Next** again and then select **Finish**. +> [!NOTE] +> Since SQL Server 2012 SP1 Express runs by default on a separate instance (SQLEXPRESS), the SQL Server Browser service must be running, and the firewall configured to allow traffic to it. Port 1433 TCP and port 1434 UDP need to be opened for inbound traffic on MDT01. + +1. On MDT01, using Deployment Workbench, expand the MDT Production deployment share, expand **Advanced Configuration**, right-click **Database**, and select **New Database**. + +2. In the New DB Wizard, on the **SQL Server Details** page, enter the following settings and select **Next**: + + 1. SQL Server Name: MDT01 + 2. Instance: SQLEXPRESS + 3. Port: <blank> + 4. Network Library: Named Pipes + +3. On the **Database** page, select **Create a new database**; in the **Database** field, type **MDT** and select **Next**. + +4. On the **SQL Share** page, in the **SQL Share** field, type **Logs$** and select **Next**. Select **Next** again and then select **Finish**. ![figure 8.](../images/mdt-09-fig08.png) Figure 8. The MDT database added to MDT01. -## Configure database permissions +## Configure database permissions After creating the database, you need to assign permissions to it. In MDT, the account you used to run the deployment is used to access the database. In this environment, the network access account is MDT\_BA. -1. On MDT01, start SQL Server Management Studio. -2. In the **Connect to Server** dialog box, in the **Server name** list, select **MDT01\\SQLEXPRESS** and select **Connect**. -3. In the **Object Explorer** pane, expand the top-level **Security** node, right-click **Logins**, and select **New Login**. + +1. On MDT01, start SQL Server Management Studio. + +2. In the **Connect to Server** dialog box, in the **Server name** list, select **MDT01\\SQLEXPRESS** and select **Connect**. + +3. In the **Object Explorer** pane, expand the top-level **Security** node, right-click **Logins**, and select **New Login**. ![figure 9.](../images/mdt-09-fig09.png) Figure 9. The top-level Security node. -4. On the **Login - New** page, next to the **Login** name field, select **Search**, and search for **CONTOSO\\MDT\_BA**. Then in the left pane, select **User Mapping**. Select the **MDT** database, and assign the following roles: - 1. db\_datareader - 2. db\_datawriter - 3. public (default) -5. Select **OK**, and close SQL Server Management Studio. +4. On the **Login - New** page, next to the **Login** name field, select **Search**, and search for **CONTOSO\\MDT\_BA**. Then in the left pane, select **User Mapping**. Select the **MDT** database, and assign the following roles: + + 1. db\_datareader + 2. db\_datawriter + 3. public (default) + +5. Select **OK**, and close SQL Server Management Studio. ![figure 10.](../images/mdt-09-fig10.png) Figure 10. Creating the login and settings permissions to the MDT database. -## Create an entry in the database +## Create an entry in the database To start using the database, you add a computer entry and assign a description and computer name. Use the computer's MAC Address as the identifier. -1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration**, and expand **Database**. -2. Right-click **Computers**, select **New**, and add a computer entry with the following settings: - 1. Description: New York Site - PC00075 - 2. MacAddress: <PC00075 MAC Address in the 00:00:00:00:00:00 format> - 3. Details Tab / OSDComputerName: PC00075 + +1. On MDT01, using the Deployment Workbench, in the MDT Production deployment share, expand **Advanced Configuration**, and expand **Database**. + +2. Right-click **Computers**, select **New**, and add a computer entry with the following settings: + + 1. Description: New York Site - PC00075 + 2. MacAddress: <PC00075 MAC Address in the 00:00:00:00:00:00 format> + 3. Details Tab / OSDComputerName: PC00075 ![figure 11.](../images/mdt-09-fig11.png) @@ -79,16 +91,10 @@ Figure 11. Adding the PC00075 computer to the database. ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use web services in MDT](use-web-services-in-mdt.md) - -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use web services in MDT](use-web-services-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) diff --git a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md index 9c9f75a03e..3f9a73aaa4 100644 --- a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: frankroj ms.topic: article ms.technology: itpro-deploy -ms.date: 10/28/2022 +ms.date: 11/28/2022 --- # Use web services in MDT @@ -17,79 +17,96 @@ ms.date: 10/28/2022 In this article, you'll learn how to create a simple web service that generates computer names and then configure MDT to use that service during your Windows 10 deployment. Web services provide a powerful way to assign settings during a deployment. Web services are web applications that run code on the server side, and MDT has built-in functions to call these web services. Using a web service in MDT is straightforward, but it does require that you've enabled the Web Server (IIS) role on the server. Developing web services involves some coding, but for most web services used with MDT, you can use the free Microsoft Visual Studio Express 2013 for Web. -## Create a sample web service +## Create a sample web service In these steps, we assume you have installed Microsoft Visual Studio Express 2013 for Web on PC0001 (the Windows 10 client) and downloaded the [MDT Sample Web Service](https://www.microsoft.com/download/details.aspx?id=42516) from the Microsoft Download Center and extracted it to C:\\Projects. -1. On PC0001, using Visual Studio Express 2013 for Web, open the C:\\Projects\\MDTSample\\ MDTSample.sln solution file. -2. On the ribbon bar, verify that Release is selected. -3. In the **Debug** menu, select the **Build MDTSample** action. -4. On MDT01, create a folder structure for **E:\\MDTSample\\bin**. -5. From PC0001, copy the C:\\Projects\\MDTSample\\obj\\Release\\MDTSample.dll file to the **E:\\MDTSample\\bin** folder on MDT01. -6. From PC0001, copy the following files from C:\\Projects\\MDTSample file to the **E:\\MDTSample** folder on MDT01: - 1. Web.config - 2. mdtsample.asmx -![figure 15.](../images/mdt-09-fig15.png) +1. On PC0001, using Visual Studio Express 2013 for Web, open the C:\\Projects\\MDTSample\\ MDTSample.sln solution file. -Figure 15. The sample project in Microsoft Visual Studio Express 2013 for Web. +2. On the ribbon bar, verify that Release is selected. -## Create an application pool for the web service +3. In the **Debug** menu, select the **Build MDTSample** action. + +4. On MDT01, create a folder structure for **E:\\MDTSample\\bin**. + +5. From PC0001, copy the C:\\Projects\\MDTSample\\obj\\Release\\MDTSample.dll file to the **E:\\MDTSample\\bin** folder on MDT01. + +6. From PC0001, copy the following files from C:\\Projects\\MDTSample file to the **E:\\MDTSample** folder on MDT01: + + - Web.config + - mdtsample.asmx + + ![figure 15.](../images/mdt-09-fig15.png) + + Figure 15. The sample project in Microsoft Visual Studio Express 2013 for Web. + +## Create an application pool for the web service This section assumes that you've enabled the Web Server (IIS) role on MDT01. -1. On MDT01, using Server Manager, install the **IIS Management Console** role (available under Web Server (IIS) / Management Tools). -2. Using Internet Information Services (IIS) Manager, expand the **MDT01 (CONTOSO\\Administrator)** node. If prompted with the **Do you want to get started with Microsoft Web Platform?** question, select the **Do not show this message** check box and then select **No**. -3. Right-click **Application Pools**, select **Add Application Pool**, and configure the new application pool with the following settings: - 1. Name: MDTSample - 2. .NET Framework version: .NET Framework 4.0.30319 - 3. Manage pipeline mode: Integrated - 4. Select the **Start application pool immediately** check box. - 5. Select **OK**. -![figure 16.](../images/mdt-09-fig16.png) +1. On MDT01, using Server Manager, install the **IIS Management Console** role (available under Web Server (IIS) / Management Tools). -Figure 16. The new MDTSample application. +2. Using Internet Information Services (IIS) Manager, expand the **MDT01 (CONTOSO\\Administrator)** node. If prompted with the **Do you want to get started with Microsoft Web Platform?** question, select the **Do not show this message** check box and then select **No**. -## Install the web service +3. Right-click **Application Pools**, select **Add Application Pool**, and configure the new application pool with the following settings: -1. On MDT01, using Internet Information Services (IIS) Manager, expand **Sites**, right-click **Default Web Site**, and select **Add Application**. Use the following settings for the application: - 1. Alias: MDTSample - 2. Application pool: MDTSample - 3. Physical Path: E:\\MDTSample + - **Name**: MDTSample + - **.NET Framework version**: .NET Framework 4.0.30319 + - **Manage pipeline mode**: Integrated + - Select the **Start application pool immediately** check box. + - Select **OK**. + + ![figure 16.](../images/mdt-09-fig16.png) + + Figure 16. The new MDTSample application. + +## Install the web service + +1. On MDT01, using Internet Information Services (IIS) Manager, expand **Sites**, right-click **Default Web Site**, and select **Add Application**. Use the following settings for the application: + + - **Alias**: MDTSample + - **Application pool**: MDTSample + - **Physical Path**: E:\\MDTSample ![figure 17.](../images/mdt-09-fig17.png) Figure 17. Adding the MDTSample web application. -2. In the **Default Web Site** node, select the MDTSample web application, and in the right pane, double-click **Authentication**. Use the following settings for the **Authentication** dialog box: - 1. Anonymous Authentication: Enabled - 2. ASP.NET Impersonation: Disabled +2. In the **Default Web Site** node, select the MDTSample web application, and in the right pane, double-click **Authentication**. Use the following settings for the **Authentication** dialog box: -![figure 18.](../images/mdt-09-fig18.png) + - **Anonymous Authentication**: Enabled + - **ASP.NET Impersonation**: Disabled -Figure 18. Configuring Authentication for the MDTSample web service. + ![figure 18.](../images/mdt-09-fig18.png) -## Test the web service in Internet Explorer + Figure 18. Configuring Authentication for the MDTSample web service. -1. On PC0001, using Internet Explorer, navigate to: **http://MDT01/MDTSample/mdtsample.asmx**. -2. Select the **GetComputerName** link. +## Test the web service in Internet Explorer + +1. On PC0001, using Internet Explorer, navigate to: **`http://MDT01/MDTSample/mdtsample.asmx**`. + +2. Select the **GetComputerName** link. ![figure 19.](../images/mdt-09-fig19.png) Figure 19. The MDT Sample web service. -3. On the **GetComputerName** page, type in the following settings, and select **Invoke**: - 1. Model: Hewlett-Packard - 2. SerialNumber: 123456789 -![figure 20.](../images/mdt-09-fig20.png) +3. On the **GetComputerName** page, type in the following settings, and select **Invoke**: -Figure 20. The result from the MDT Sample web service. + - **Model**: Hewlett-Packard + - **SerialNumber**: 123456789 -## Test the web service in the MDT simulation environment + ![figure 20.](../images/mdt-09-fig20.png) + + Figure 20. The result from the MDT Sample web service. + +## Test the web service in the MDT simulation environment After verifying the web service using Internet Explorer, you're ready to do the same test in the MDT simulation environment. 1. On PC0001, edit the CustomSettings.ini file in the **C:\\MDT** folder to look like the following: - ``` + + ```ini [Settings] Priority=Default, GetComputerName [Default] @@ -99,35 +116,32 @@ After verifying the web service using Internet Explorer, you're ready to do the Parameters=Model,SerialNumber OSDComputerName=string ``` + ![figure 21.](../images/mdt-09-fig21.png) Figure 21. The updated CustomSettings.ini file. 2. Save the CustomSettings.ini file. + 3. Using an elevated Windows PowerShell prompt (run as Administrator), run the following commands. Press **Enter** after each command: - ``` + + ```powershell Set-Location C:\MDT .\Gather.ps1 ``` + 4. Review the ZTIGather.log in the **C:\\MININT\\SMSOSD\\OSDLOGS** folder. -![figure 22.](../images/mdt-09-fig22.png) + ![figure 22.](../images/mdt-09-fig22.png) -Figure 22. The OSDCOMPUTERNAME value obtained from the web service. + Figure 22. The OSDCOMPUTERNAME value obtained from the web service. ## Related articles -[Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) - -[Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) - -[Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) - -[Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) - -[Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) - -[Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) - -[Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) - +- [Set up MDT for BitLocker](set-up-mdt-for-bitlocker.md) +- [Configure MDT deployment share rules](configure-mdt-deployment-share-rules.md) +- [Configure MDT for UserExit scripts](configure-mdt-for-userexit-scripts.md) +- [Simulate a Windows 10 deployment in a test environment](simulate-a-windows-10-deployment-in-a-test-environment.md) +- [Use the MDT database to stage Windows 10 deployment information](use-the-mdt-database-to-stage-windows-10-deployment-information.md) +- [Assign applications using roles in MDT](assign-applications-using-roles-in-mdt.md) +- [Use Orchestrator runbooks with MDT](use-orchestrator-runbooks-with-mdt.md) From c3125585f2d3be17f21015f2d822fa77cfdb2d06 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 28 Nov 2022 20:38:08 -0500 Subject: [PATCH 063/324] Remove troubleshooting articles from USMT and BitLocker --- windows/deployment/TOC.yml | 29 +- windows/deployment/usmt/usmt-common-issues.md | 299 --------------- windows/deployment/usmt/usmt-return-codes.md | 339 ------------------ 3 files changed, 16 insertions(+), 651 deletions(-) delete mode 100644 windows/deployment/usmt/usmt-common-issues.md delete mode 100644 windows/deployment/usmt/usmt-return-codes.md diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 85b109b135..2adf338485 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -466,18 +466,6 @@ href: usmt/usmt-reroute-files-and-settings.md - name: Verify the Condition of a Compressed Migration Store href: usmt/verify-the-condition-of-a-compressed-migration-store.md - - name: USMT Troubleshooting - href: usmt/usmt-troubleshooting.md - - name: Common Issues - href: usmt/usmt-common-issues.md - - name: Frequently Asked Questions - href: usmt/usmt-faq.yml - - name: Log Files - href: usmt/usmt-log-files.md - - name: Return Codes - href: usmt/usmt-return-codes.md - - name: USMT Resources - href: usmt/usmt-resources.md - name: USMT Reference items: @@ -545,7 +533,22 @@ href: usmt/usmt-xml-elements-library.md - name: Offline Migration Reference href: usmt/offline-migration-reference.md - + + - name: Troubleshoot USMT + items: + - name: USMT Troubleshooting + href: usmt/usmt-troubleshooting.md + - name: Common Issues + href: /troubleshoot/windows-client/deployment/usmt-common-issues + - name: Frequently Asked Questions + href: usmt/usmt-faq.yml + - name: Log Files + href: usmt/usmt-log-files.md + - name: Return Codes + href: /troubleshoot/windows-client/deployment/usmt-return-codes + - name: USMT Resources + href: usmt/usmt-resources.md + - name: Application Compatibility Toolkit (ACT) Technical Reference items: - name: SUA User's Guide diff --git a/windows/deployment/usmt/usmt-common-issues.md b/windows/deployment/usmt/usmt-common-issues.md deleted file mode 100644 index e5164ba2e5..0000000000 --- a/windows/deployment/usmt/usmt-common-issues.md +++ /dev/null @@ -1,299 +0,0 @@ ---- -title: Common Issues (Windows 10) -description: Learn about common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. -ms.reviewer: -manager: aaroncz -ms.author: frankroj -ms.prod: windows-client -ms.date: 11/01/2022 -author: frankroj -ms.topic: article -ms.technology: itpro-deploy ---- - -# Common issues - -The following sections discuss common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. USMT produces log files that describe in further detail any errors that occurred during the migration process. These logs can be used to troubleshoot migration failures. - -## General guidelines for identifying migration problems - -When you encounter a problem or error message during migration, you can use the following general guidelines to help determine the source of the problem: - -- Examine the **ScanState**, **LoadState**, and UsmtUtils logs to obtain the exact USMT error messages and Windows® application programming interface (API) error messages. For more information about USMT return codes and error messages, see [Return codes](usmt-return-codes.md). You can obtain more information about any listed **Windows** system error codes by typing in a command prompt window `net.exe helpmsg ` where ** is the error code number generated by the error message. For more information about System Error Codes, see [System Error Codes (0-499)](/windows/win32/debug/system-error-codes--0-499-). - - In most cases, the **ScanState** and **LoadState** logs indicate why a USMT migration is failing. We recommend that you use the `/v:5` option when testing your migration. This verbosity level can be adjusted in a production migration; however, reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a verbosity level higher than 5 if you want the log files output to go to a debugger. - - > [!NOTE] - > Running the **ScanState** and **LoadState** tools with the `/v:5` option creates a detailed log file. Although this option makes the log file large, the extra detail can help you determine where migration errors occurred. - -- Use the `/Verify` option with the UsmtUtils tool to determine whether any files in a compressed migration store are corrupted. For more information, see [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md). - -- Use the `/Extract` option with the UsmtUtils tool to extract files from a compressed migration store. For more information, see [Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md). - -- Create a progress log using the `/Progress` option to monitor your migration. - -- For the source and destination computers, obtain operating system information, and versions of applications such as Internet Explorer and any other relevant programs. Then verify the exact steps that are needed to reproduce the problem. This information might help you to understand what is wrong and to reproduce the issue in your testing environment. - -- Sign out after you run the **LoadState** tool. Some settings such as fonts, desktop backgrounds, and screen-saver settings won't take effect until the next time the end user logs on. - -- Close all applications before running **ScanState** or **LoadState** tools. If some applications are running during the **ScanState** or **LoadState** process, USMT might not migrate some data. For example, if Microsoft Outlook® is open, USMT might not migrate PST files. - - > [!NOTE] - > USMT will fail if it can't migrate a file or setting unless you specify the `/c` option. When you specify the `/c` option, USMT ignores errors. However, it logs an error when it encounters a file that is in use that didn't migrate. - -## User account problems - -The following sections describe common user account problems. Expand the section to see recommended solutions. - -### I'm having problems creating local accounts on the destination computer - -**Resolution:** For more information about creating accounts and migrating local accounts, see [Migrate user accounts](usmt-migrate-user-accounts.md). - -### Not all of the user accounts were migrated to the destination computer - -**Causes/Resolutions** There are two possible causes for this problem: - -When running the **ScanState** and LoadState tools on Windows 7, Windows 8, or Windows 10, you must run them in Administrator mode from an account with administrative credentials to ensure that all specified users are migrated. To run in Administrator mode: - -1. Select **Start** > **All Programs** > **Accessories**. - -2. Right-click **Command Prompt**. - -3. Select **Run as administrator**. - -4. Specify the `LoadState.exe` or `ScanState.exe` command. - -If you don't run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. - -Any user accounts on the computer that haven't been used won't be migrated. For example, if you add User1 to the computer, but User1 never logs on, then USMT won't migrate the User1 account. - -### User accounts that I excluded were migrated to the destination computer - -**Cause:** The command that you specified might have had conflicting `ui` and `/ue` options. If a user is specified with the `/ui` option and with either the `/ue` or `/uel` options at the same time, the user will be included in the migration. For example, if you specify `/ui:domain1\* /ue:domain1\user1`, then User1 will be migrated because the `/ui` option takes precedence. - -**Resolution:** For more information about how to use the `/ui` and `/ue` options together, see the examples in the [ScanState Syntax](usmt-scanstate-syntax.md) article. - -### I'm using the /uel option, but many accounts are still being included in the migration - -**Cause:** The `/uel` option depends on the last modified date of the users' NTUser.dat file. There are scenarios in which this last modified date might not match the users' last sign-in date. - -**Resolution:** This is a limitation of the `/uel` option. You might need to exclude these users manually with the `/ue` option. - -### The LoadState tool reports an error as return code 71 and fails to restore a user profile during a migration test - -**Cause:** During a migration test, if you run the **ScanState** tool on your test computer and then delete user profiles in order to test the **LoadState** tool on the same computer, you may have a conflicting key present in the registry. Using the **net use** command to remove a user profile will delete folders and files associated with that profile, but won't remove the registry key. - -**Resolution:** To delete a user profile, use the **User Accounts** item in Control Panel. To correct an incomplete deletion of a user profile: - -1. Open the registry editor by typing `regedit` at an elevated command prompt. - -2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`. - - Each user profile is stored in a System Identifier key under `ProfileList`. - -3. Delete the key for the user profile you're trying to remove. - -### Files that weren't encrypted before the migration are now encrypted with the account used to run the LoadState tool - -**Cause:** The **ScanState** tool was run using the `/EFS:copyraw` option to migrate encrypted files and Encrypting File System (EFS) certificates. The encryption attribute was set on a folder that was migrated, but the attribute was removed from file contents of that folder prior to migration. - -**Resolution:** Before using the **ScanState** tool for a migration that includes encrypted files and EFS certificates, you can run the Cipher tool at the command prompt to review and change encryption settings on files and folders. You must remove the encryption attribute from folders that contain unencrypted files or encrypt the contents of all files within an encrypted folder. - -To remove encryption from files that have already been migrated incorrectly, you must sign into the computer with the account that you used to run the **LoadState** tool and then remove the encryption from the affected files. - -### The LoadState tool reports an error as return code 71 and a Windows Error 2202 in the log file - -**Cause:** The computer name was changed during an offline migration of a local user profile. - -**Resolution:** You can use the `/mu` option when you run the **LoadState** tool to specify a new name for the user. For example, - -```cmd -LoadState.exe /i:MigApp.xml /i:MigDocs.xml \\server\share\migration\mystore -/progress:Progress.log /l:LoadState.log /mu:fareast\user1:farwest\user1 -``` - -## Command-line problems - -The following sections describe common command-line problems. Expand the section to see recommended solutions. - -### I received the following error message: "Usage Error: You can't specify a file path with any of the command-line options that exceeds 256 characters." - -**Cause:** You might receive this error message in some cases even if you don't specify a long store or file path, because the path length is calculated based on the absolute path. For example, if you run the ` **ScanState**.exe /o store` command from `C:\Program Files\USMT40`, then each character in "`C:\Program Files\USMT40`" will be added to the length of "store" to get the length of the path. - -**Resolution:** Ensure that the total path length doesn't exceed 256 characters. The total path length includes the store path plus the current directory. - -### I received the following error message: "USMT was unable to create the log file(s). Ensure that you have write access to the log directory." - -**Cause:** If you're running the **ScanState** or **LoadState** tools from a shared network resource, you'll receive this error message if you don't specify `/l`. - -**Resolution:** To fix this issue in this scenario, specify the `/l:ScanState.log` or `/l:LoadState.log` option. - -## XML file problems - -The following sections describe common XML file problems. Expand the section to see recommended solutions. - -### I used the `/genconfig` option to create a `Config.xml` file, but I see only a few applications and components that are in `MigApp.xml`. Why does `Config.xml` not contain all of the same applications? - -**Cause:** `Config.xml` will contain only operating system components, applications, and the user document sections that are in both of the .xml files and are installed on the computer when you run the `/genconfig` option. Otherwise, these applications and components won't appear in the `Config.xml` file. - -**Resolution:** Install all of the desired applications on the computer before running the `/genconfig` option. Then run `ScanState.exe` with all of the .xml files. For example, run the following command: - -```cmd -ScanState.exe /genconfig:Config.xml /i:MigDocs.xml /i:MigApp.xml /v:5 /l:ScanState.log -``` - -### I'm having problems with a custom .xml file that I authored, and I can't verify that the syntax is correct - -**Resolution:** You can load the XML schema file `MigXML.xsd` into your XML authoring tool. `MigXML.xsd` is included with USMT. For examples, see the [Visual Studio Development Center](https://go.microsoft.com/fwlink/p/?LinkId=74513). Then, load your .xml file in the authoring tool to see if there's a syntax error. For more information about using the XML elements, see [USMT XML Reference](usmt-xml-reference.md). - -### I'm using a MigXML helper function, but the migration isn't working the way I expected it to. How do I troubleshoot this issue? - -**Cause:** Typically, this issue is caused by incorrect syntax used in a helper function. You receive a Success return code, but the files you wanted to migrate didn't get collected or applied, or weren't collected or applied in the way you expected. - -**Resolution:** You should search the **ScanState** or **LoadState** log for either the component name that contains the MigXML helper function, or the MigXML helper function title, so that you can locate the related warning in the log file. - -## Migration problems - -The following sections describe common migration problems. Expand the section to see recommended solutions. - -### Files that I specified to exclude are still being migrated - -**Cause:** There might be another rule that is including the files. If there's a more specific rule or a conflicting rule, the files will be included in the migration. - -**Resolution:** For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md) and the Diagnostic Log section in [Log Files](usmt-log-files.md). - -### I specified rules to move a folder to a specific location on the destination computer, but it hasn't migrated correctly - -**Cause:** There might be an error in the XML syntax. - -**Resolution:** You can use the USMT XML schema (`MigXML.xsd`) to write and validate migration .xml files. Also see the XML examples in the following articles: - -[Conflicts and precedence](usmt-conflicts-and-precedence.md) - -[Exclude files and settings](usmt-exclude-files-and-settings.md) - -[Reroute files and settings](usmt-reroute-files-and-settings.md) - -[Include files and settings](usmt-include-files-and-settings.md) - -[Custom XML examples](usmt-custom-xml-examples.md) - -### After LoadState completes, the new desktop background doesn't appear on the destination computer - -There are three typical causes for this issue. - -**Cause**: Some settings such as fonts, desktop backgrounds, and screen-saver settings aren't applied by **LoadState** until after the destination computer has been restarted. - -**Resolution:** To fix this issue, sign out, and then log back on to see the migrated desktop background. - - - -### I included `MigApp.xml` in the migration, but some `PST` files aren't migrating - -**Cause:** The `MigApp.xml` file migrates only the PST files that are linked to Outlook profiles. - -**Resolution:** To migrate PST files that aren't linked to Outlook profiles, you must create a separate migration rule to capture these files. - -### USMT doesn't migrate the Start layout - -**Description:** You're using USMT to migrate profiles from one installation of Windows 10 to another installation of Windows 10 on different hardware. After migration, the user signs in on the new device and doesn't have the Start menu layout they had previously configured. - -**Cause:** A code change in the Start Menu with Windows 10 version 1607 and later is incompatible with this USMT function. - -**Resolution:** The following workaround is available: - -1. With the user signed in, back up the Start layout using the following Windows PowerShell command. You can specify a different path if desired: - - ```powershell - Export-StartLayout -Path "C:\Layout\user1.xml" - ``` - -2. Migrate the user's profile with USMT. - -3. Before the user signs in on the new device, import the Start layout using the following Windows PowerShell command: - - ```powershell - Import-StartLayout -LayoutPath "C:\Layout\user1.xml" -MountPath %systemdrive% - ``` - -This workaround changes the Default user's Start layout. The workaround doesn't scale to a mass migrations or multiuser devices, but it can potentially unblock some scenarios. If other users will sign on to the device, you should delete layoutmodification.xml from the Default user profile. Otherwise, all users who sign on to that device will use the imported Start layout. - -## Offline migration problems - -The following sections describe common offline migration problems. Expand the section to see recommended solutions. - -### Some of my system settings don't migrate in an offline migration - -**Cause:** Some system settings, such as desktop backgrounds and network printers, aren't supported in an offline migration. For more information, see [What does USMT migrate?](usmt-what-does-usmt-migrate.md) - -**Resolution:** In an offline migration, these system settings must be restored manually. - -### The ScanState tool fails with return code 26 - -**Cause:** A common cause of return code 26 is that a temp profile is active on the source computer. This profile maps to c:\\users\\temp. The **ScanState** log shows a **MigStartupOfflineCaught** exception that includes the message **User profile duplicate SID error**. - -**Resolution:** You can reboot the computer to get rid of the temp profile or you can set **MIG_FAIL_ON_PROFILE_ERROR=0** to skip the error and exclude the temp profile. - -### Include and Exclude rules for migrating user profiles don't work the same offline as they do online - -**Cause:** When offline, the DNS server can't be queried to resolve the user name and SID mapping. - -**Resolution:** Use a Security Identifier (SID) to include a user when running the **ScanState** tool. For example: - -```cmd -ScanState.exe /ui:S1-5-21-124525095-708259637-1543119021* -``` - -The wild card (\*) at the end of the SID will migrate the *SID*\_Classes key as well. - -You can also use patterns for SIDs that identify generic users or groups. For example, you can use the `/ue:*-500` option to exclude the local administrator accounts. For more information about Windows SIDs, see [Security identifiers](/windows-server/identity/ad-ds/manage/understand-security-identifiers). - -### My script to wipe the disk fails after running the ScanState tool on a 64-bit system - -**Cause:** The HKLM registry hive isn't unloaded after the **ScanState** tool has finished running. - -**Resolution:** Reboot the computer or unload the registry hive at the command prompt after the **ScanState** tool has finished running. For example, at a command prompt, enter: - -```cmd -reg.exe unload hklm\$dest$software -``` - -## Hard-Link Migration Problems - -The following sections describe common hard-link migration problems. Expand the section to see recommended solutions. - -### EFS files aren't restored to the new partition - -**Cause:** EFS files can't be moved to a new partition with a hard link. The `/efs:hardlink` command-line option is only applicable to files migrated on the same partition. - -**Resolution:** Use the `/efs:copyraw` command-line option to copy EFS files during the migration instead of creating hard links, or manually copy the EFS files from the hard-link store. - -### The ScanState tool can't delete a previous hard-link migration store - -**Cause:** The migration store contains hard links to locked files. - -**Resolution:** Use the UsmtUtils tool to delete the store or change the store name. For example, at a command prompt, enter: - -```cmd -UsmtUtils.exe /rd -``` - -You should also reboot the machine. - -## Related articles - -[User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md) - -[Frequently asked questions](usmt-faq.yml) - -[Return codes](usmt-return-codes.md) - -[UsmtUtils syntax](usmt-utilities.md) diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md deleted file mode 100644 index c2fbd59cd6..0000000000 --- a/windows/deployment/usmt/usmt-return-codes.md +++ /dev/null @@ -1,339 +0,0 @@ ---- -title: Return Codes (Windows 10) -description: Learn about User State Migration Tool (USMT) 10.0 return codes and error messages. Also view a list of USMT return codes and their associated migration steps. -ms.reviewer: -manager: aaroncz -ms.author: frankroj -ms.prod: windows-client -author: frankroj -ms.date: 11/01/2022 -ms.topic: article -ms.technology: itpro-deploy ---- - -# Return codes - -This article describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this article provides tips to help you use the logfiles to determine why you received an error. - -Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). - -## USMT return codes - -If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. - -Return codes are grouped into the following broad categories that describe their area of error reporting: - -- Success or User Cancel - -- Invalid Command Lines - -- Setup and Initialization - -- Non-fatal Errors - -- Fatal Errors - -As a best practice, we recommend that you set verbosity level to 5, `v:5`, on the `ScanState.exe`, `LoadState.exe`, and `UsmtUtils.exe` command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. - -## USMT error messages - -Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **UsmtUtils** tool might return a code of **11** (for **USMT_INVALID_PARAMETERS**) and a related error message that reads **/key and /keyfile both specified**. The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **UsmtUtils** log files to help you determine why the return code was received. - -You can obtain more information about any listed **Windows** system error codes by typing in a command prompt window `net.exe helpmsg ` where ** is the error code number generated by the error message. For more information about System Error Codes, see [System Error Codes (0-499)](/windows/win32/debug/system-error-codes--0-499-). - -## Troubleshooting return codes and error messages - -The following information lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. - -### 0: USMT_SUCCESS - -- **Category**: Success or User Cancel - -| Error message | Troubleshooting, mitigation, workarounds | - | --- | --- | - | **Successful run** | NA | - -### 1: USMT_DISPLAY_HELP - -- **Category**: Success or User Cancel - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Command line help requested** | NA | - -### 2: USMT_STATUS_CANCELED - -- **Category**: Success or User Cancel - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Gather was aborted because of an EFS file** | NA | -| **User chose to cancel (such as pressing CTRL+C)** | NA | - -### 3: USMT_WOULD_HAVE_FAILED - -- **Category**: - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **At least one error was skipped as a result of /c.** | Review ScanState, LoadState, or UsmtUtils log for details about command-line errors. | - -### 11: USMT_INVALID_PARAMETERS - -- **Category**: Invalid Command Lines - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **/all conflicts with /ui, /ue or /uel** | Review ScanState log or LoadState log for details about command-line errors. | -| **/auto expects an optional parameter for the script folder** | Review ScanState log or LoadState log for details about command-line errors. | -| **/encrypt can't be used with /nocompress** | Review ScanState log or LoadState log for details about command-line errors. | -| **/encrypt requires /key or /keyfile** | Review ScanState log or LoadState log for details about command-line errors. | -| **/genconfig can't be used with most other options** | Review ScanState log or LoadState log for details about command-line errors. | -| **/genmigxml can't be used with most other options** | Review ScanState log or LoadState log for details about command-line errors. | -| **/hardlink requires /nocompress** | Review ScanState log or LoadState log for details about command-line errors. | -| **/key and /keyfile both specified** | Review ScanState log or LoadState log for details about command-line errors. | -| **/key or /keyfile used without enabling encryption** | Review ScanState log or LoadState log for details about command-line errors. | -| **/lae is only used with /lac** | Review ScanState log or LoadState log for details about command-line errors. | -| **/listfiles cannot be used with /p** | Review ScanState log or LoadState log for details about command-line errors. | -| **/offline requires a valid path to an XML file describing offline paths** | Review ScanState log or LoadState log for details about command-line errors. | -| **/offlinewindir requires a valid path to offline windows folder** | Review ScanState log or LoadState log for details about command-line errors. | -| **/offlinewinold requires a valid path to offline windows folder** | Review ScanState log or LoadState log for details about command-line errors. | -| **A command was already specified** | Verify that the command-line syntax is correct and that there are no duplicate commands. | -| **An option argument is missing** | Review ScanState log or LoadState log for details about command-line errors. | -| **An option is specified more than once and is ambiguous** | Review ScanState log or LoadState log for details about command-line errors. | -| **By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.** | Review ScanState log or LoadState log for details about command-line errors. | -| **Command line arguments are required. Specify /? for options.** | Review ScanState log or LoadState log for details about command-line errors. | -| **Command line option is not valid** | Review ScanState log or LoadState log for details about command-line errors. | -| **EFS parameter specified is not valid for /efs** | Review ScanState log or LoadState log for details about command-line errors. | -| **File argument is invalid for /genconfig** | Review ScanState log or LoadState log for details about command-line errors. | -| **File argument is invalid for /genmigxml** | Review ScanState log or LoadState log for details about command-line errors. | -| **Invalid space estimate path. Check the parameters and/or file system permissions** | Review ScanState log or LoadState log for details about command-line errors. | -| **List file path argument is invalid for /listfiles** | Review ScanState log or LoadState log for details about command-line errors. | -| **Retry argument must be an integer** | Review ScanState log or LoadState log for details about command-line errors. | -| **Settings store argument specified is invalid** | Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set. | -| **Specified encryption algorithm is not supported** | Review ScanState log or LoadState log for details about command-line errors. | -| **The /efs:hardlink requires /hardlink** | Review ScanState log or LoadState log for details about command-line errors. | -| **The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7** | Review ScanState log or LoadState log for details about command-line errors. | -| **The store parameter is required but not specified** | Review ScanState log or LoadState log for details about command-line errors. | -| **The source-to-target domain mapping is invalid for /md** | Review ScanState log or LoadState log for details about command-line errors. | -| **The source-to-target user account mapping is invalid for /mu** | Review ScanState log or LoadState log for details about command-line errors. | -| **Undefined or incomplete command line option** | Review ScanState log or LoadState log for details about command-line errors. | -| **Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate** | Review ScanState log or LoadState log for details about command-line errors. | -| **User exclusion argument is invalid** | Review ScanState log or LoadState log for details about command-line errors. | -| **Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)** | Review ScanState log or LoadState log for details about command-line errors. | -| **Volume shadow copy feature is not supported with a hardlink store** | Review ScanState log or LoadState log for details about command-line errors. | -| **Wait delay argument must be an integer** | Review ScanState log or LoadState log for details about command-line errors. | - -### 12: USMT_ERROR_OPTION_PARAM_TOO_LARGE - -- **Category**: Invalid Command Lines - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Command line arguments cannot exceed 256 characters** | Review ScanState log or LoadState log for details about command-line errors. | -| **Specified settings store path exceeds the maximum allowed length of 256 characters** | Review ScanState log or LoadState log for details about command-line errors. | - -### 13: USMT_INIT_LOGFILE_FAILED - -- **Category**: Invalid Command Lines - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Log path argument is invalid for /l** | When `/l` is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct. | - -### 14: USMT_ERROR_USE_LAC - -- **Category**: Invalid Command Lines - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Unable to create a local account because /lac was not specified** | When creating local accounts, the command-line options `/lac` and `/lae` should be used. | - -### 26: USMT_INIT_ERROR - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Multiple Windows installations found** | Listfiles.txt couldn't be created. Verify that the location you specified for the creation of this file is valid. | -| **Software malfunction or unknown exception** | Check all loaded .xml files for errors, common error when using `/i` to load the `Config.xml` file. | -| **Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries** | Verify that the offline input file is present and that it has valid entries. USMT couldn't find valid offline operating system. Verify your offline directory mapping. | - -### 27: USMT_INVALID_STORE_LOCATION - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **A store path can't be used because an existing store exists; specify /o to overwrite** | Specify `/o` to overwrite an existing intermediate or migration store. | -| **A store path is missing or has incomplete data** | Make sure that the store path is accessible and that the proper permission levels are set. | -| **An error occurred during store creation** | Make sure that the store path is accessible and that the proper permission levels are set. Specify `/o` to overwrite an existing intermediate or migration store. | -| **An inappropriate device such as a floppy disk was specified for the store** | Make sure that the store path is accessible and that the proper permission levels are set. | -| **Invalid store path; check the store parameter and/or file system permissions** | Invalid store path; check the store parameter and/or file system permissions. | -| **The file layout and/or file content is not recognized as a valid store** | Make sure that the store path is accessible and that the proper permission levels are set. Specify `/o` to overwrite an existing intermediate or migration store. | -| **The store path holds a store incompatible with the current USMT version** | Make sure that the store path is accessible and that the proper permission levels are set. | -| **The store save location is read-only or does not support a requested storage option** | Make sure that the store path is accessible and that the proper permission levels are set. | - -### 28: USMT_UNABLE_GET_SCRIPTFILES - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Script file is invalid for /i** | Check all specified migration .xml files for errors. This error is common when using `/i` to load the `Config.xml` file. | -| **Unable to find a script file specified by /i** | Verify the location of your script files, and ensure that the command-line options are correct. | - -### 29: USMT_FAILED_MIGSTARTUP - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **A minimum of 250 MB of free space is required for temporary files** | Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable `USMT_WORKING_DIR=` to redirect the temporary files working directory. | -| **Another process is preventing migration; only one migration tool can run at a time** | Check the ScanState log file for migration .xml file errors. | -| **Failed to start main processing, look in log for system errors or check the installation** | Check the ScanState log file for migration .xml file errors. | -| **Migration failed because of an XML error; look in the log for specific details** | Check the ScanState log file for migration .xml file errors. | -| **Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table** | Check the ScanState log file for migration .xml file errors. | - -### 31: USMT_UNABLE_FINDMIGUNITS - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **An error occurred during the discover phase; the log should have more specific information** | Check the ScanState log file for migration .xml file errors. | - -### 32: USMT_FAILED_SETMIGRATIONTYPE - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **An error occurred processing the migration system** | Check the ScanState log file for migration .xml file errors, or use online Help by typing `/?` on the command line. | - -### 33: USMT_UNABLE_READKEY - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Error accessing the file specified by the /keyfile parameter** | Check the ScanState log file for migration .xml file errors, or use online Help by typing `/?` on the command line. | -| **The encryption key must have at least one character** | Check the ScanState log file for migration .xml file errors, or use online Help by typing `/?` on the command line. | - -### 34: USMT_ERROR_INSUFFICIENT_RIGHTS - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Directory removal requires elevated privileges** | Sign in as Administrator, and run with elevated privileges. | -| **No rights to create user profiles; log in as Administrator; run with elevated privileges** | Sign in as Administrator, and run with elevated privileges. | -| **No rights to read or delete user profiles; log in as Administrator, run with elevated privileges** | Sign in as Administrator, and run with elevated privileges. | - -### 35: USMT_UNABLE_DELETE_STORE - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **A reboot is required to remove the store** | Reboot to delete any files that couldn't be deleted when the command was executed. | -| **A store path can't be used because it contains data that could not be overwritten** | A migration store couldn't be deleted. If you're using a hardlink migration store, you might have a locked file in it. You should manually delete the store, or use `UsmtUtils.exe /rd` command to delete the store. | -| **There was an error removing the store** | Review ScanState log or LoadState log for details about command-line errors. | - -### 36: USMT_ERROR_UNSUPPORTED_PLATFORM - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Compliance check failure; please check the logs for details** | Investigate whether there's an active temporary profile on the system. | -| **Use of /offline is not supported during apply** | The `/offline` command wasn't used while running in the Windows Preinstallation Environment (WinPE). | -| **Use /offline to run gather on this platform** | The `/offline` command wasn't used while running in WinPE. | - -### 37: USMT_ERROR_NO_INVALID_KEY - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **The store holds encrypted data but the correct encryption key was not provided** | Verify that the correct encryption key or keyfile was included with the `/key` or `/keyfile` option. | - -### 38: USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **An error occurred during store access** | Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set. | - -### 39: USMT_UNABLE_TO_READ_CONFIG_FILE - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Error reading Config.xml** | Review ScanState log or LoadState log for details about command-line errors in the `Config.xml` file. | -| **File argument is invalid for /config** | Check the command line you used to load the `Config.xml` file. You can use online Help by typing `/?` on the command line. | - -### 40: USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Error writing to the progress log** | The Progress log couldn't be created. Verify that the location is valid and that you have write access. | -| **Progress log argument is invalid for /progress** | The Progress log couldn't be created. Verify that the location is valid and that you have write access. | - -### 41: USMT_PREFLIGHT_FILE_CREATION_FAILED - -- **Category**: Setup and Initialization - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **Can't overwrite existing file** | The Progress log couldn't be created. Verify that the location is valid and that you have write access. | -| **Invalid space estimate path. Check the parameters and/or file system permissions** | Review ScanState log or LoadState log for details about command-line errors. | - -### 42: USMT_ERROR_CORRUPTED_STORE - -- **Category**: - -| Error message | The store contains one or more corrupted files | -| --- | --- | -| **The store holds encrypted data but the correct encryption key was not provided** | Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that aren't corrupted, see [Extract files from a compressed USMT migration store](usmt-extract-files-from-a-compressed-migration-store.md). | - -### 61: USMT_MIGRATION_STOPPED_NONFATAL - -- **Category**: Non-fatal Errors - -| Error message | The store contains one or more corrupted files | -| --- | --- | -| **Processing stopped due to an I/O error** | USMT exited but can continue with the `/c` command-line option, with the optional configurable **<ErrorControl>** section or by using the `/vsc` command-line option. | - -### 71: USMT_INIT_OPERATING_ENVIRONMENT_FAILED - -- **Category**: Fatal Errors - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **A Windows Win32 API error occurred** | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. | -| **An error occurred when attempting to initialize the diagnostic mechanisms such as the log** | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. | -| **Failed to record diagnostic information** | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. | -| **Unable to start. Make sure you are running USMT with elevated privileges** | Exit USMT and sign in again with elevated privileges. | - -### 72: USMT_UNABLE_DOMIGRATION - -- **Category**: Fatal Errors - -| Error message | Troubleshooting, mitigation, workarounds | -| --- | --- | -| **An error occurred closing the store** | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | -| **An error occurred in the apply process** | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | -| **An error occurred in the gather process** | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | -| **Out of disk space while writing the store** | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | -| **Out of temporary disk space on the local system** | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | - -## Related articles - -[User State Migration Tool (USMT) troubleshooting](usmt-troubleshooting.md) - -[USMT log files](usmt-log-files.md) From 7a115a04dffbbdd7d7685d6f8f870a26e6f65dae Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 28 Nov 2022 20:49:19 -0500 Subject: [PATCH 064/324] Remove troubleshooting articles from USMT and BitLocker 2 --- windows/deployment/TOC.yml | 8 ++++---- ...smt-extract-files-from-a-compressed-migration-store.md | 4 ++-- windows/deployment/usmt/usmt-test-your-migration.md | 2 +- windows/deployment/usmt/usmt-troubleshooting.md | 4 ++-- windows/deployment/usmt/usmt-utilities.md | 2 +- windows/deployment/usmt/usmt-what-does-usmt-migrate.md | 6 +++--- ...erify-the-condition-of-a-compressed-migration-store.md | 2 +- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 2adf338485..a99f1e18eb 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -538,13 +538,13 @@ items: - name: USMT Troubleshooting href: usmt/usmt-troubleshooting.md - - name: Common Issues + - name: USMT Common Issues href: /troubleshoot/windows-client/deployment/usmt-common-issues - - name: Frequently Asked Questions + - name: USMT Frequently Asked Questions href: usmt/usmt-faq.yml - - name: Log Files + - name: USMT Log Files href: usmt/usmt-log-files.md - - name: Return Codes + - name: USMT Return Codes href: /troubleshoot/windows-client/deployment/usmt-return-codes - name: USMT Resources href: usmt/usmt-resources.md diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md index f1a46e9c78..b5b02016d8 100644 --- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md @@ -25,7 +25,7 @@ Options used with the `/extract` option can specify: In addition, you can specify the file patterns that you want to extract by using the `/i` option to include file patterns or the `/e` option to exclude file patterns. When both the `/i` option and the `/e` option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the **ScanState** and **LoadState** tools. -### To run the UsmtUtils tool with the /extract option +## To run the UsmtUtils tool with the /extract option To extract files from the compressed migration store onto the destination computer, use the following UsmtUtils syntax: @@ -93,6 +93,6 @@ In this example, if there is a myProject.exe file, it will also be extracted bec [UsmtUtils syntax](usmt-utilities.md) -[Return codes](usmt-return-codes.md) +[Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes) [Verify the condition of a compressed migration store](verify-the-condition-of-a-compressed-migration-store.md) diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md index 19bd789bda..a26c2a25cd 100644 --- a/windows/deployment/usmt/usmt-test-your-migration.md +++ b/windows/deployment/usmt/usmt-test-your-migration.md @@ -17,7 +17,7 @@ Always test your migration plan in a controlled laboratory setting before you de After you've thoroughly tested the entire migration process on a single computer running each of your source operating systems, conduct a pilot migration with a small group of users. After migrating a few typical user states to the intermediate store, note the space required and adjust your initial calculations accordingly. For details about estimating the space needed for your migration, see [Estimate migration store size](usmt-estimate-migration-store-size.md). You might also need to adjust the registry-setting and file-location information in your migration-rule files. If you make changes, test the migration again. Then verify that all data and settings have migrated as expected. A pilot migration also gives you an opportunity to test your space estimates for the intermediate store. -If your test migration encounters any errors, examine the **ScanState** and **LoadState** logs to obtain the exact User State Migration Tool (USMT) 10.0 return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return codes](usmt-return-codes.md). You can obtain more information about any listed **Windows** system error codes by typing in a command prompt window `net.exe helpmsg ` where ** is the error code number generated by the error message. For more information about System Error Codes, see [System Error Codes (0-499)](/windows/win32/debug/system-error-codes--0-499-). +If your test migration encounters any errors, examine the **ScanState** and **LoadState** logs to obtain the exact User State Migration Tool (USMT) 10.0 return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes). You can obtain more information about any listed **Windows** system error codes by typing in a command prompt window `net.exe helpmsg ` where ** is the error code number generated by the error message. For more information about System Error Codes, see [System Error Codes (0-499)](/windows/win32/debug/system-error-codes--0-499-). In most cases, the **ScanState** and **LoadState** logs indicate why a USMT migration is failing. We recommend that you use the `/v:5` option when testing your migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a higher verbosity level if you want the log files output to go to a debugger. diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index e215207ede..ede8f237ec 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -19,10 +19,10 @@ The following table describes articles that address common User State Migration | Link | Description | |--- |--- | -|[Common Issues](usmt-common-issues.md)|Find troubleshooting solutions for common problems in USMT.| +|[Common Issues](/troubleshoot/windows-client/deployment/usmt-common-issues)|Find troubleshooting solutions for common problems in USMT.| |[Frequently Asked Questions](usmt-faq.yml)|Find answers to questions about how to use USMT.| |[Log Files](usmt-log-files.md)|Learn how to enable logging to help you troubleshoot issues in USMT.| -|[Return Codes](usmt-return-codes.md)|Learn how to use return codes to identify problems in USMT.| +|[Return Codes](/troubleshoot/windows-client/deployment/usmt-return-codes)|Learn how to use return codes to identify problems in USMT.| |[USMT Resources](usmt-resources.md)|Find more information and support for using USMT.| ## Related articles diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index 9568ca5337..cb67fc466b 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -97,4 +97,4 @@ Some examples of `/extract` commands: [User State Migration Tool (USMT) command-line syntax](usmt-command-line-syntax.md) -[Return codes](usmt-return-codes.md) +[Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes) diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index 9fac4ebca3..be20a22816 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -53,7 +53,7 @@ This section describes the user data that USMT migrates by default, using the `M - Favorites > [!IMPORTANT] - > Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](./usmt-common-issues.md#usmt-doesnt-migrate-the-start-layout). + > Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). - **Folders from the All Users and Public profiles.** When you specify the `MigUser.xml` file, USMT also migrates the following from the **Public** profile in Windows Vista, Windows 7, Windows 8, or Windows 10: @@ -209,7 +209,7 @@ When you specify the `MigApp.xml` file, USMT migrates the settings for the follo ## What USMT doesn't migrate -The following items are settings that USMT doesn't migrate. If you're having a problem that isn't listed here, see [Common issues](usmt-common-issues.md). +The following items are settings that USMT doesn't migrate. If you're having a problem that isn't listed here, see [Common issues](/troubleshoot/windows-client/deployment/usmt-common-issues). ### Application settings @@ -247,7 +247,7 @@ You should also note the following items: ### Start menu layout -Starting in Windows 10, version 1607 the USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](./usmt-common-issues.md#usmt-doesnt-migrate-the-start-layout). +Starting in Windows 10, version 1607 the USMT doesn't migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](/troubleshoot/windows-client/deployment/usmt-common-issues#usmt-doesnt-migrate-the-start-layout). ### User profiles from Active Directory to Azure Active Directory diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md index 2f004c83ff..60856e7a7e 100644 --- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md @@ -101,4 +101,4 @@ If the `/verify` option indicates that there are corrupted files in the migratio [UsmtUtils syntax](usmt-utilities.md) -[Return codes](usmt-return-codes.md) +[Return codes](/troubleshoot/windows-client/deployment/usmt-return-codes) From 0e70f7a79d139351572fe28568d31969ca7efbfc Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 28 Nov 2022 21:54:46 -0500 Subject: [PATCH 065/324] Remove troubleshooting articles from USMT and BitLocker 3 --- .openpublishing.redirection.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index dfaf5a09e2..e294ae6e64 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20174,6 +20174,16 @@ "source_path": "windows/configuration/start-layout-troubleshoot.md", "redirect_url": "/troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors", "redirect_document_id": false - } + }, + { + "source_path": "windows/deployment/usmt/usmt-common-issues.md", + "redirect_url": "/troubleshoot/windows-client/deployment/usmt-common-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/usmt/usmt-return-codes.md", + "redirect_url": "/troubleshoot/windows-client/deployment/usmt-return-codes", + "redirect_document_id": false + } ] } \ No newline at end of file From 6c96649511fd37bdba085c33d7f54093b91bb3bc Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 08:41:58 -0500 Subject: [PATCH 066/324] Remove troubleshooting articles from BitLocker 3 --- .../information-protection/bitlocker/bitlocker-and-adds-faq.yml | 2 +- .../bitlocker/bitlocker-basic-deployment.md | 2 +- .../bitlocker/bitlocker-countermeasures.md | 2 +- .../bitlocker/bitlocker-deployment-and-administration-faq.yml | 2 +- .../bitlocker/bitlocker-deployment-comparison.md | 2 +- .../bitlocker-device-encryption-overview-windows-10.md | 2 +- .../bitlocker/bitlocker-frequently-asked-questions.yml | 2 +- .../bitlocker/bitlocker-group-policy-settings.md | 2 +- .../bitlocker/bitlocker-how-to-deploy-on-windows-server.md | 2 +- .../bitlocker/bitlocker-how-to-enable-network-unlock.md | 2 +- .../bitlocker/bitlocker-key-management-faq.yml | 2 +- .../bitlocker/bitlocker-network-unlock-faq.yml | 2 +- .../bitlocker/bitlocker-overview-and-requirements-faq.yml | 2 +- .../information-protection/bitlocker/bitlocker-overview.md | 2 +- .../bitlocker/bitlocker-recovery-guide-plan.md | 2 +- .../information-protection/bitlocker/bitlocker-security-faq.yml | 2 +- .../information-protection/bitlocker/bitlocker-to-go-faq.yml | 2 +- .../bitlocker/bitlocker-upgrading-faq.yml | 2 +- ...-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md | 2 +- .../bitlocker-use-bitlocker-recovery-password-viewer.md | 2 +- .../bitlocker/bitlocker-using-with-other-programs-faq.yml | 2 +- ...are-your-organization-for-bitlocker-planning-and-policies.md | 2 +- ...r-shared-volumes-and-storage-area-networks-with-bitlocker.md | 2 +- 23 files changed, 23 insertions(+), 23 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml index 6b2f45605c..df826bda53 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.yml @@ -21,7 +21,7 @@ metadata: ms.custom: bitlocker title: BitLocker and Active Directory Domain Services (AD DS) FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index e277229e21..a2047fc5a1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -17,7 +17,7 @@ ms.technology: itpro-security # BitLocker basic deployment -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 58f5c7fe83..7a8377aceb 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -17,7 +17,7 @@ ms.technology: itpro-security # BitLocker Countermeasures -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml index 37e6318217..39701f8123 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml @@ -20,7 +20,7 @@ metadata: ms.custom: bitlocker title: BitLocker frequently asked questions (FAQ) summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index 9e7aba3ca0..d3643ab0fe 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -15,7 +15,7 @@ ms.technology: itpro-security # BitLocker deployment comparison -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 5b4d79dcc1..82fb89a4d8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -17,7 +17,7 @@ ms.technology: itpro-security # Overview of BitLocker Device Encryption in Windows -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml index 353a01de5b..46ab64d09d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.yml @@ -22,7 +22,7 @@ metadata: ms.custom: bitlocker title: BitLocker frequently asked questions (FAQ) resources summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 58f19b4708..a082bdcca9 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -18,7 +18,7 @@ ms.technology: itpro-security # BitLocker group policy settings -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md index 6e918604ba..bdf2e0b538 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md @@ -16,7 +16,7 @@ ms.technology: itpro-security # BitLocker: How to deploy on Windows Server 2012 and later -*Applies to:* +**Applies to:** - Windows Server 2012 - Windows Server 2012 R2 diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 37481aac1c..dd8cc3e8c7 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -17,7 +17,7 @@ ms.technology: itpro-security # BitLocker: How to enable Network Unlock -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml index ed40610b48..b7aa1ae889 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.yml @@ -19,7 +19,7 @@ metadata: ms.custom: bitlocker title: BitLocker Key Management FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml index 697e19e565..7129c50889 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.yml @@ -19,7 +19,7 @@ metadata: ms.custom: bitlocker title: BitLocker Network Unlock FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml index cb38246cbc..c8bea939c1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml @@ -21,7 +21,7 @@ metadata: ms.custom: bitlocker title: BitLocker Overview and Requirements FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 8d97d00a81..5f2e312fe5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -17,7 +17,7 @@ ms.technology: itpro-security # BitLocker -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index 752d1dd02c..efdcd705e7 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -18,7 +18,7 @@ ms.custom: bitlocker # BitLocker recovery guide -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml index e9cb42a381..04035cd1cb 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.yml @@ -19,7 +19,7 @@ metadata: ms.custom: bitlocker title: BitLocker Security FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml index 1045a942fe..1ab54f3689 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.yml @@ -19,7 +19,7 @@ metadata: ms.custom: bitlocker title: BitLocker To Go FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml index ea7c705f38..2ab78a0734 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.yml @@ -19,7 +19,7 @@ metadata: ms.custom: bitlocker title: BitLocker Upgrading FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index c88e87b23c..573fcb0e51 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -18,7 +18,7 @@ ms.technology: itpro-security # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index 3101c1d0bd..4fedd8f3d5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -18,7 +18,7 @@ ms.technology: itpro-security # BitLocker: Use BitLocker Recovery Password Viewer -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml index e688d0fd10..64f9160f29 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml @@ -19,7 +19,7 @@ metadata: ms.custom: bitlocker title: Using BitLocker with other programs FAQ summary: | - *Applies to:* + **Applies to:** - Windows 10 - Windows 11 - Windows Server 2016 and above diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index a76b56a2d3..56026fd192 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -17,7 +17,7 @@ ms.technology: itpro-security # Prepare an organization for BitLocker: Planning and policies -*Applies to:* +**Applies to:** - Windows 10 - Windows 11 diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index ad33dd9dfd..edf5fd84f3 100644 --- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -16,7 +16,7 @@ ms.technology: itpro-security # Protecting cluster shared volumes and storage area networks with BitLocker -*Applies to:* +**Applies to:** - Windows Server 2016 and above From 4f27ef00a5cf74c2676333f570ab9239c17cef97 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 09:14:47 -0500 Subject: [PATCH 067/324] Remove troubleshooting articles from USMT and BitLocker 4 --- .openpublishing.redirection.json | 53 ++- windows/security/TOC.yml | 18 +- .../bitlocker/troubleshoot-bitlocker.md | 152 -------- .../ts-bitlocker-cannot-encrypt-issues.md | 114 ------ .../ts-bitlocker-cannot-encrypt-tpm-issues.md | 157 -------- .../bitlocker/ts-bitlocker-config-issues.md | 191 --------- .../ts-bitlocker-decode-measured-boot-logs.md | 120 ------ .../bitlocker/ts-bitlocker-intune-issues.md | 366 ----------------- .../ts-bitlocker-network-unlock-issues.md | 105 ----- .../bitlocker/ts-bitlocker-recovery-issues.md | 369 ------------------ .../bitlocker/ts-bitlocker-tpm-issues.md | 126 ------ 11 files changed, 58 insertions(+), 1713 deletions(-) delete mode 100644 windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md delete mode 100644 windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index e294ae6e64..eca0b9e1b8 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20159,17 +20159,17 @@ "source_path": "windows/deployment/update/update-status-admin-center.md", "redirect_url": "/windows/deployment/update/wufb-reports-admin-center", "redirect_document_id": false - }, + }, { "source_path": "windows/deployment/update/update-compliance-v2-workbook.md", "redirect_url": "/windows/deployment/update/wufb-reports-workbook", "redirect_document_id": false - }, + }, { "source_path": "windows/configuration/kiosk-troubleshoot.md", "redirect_url": "/troubleshoot/windows-client/shell-experience/kiosk-mode-issues-troubleshooting", "redirect_document_id": false - }, + }, { "source_path": "windows/configuration/start-layout-troubleshoot.md", "redirect_url": "/troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors", @@ -20184,6 +20184,51 @@ "source_path": "windows/deployment/usmt/usmt-return-codes.md", "redirect_url": "/troubleshoot/windows-client/deployment/usmt-return-codes", "redirect_document_id": false - } + }, + { + "source_path": "windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-tpm-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-configuration-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/decode-measured-boot-logs-to-track-pcr-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-and-tpm-other-known-issues", + "redirect_document_id": false + } ] } \ No newline at end of file diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index c364767760..d93fc2caaf 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -136,25 +136,25 @@ - name: Troubleshoot BitLocker items: - name: Troubleshoot BitLocker - href: information-protection/bitlocker/troubleshoot-bitlocker.md + href: /troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting - name: "BitLocker cannot encrypt a drive: known issues" - href: information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md + href: /troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-issues - name: "Enforcing BitLocker policies by using Intune: known issues" - href: information-protection/bitlocker/ts-bitlocker-intune-issues.md + href: /troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues - name: "BitLocker Network Unlock: known issues" - href: information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md + href: /troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues - name: "BitLocker recovery: known issues" - href: information-protection/bitlocker/ts-bitlocker-recovery-issues.md + href: /troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues - name: "BitLocker configuration: known issues" - href: information-protection/bitlocker/ts-bitlocker-config-issues.md + href: /troubleshoot/windows-client/windows-security/bitlocker-configuration-known-issues - name: Troubleshoot BitLocker and TPM issues items: - name: "BitLocker cannot encrypt a drive: known TPM issues" - href: information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md + href: /troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-tpm-issues - name: "BitLocker and TPM: other known issues" - href: information-protection/bitlocker/ts-bitlocker-tpm-issues.md + href: /troubleshoot/windows-client/windows-security/bitlocker-and-tpm-other-known-issues - name: Decode Measured Boot logs to track PCR changes - href: information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md + href: /troubleshoot/windows-client/windows-security/decode-measured-boot-logs-to-track-pcr-changes - name: Personal Data Encryption (PDE) items: - name: Personal Data Encryption (PDE) overview diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md deleted file mode 100644 index 3a2eab807c..0000000000 --- a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md +++ /dev/null @@ -1,152 +0,0 @@ ---- -title: Guidelines for troubleshooting BitLocker -description: Describes approaches for investigating BitLocker issues, including how to gather diagnostic information -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# Guidelines for troubleshooting BitLocker - -This article addresses common issues in BitLocker and provides guidelines to troubleshoot these issues. This article also provides information such as what data to collect and what settings to check. This information makes the troubleshooting process much easier. - -## Review the event logs - -Open **Event Viewer** and review the following logs under **Applications and Services Logs** > **Microsoft** > **Windows**: - -- **BitLocker-API**. Review the **Management** log, the **Operational** log, and any other logs that are generated in this folder. The default logs have the following unique names: - - - **Microsoft-Windows-BitLocker-API/Management** - - **Microsoft-Windows-BitLocker-API/Operational** - - **Microsoft-Windows-BitLocker-API/Tracing** - only displayed when **Show Analytic and Debug Logs** is enabled - -- **BitLocker-DrivePreparationTool**. Review the **Admin** log, the **Operational** log, and any other logs that are generated in this folder. The default logs have the following unique names: - - - **Microsoft-Windows-BitLocker-DrivePreparationTool/Admin** - - **Microsoft-Windows-BitLocker-DrivePreparationTool/Operational** - -Additionally, review the **Windows Logs** > **System** log for events that were produced by the TPM and TPM-WMI event sources. - -To filter and display or export logs, the [wevtutil.exe](/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6&preserve-view=true) PowerShell cmdlet can be used. - -For example, to use `wevtutil.exe` to export the contents of the operational log from the BitLocker-API folder to a text file that is named `BitLockerAPIOpsLog.txt`, open a Command Prompt window, and run the following command: - -```cmd -wevtutil.exe qe "Microsoft-Windows-BitLocker/BitLocker Operational" /f:text > BitLockerAPIOpsLog.txt -``` - -To use the **Get-WinEvent** cmdlet to export the same log to a comma-separated text file, open a Windows PowerShell window and run the following command: - -```powershell -Get-WinEvent -logname "Microsoft-Windows-BitLocker/BitLocker Operational" | Export-Csv -Path Bitlocker-Operational.csv -``` - -The Get-WinEvent can be used in an elevated PowerShell window to display filtered information from the system or application log by using the following syntax: - -- To display BitLocker-related information: - - ```powershell - Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'BitLocker' | fl - ``` - - The output of such a command resembles the following. - - ![Display of events that is produced by using Get-WinEvent and a BitLocker filter.](./images/psget-winevent-1.png) - -- To export BitLocker-related information: - - ```powershell - Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'BitLocker' | Export-Csv -Path System-BitLocker.csv - ``` - -- To display TPM-related information: - - ```powershell - Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'TPM' | fl - ``` - -- To export TPM-related information: - - ```powershell - Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'TPM' | Export-Csv -Path System-TPM.csv - ``` - - The output of such a command resembles the following. - - ![Display of events that is produced by using Get-WinEvent and a TPM filter.](./images/psget-winevent-2.png) - -> [!NOTE] -> When contacting Microsoft Support, it is recommended to export the logs listed in this section. - -## Gather status information from the BitLocker technologies - -Open an elevated Windows PowerShell window, and run each of the following commands: - -|Command |Notes | More Info | -| --- | --- | --- | -|**`Get-Tpm > C:\TPM.txt`** |PowerShell cmdlet that exports information about the local computer's Trusted Platform Module (TPM). This cmdlet shows different values depending on whether the TPM chip is version 1.2 or 2.0. This cmdlet isn't supported in Windows 7. | [Get-Tpm](/powershell/module/trustedplatformmodule/get-tpm)| -|**`manage-bde.exe -status > C:\BDEStatus.txt`** |Exports information about the general encryption status of all drives on the computer. | [manage-bde.exe status](/windows-server/administration/windows-commands/manage-bde-status) | -|**`manage-bde.exe c: -protectors -get > C:\Protectors`** |Exports information about the protection methods that are used for the BitLocker encryption key. | [manage-bde.exe protectors](/windows-server/administration/windows-commands/manage-bde-protectors)| -|**`reagentc.exe /info > C:\reagent.txt`** |Exports information about an online or offline image about the current status of the Windows Recovery Environment (WindowsRE) and any available recovery image. | [reagentc.exe](/windows-hardware/manufacture/desktop/reagentc-command-line-options) | -|**`Get-BitLockerVolume \| fl`** |PowerShell cmdlet that gets information about volumes that BitLocker Drive Encryption can protect. | [Get-BitLockerVolume](/powershell/module/bitlocker/get-bitlockervolume) | - -## Review the configuration information - -1. Open an elevated Command Prompt window, and run the following commands: - - |Command |Notes | More Info | - | --- | --- | --- | - |**`gpresult.exe /h `** |Exports the Resultant Set of Policy information, and saves the information as an HTML file. | [gpresult.exe](/windows-server/administration/windows-commands/gpresult) | - |**`msinfo.exe /report /computer `** |Exports comprehensive information about the hardware, system components, and software environment on the local computer. The **/report** option saves the information as a .txt file. |[msinfo.exe](/windows-server/administration/windows-commands/msinfo32) | - -2. Open Registry Editor, and export the entries in the following subkeys: - - - **`HKLM\SOFTWARE\Policies\Microsoft\FVE`** - - **`HKLM\SYSTEM\CurrentControlSet\Services\TPM\`** - -## Check the BitLocker prerequisites - -Common settings that can cause issues for BitLocker include the following scenarios: - -- The TPM must be unlocked. Check the output of the **`get-tpm`** PowerShell cmdlet command for the status of the TPM. - -- Windows RE must be enabled. Check the output of the **`reagentc.exe`** command for the status of WindowsRE. - -- The system-reserved partition must use the correct format. - - - On Unified Extensible Firmware Interface (UEFI) computers, the system-reserved partition must be formatted as FAT32. - - On legacy computers, the system-reserved partition must be formatted as NTFS. - -- If the device being troubleshot is a slate or tablet PC, use to verify the status of the **Enable use of BitLocker authentication requiring preboot keyboard input on slates** option. - -For more information about the BitLocker prerequisites, see [BitLocker basic deployment: Using BitLocker to encrypt volumes](./bitlocker-basic-deployment.md#using-bitlocker-to-encrypt-volumes) - -## Next steps - -If the information examined so far indicates a specific issue (for example, WindowsRE isn't enabled), the issue may have a straightforward fix. - -Resolving issues that don't have obvious causes depends on exactly which components are involved and what behavior is being see. The gathered information helps narrow down the areas to investigate. - -- If the device being troubleshot is managed by Microsoft Intune, see [Enforcing BitLocker policies by using Intune: known issues](ts-bitlocker-intune-issues.md). - -- If BitLocker doesn't start or can't encrypt a drive and errors or events that are related to the TPM are occurring, see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md). - -- If BitLocker doesn't start or can't encrypt a drive, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md). - -- If BitLocker Network Unlock doesn't behave as expected, see [BitLocker Network Unlock: known issues](ts-bitlocker-network-unlock-issues.md). - -- If BitLocker doesn't behave as expected when an encrypted drive is recovered, or if BitLocker unexpectedly recovered a drive, see [BitLocker recovery: known issues](ts-bitlocker-recovery-issues.md). - -- If BitLocker or the encrypted drive doesn't behave as expected, and errors or events that are related to the TPM are occurring, see [BitLocker and TPM: other known issues](ts-bitlocker-tpm-issues.md). - -- If BitLocker or the encrypted drive doesn't behave as expected, see [BitLocker configuration: known issues](ts-bitlocker-config-issues.md). - -It's recommended to keep the gathered information handy in case Microsoft Support is contacted for help with resolving the issue. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md deleted file mode 100644 index 21e5e1fe33..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: BitLocker cannot encrypt a drive known issues -description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# BitLocker cannot encrypt a drive: known issues - -This article describes common issues that prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. - -> [!NOTE] -> If it is determined that the BitLocker issue involves the trusted platform module (TPM), see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md). - -## **Error 0x80310059: BitLocker drive encryption is already performing an operation on this drive** - -When BitLocker Drive Encryption is turned on a computer that is running Windows 10 Professional or Windows 11, the following message may appear: - -> **ERROR: An error occurred (code 0x80310059): BitLocker Drive Encryption is already performing an operation on this drive. Please complete all operations before continuing. NOTE: If the -on switch has failed to add key protectors or start encryption, you may need to call manage-bde -off before attempting -on again.** - -### Cause of **Error 0x80310059** - -This issue may be caused by settings that are controlled by group policy objects (GPOs). - -### Resolution for **Error 0x80310059** - -> [!IMPORTANT] -> Follow the steps in this section carefully. Serious problems might occur if the registry is modified incorrectly. Before modifying the registry, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. - -To resolve this issue, follow these steps: - -1. Start Registry Editor, and navigate to the following subkey: - - **`HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE`** - -2. Delete the following entries: - - - **`OSPlatformValidation_BIOS`** - - **`OSPlatformValidation_UEFI`** - - **`PlatformValidation`** - -3. Exit registry editor, and turn on BitLocker drive encryption again. - - \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md deleted file mode 100644 index 78b5691523..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ /dev/null @@ -1,157 +0,0 @@ ---- -title: BitLocker cannot encrypt a drive known TPM issues -description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive that can be attributed to the TPM -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# BitLocker cannot encrypt a drive: known TPM issues - -This article describes common issues that affect the Trusted Platform Module (TPM) that might prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. - -> [!NOTE] -> If it's been determined that the BitLocker issue does not involve the TPM, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md). - -## The TPM is locked and the error **`The TPM is defending against dictionary attacks and is in a time-out period`** is displayed - -It's attempted to turn on BitLocker drive encryption on a device but it fails with an error message similar to the following error message: - -> **The TPM is defending against dictionary attacks and is in a time-out period.** - -### Cause of the TPM being locked - -The TPM is locked out. - -### Resolution for the TPM being locked - -To resolve this issue, the TPM needs to be reset and cleared. The TPM can be reset and cleared with the following steps: - -1. Open an elevated PowerShell window and run the following script: - - ```powershell - $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" - $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus - if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} - ``` - -2. Restart the computer. If a prompt is displayed confirming the clearing of the TPM, agree to clear the TPM. - -3. Sign on to Windows and retry starting BitLocker drive encryption. - -> [!WARNING] -> Resetting and clearing the TPM can cause data loss. - -## The TPM fails to prepare with the error **`The TPM is defending against dictionary attacks and is in a time-out period`** - -It's attempted to turn on BitLocker drive encryption on a device but it fails. While troubleshooting, the TPM management console (`tpm.msc`) is used to attempt to prepare the TPM on the device. The operation fails with an error message similar to the following error message: - -> **The TPM is defending against dictionary attacks and is in a time-out period.** - -### Cause of TPM failing to prepare - -The TPM is locked out. - -### Resolution for TPM failing to prepare - -To resolve this issue, disable and re-enable the TPM with the following steps: - -1. Enter the UEFI/BIOS configuration screens of the device by restarting the device and hitting the appropriate key combination as the device boots. Consult with the device manufacturer for the appropriate key combination for entering into the UEFI/BIOS configuration screens. - -2. Once in the UEFI/BIOS configuration screens, disable the TPM. Consult with the device manufacturer for instructions on how to disable the TPM in the UEFI/BIOS configuration screens. - -3. Save the UEFI/BIOS configuration with the TPM disabled and restart the device to boot into Windows. - -4. Once signed into Windows, return to the TPM management console. An error message similar to the following error message is displayed: - - > **Compatible TPM cannot be found** - > - > **Compatible Trusted Platform Module (TPM) cannot be found on this computer. Verify that this computer has 1.2 TPM and it is turned on in the BIOS.** - - This message is expected since the TPM is currently disabled in the UEFI firmware/BIOS of the device. - -5. Restart the device and enter the UEFI/BIOS configuration screens again. - -6. Reenable the TPM in the UEFI/BIOS configuration screens. - -7. Save the UEFI/BIOS configuration with the TPM enabled and restart the device to boot into Windows. - -8. Once signed into Windows, return to the TPM management console. - -If the TPM still can't be prepared, clear the existing TPM keys by following the instructions in the article [Troubleshoot the TPM: Clear all the keys from the TPM](../tpm/initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). - -> [!WARNING] -> Clearing the TPM can cause data loss. - -## BitLocker fails to enable with the error **`Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005`** or **`Insufficient Rights`** - -The **Do not enable BitLocker until recovery information is stored in AD DS** policy is enforced in the environment. It's attempted to turn on BitLocker drive encryption on a device but it fails with the error message of **`Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005`** or **`Insufficient Rights`**. - -### Cause of **`Access Denied`** or **`Insufficient Rights`** - -The TPM didn't have sufficient permissions on the TPM devices container in Active Directory Domain Services (AD DS). Therefore, the BitLocker recovery information couldn't be backed up to AD DS, and BitLocker drive encryption couldn't turn on. - -This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10. - -### Resolution for **`Access Denied`** or **`Insufficient Rights`** - -To verify this issue is occurring, use one of the following two methods: - -- Disable the policy or remove the computer from the domain followed by trying to turn on BitLocker drive encryption again. If the operation succeeds, then the issue was caused by the policy. - -- Use LDAP and network trace tools to examine the LDAP exchanges between the client and the AD DS domain controller to identify the cause of the **Access Denied** or **Insufficient Rights** error. In this case, an error should be displayed when the client tries to access its object in the **`CN=TPM Devices,DC=,DC=com`** container. - -1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command: - - ```powershell - Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer - ``` - - In this command, *ComputerName* is the name of the affected computer. - -2. To resolve the issue, use a tool such as `dsacls.exe` to ensure that the access control list of msTPM-TPMInformationForComputer grants both **Read** and **Write** permissions to **NTAUTHORITY/SELF**. - -## The TPM fails to be prepared with the error **`0x80072030: There is no such object on the server`** - -Domain controllers were upgraded from Windows Server 2008 R2 to Windows Server 2012 R2. A group policy object (GPO) exists that enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. - -It's attempted to turn on BitLocker drive encryption on a device but it fails. While troubleshooting, the TPM management console (`tpm.msc`) is used to attempt to prepare the TPM on the device. The operation fails with an error message similar to the following error message: - -> **0x80072030 There is no such object on the server when a policy to back up TPM information to active directory is enabled** - -It's been confirmed that the **ms-TPM-OwnerInformation** and **msTPM-TpmInformationForComputer** attributes are present. - -### Cause of **0x80072030: There is no such object on the server** - -The domain and forest functional level of the environment may still be set to Windows 2008 R2. Additionally, the permissions in AD DS might not be correctly set. - -### Resolution for **0x80072030: There is no such object on the server** - -The issue can be resolved with the following steps: - -1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2. - -2. Download [Add-TPMSelfWriteACE.vbs](/samples/browse/?redirectedfrom=TechNet-Gallery). - -3. In the script, modify the value of **strPathToDomain** to the organization's domain name. - -4. Open an elevated PowerShell window, and run the following command: - - ```cmd - cscript.exe \Add-TPMSelfWriteACE.vbs - ``` - - In this command, \<*Path*> is the path to the script file. - -For more information, see the following articles: - -- [Back up the TPM recovery information to AD DS](../tpm/backup-tpm-recovery-information-to-ad-ds.md) -- [Prepare your organization for BitLocker: Planning and policies](./prepare-your-organization-for-bitlocker-planning-and-policies.md) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md deleted file mode 100644 index bac3ad9030..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md +++ /dev/null @@ -1,191 +0,0 @@ ---- -title: BitLocker configuration known issues -description: Describes common issues that involve BitLocker configuration and BitLocker's general functionality, and provides guidance for addressing those issues. -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# BitLocker configuration: known issues - -This article describes common issues that affect BitLocker's configuration and general functionality. This article also provides guidance to address these issues. - -## BitLocker encryption is slower in Windows 10 and Windows 11 - -BitLocker runs in the background to encrypt drives. However, in Windows 11 and Windows 10, BitLocker is less aggressive about requesting resources than in previous versions of Windows. This behavior reduces the chance that BitLocker will affect the computer's performance. - -To compensate for these changes, BitLocker uses a conversion model called Encrypt-On-Write. This model makes sure that any new disk writes are encrypted as soon as BitLocker is enabled. This behavior happens on all client editions and for any internal drives. - -> [!IMPORTANT] -> To preserve backward compatibility, BitLocker uses the previous conversion model to encrypt removable drives. - -### Benefits of using the new conversion model - -By using the previous conversion model, an internal drive can't be considered protected and compliant with data protection standards until the BitLocker conversion is 100 percent complete. Before the process finishes, the data that existed on the drive before encryption began - that is, potentially compromised data - can still be read and written without encryption. Therefore, for data to be considered protected and compliant with data protection standards, the encryption process has to finish before sensitive data is stored on the drive. Depending on the size of the drive, this delay can be substantial. - -By using the new conversion model, sensitive data can be stored on the drive as soon as BitLocker is turned on. The encryption process doesn't need to finish first, and encryption doesn't adversely affect performance. The tradeoff is that the encryption process for pre-existing data takes more time. - -### Other BitLocker enhancements - -Several other areas of BitLocker were improved in versions of Windows released after Windows 7: - -- **New encryption algorithm, XTS-AES** - Added in Windows 10 version 1511, this algorithm provides additional protection from a class of attacks on encrypted data that rely on manipulating cipher text to cause predictable changes in plain text. - - By default, this algorithm complies with the Federal Information Processing Standards (FIPS). FIPS is a United States Government standard that provides a benchmark for implementing cryptographic software. - -- **Improved administration features**. BitLocker can be managed on PCs or other devices by using the following interfaces: - - - BitLocker Wizard - - manage-bde.exe - - Group Policy Objects (GPOs) - - Mobile Device Management (MDM) policy - - Windows PowerShell - - Windows Management Interface (WMI) - -- **Integration with Azure Active Directory** (Azure AD) - BitLocker can store recovery information in Azure AD to make it easier to recover. - -- **[Direct memory access (DMA) Port Protection](../kernel-dma-protection-for-thunderbolt.md)** - By using MDM policies to manage BitLocker, a device's DMA ports can be blocked which secures the device during its startup. - -- **[BitLocker Network Unlock](./bitlocker-how-to-enable-network-unlock.md)** - If the BitLocker-enabled desktop or server computer is connected to a wired corporate network in a domain environment, its operating system volume can be automatically unlocked during a system restart. - -- **Support for [Encrypted Hard Drives](../encrypted-hard-drive.md)** - Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. By taking on that workload, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. - -- **Support for classes of HDD/SSD hybrid disks** - BitLocker can encrypt a disk that uses a small SSD as a non-volatile cache in front of the HDD, such as Intel Rapid Storage Technology. - -## Hyper-V Gen 2 VM: Can't access the volume after BitLocker encryption - -Consider the following scenario: - -1. BitLocker is turned on a generation 2 virtual machine (VM) that runs on Hyper-V. - -2. Data is added to the data disk as it encrypts. - -3. The VM is restarted and the following behavior is observed: - - - The system volume isn't encrypted. - - - The encrypted volume isn't accessible, and the computer lists the volume's file system as **Unknown**. - - - A message similar to the following message is displayed: - - > **You need to format the disk in \<*drive_letter:*> drive before you can use it** - -### Cause of not being able to access the volume after BitLocker encryption on a Hyper-V Gen 2 VM - -This issue occurs because the third-party filter driver `Stcvsm.sys` (from StorageCraft) is installed on the VM. - -### Resolution for not being able to access the volume after BitLocker encryption on a Hyper-V Gen 2 VM - -To resolve this issue, remove the third-party software. - -## Production snapshots fail for virtualized domain controllers that use BitLocker-encrypted disks - -Consider the following scenario: - -A Windows Server 2019 or 2016 Hyper-V Server is hosting VMs (guests) that are configured as Windows domain controllers. On a domain controller guest VM, BitLocker has encrypted the disks that store the Active Directory database and log files. When a "production snapshot" of the domain controller guest VM is attempted, the Volume Snap-Shot (VSS) service doesn't correctly process the backup. - -This issue occurs regardless of any of the following variations in the environment: - -- How the domain controller volumes are unlocked. -- Whether the VMs are generation 1 or generation 2. -- Whether the guest operating system is Windows Server 2019, 2016 or 2012 R2. - -In the guest VM domain controller **Windows Logs** > **Application** Event Viewer log, the VSS event source records event **ID 8229**: - -> ID: 8229
    -> Level: Warning
    -> Source: VSS
    -> Message: A VSS writer has rejected an event with error 0x800423f4. The writer experienced a non-transient error. If the backup process is retried, the error is likely to reoccur.
    -> -> Changes that the writer made to the writer components while handling the event will not be available to the requester.
    -> -> Check the event log for related events from the application hosting the VSS writer. -> -> Operation:
    -> PostSnapshot Event -> -> Context:
    -> Execution Context: Writer
    -> Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757}
    -> Writer Name: NTDS
    -> Writer Instance ID: {d170b355-a523-47ba-a5c8-732244f70e75}
    -> Command Line: C:\\Windows\\system32\\lsass.exe
    -> -> Process ID: 680 - -In the guest VM domain controller **Applications and Services Logs** > **Directory Service** Event Viewer log, there's an event logged similar to the following event: - -> Error Microsoft-Windows-ActiveDirectory\_DomainService 1168
    -> Internal Processing Internal error: An Active Directory Domain Services error has occurred. -> -> Additional Data
    -> Error value (decimal): -1022
    -> -> Error value (hex): fffffc02 -> -> Internal ID: 160207d9 - -> [!NOTE] -> The internal ID of this event may differ based on the operating system release version and patch level. - -When this issue occurs, the **Active Directory Domain Services (NTDS) VSS Writer** will display the following error when the **`vssadmin.exe list writers`** command is run: - -```Error -Writer name: 'NTDS' - Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757} - Writer Instance Id: {08321e53-4032-44dc-9b03-7a1a15ad3eb8} - State: [11] Failed - Last error: Non-retryable error -``` - -Additionally, the VMs can't be backed up until they're restarted. - -### Cause of production snapshots fail for virtualized domain controllers that use BitLocker-encrypted disks - -After VSS creates a snapshot of a volume, the VSS writer takes "post snapshot" actions. When a "production snapshot" is initiated from the host server, Hyper-V tries to mount the snapshotted volume. However, it can't unlock the volume for unencrypted access. BitLocker on the Hyper-V server doesn't recognize the volume. Therefore, the access attempt fails and then the snapshot operation fails. - -This behavior is by design. - -### Workaround for production snapshots fail for virtualized domain controllers that use BitLocker-encrypted disks - -A supported way to perform backup and restore of a virtualized domain controller is to run **Windows Server Backup** in the guest operating system. - -If a production snapshot of a virtualized domain controller needs to be taken, BitLocker can be suspended in the guest operating system before the production snapshot is started. However, this approach isn't recommended. - -For more information and recommendations about backing up virtualized domain controllers, see [Virtualizing Domain Controllers using Hyper-V: Backup and Restore Considerations for Virtualized Domain Controllers](/windows-server/identity/ad-ds/get-started/virtual-dc/virtualized-domain-controllers-hyper-v#backup-and-restore-considerations-for-virtualized-domain-controllers) - -### More information - -When the VSS NTDS writer requests access to the encrypted drive, the Local Security Authority Subsystem Service (LSASS) generates an error entry similar to the following error: - -```console -\# for hex 0xc0210000 / decimal -1071579136 -STATUS\_FVE\_LOCKED\_VOLUME ntstatus.h -\# This volume is locked by BitLocker Drive Encryption. -``` - -The operation produces the following call stack: - -```console -\# Child-SP RetAddr Call Site - 00 00000086\`b357a800 00007ffc\`ea6e7a4c KERNELBASE\!FindFirstFileExW+0x1ba \[d:\\rs1\\minkernel\\kernelbase\\filefind.c @ 872\] - 01 00000086\`b357abd0 00007ffc\`e824accb KERNELBASE\!FindFirstFileW+0x1c \[d:\\rs1\\minkernel\\kernelbase\\filefind.c @ 208\] - 02 00000086\`b357ac10 00007ffc\`e824afa1 ESENT\!COSFileFind::ErrInit+0x10b \[d:\\rs1\\onecore\\ds\\esent\\src\\os\\osfs.cxx @ 2476\] - 03 00000086\`b357b700 00007ffc\`e827bf02 ESENT\!COSFileSystem::ErrFileFind+0xa1 \[d:\\rs1\\onecore\\ds\\esent\\src\\os\\osfs.cxx @ 1443\] - 04 00000086\`b357b960 00007ffc\`e82882a9 ESENT\!JetGetDatabaseFileInfoEx+0xa2 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 11503\] - 05 00000086\`b357c260 00007ffc\`e8288166 ESENT\!JetGetDatabaseFileInfoExA+0x59 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 11759\] - 06 00000086\`b357c390 00007ffc\`e84c64fb ESENT\!JetGetDatabaseFileInfoA+0x46 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 12076\] - 07 00000086\`b357c3f0 00007ffc\`e84c5f23 ntdsbsrv\!CVssJetWriterLocal::RecoverJetDB+0x12f \[d:\\rs1\\ds\\ds\\src\\jetback\\snapshot.cxx @ 2009\] - 08 00000086\`b357c710 00007ffc\`e80339e0 ntdsbsrv\!CVssJetWriterLocal::OnPostSnapshot+0x293 \[d:\\rs1\\ds\\ds\\src\\jetback\\snapshot.cxx @ 2190\] - 09 00000086\`b357cad0 00007ffc\`e801fe6d VSSAPI\!CVssIJetWriter::OnPostSnapshot+0x300 \[d:\\rs1\\base\\stor\\vss\\modules\\jetwriter\\ijetwriter.cpp @ 1704\] - 0a 00000086\`b357ccc0 00007ffc\`e8022193 VSSAPI\!CVssWriterImpl::OnPostSnapshotGuard+0x1d \[d:\\rs1\\base\\stor\\vss\\modules\\vswriter\\vswrtimp.cpp @ 5228\] - 0b 00000086\`b357ccf0 00007ffc\`e80214f0 VSSAPI\!CVssWriterImpl::PostSnapshotInternal+0xc3b \[d:\\rs1\\base\\stor\\vss\\modules\\vswriter\\vswrtimp.cpp @ 3552\] -``` diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md deleted file mode 100644 index 9a5952f7e5..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ /dev/null @@ -1,120 +0,0 @@ ---- -title: Decode Measured Boot logs to track PCR changes -description: Provides instructions for installing and using a tool for analyzing log information to identify changes to PCRs -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# Decode Measured Boot logs to track PCR changes - -Platform Configuration Registers (PCRs) are memory locations in the Trusted Platform Module (TPM). BitLocker and its related technologies depend on specific PCR configurations. Additionally, specific change in PCRs can cause a device or computer to enter BitLocker recovery mode. - -By tracking changes in the PCRs, and identifying when they changed, insight can be gained into issues that occur or learn why a device or computer entered BitLocker recovery mode. The Measured Boot logs record PCR changes and other information. These logs are located in the `C:\Windows\Logs\MeasuredBoot\` folder. - -This article describes tools that can be used to decode these logs: `TBSLogGenerator.exe` and `PCPTool.exe`. - -For more information about Measured Boot and PCRs, see the following articles: - -- [TPM fundamentals: Measured Boot with support for attestation](../tpm/tpm-fundamentals.md#measured-boot-with-support-for-attestation) -- [Understanding PCR banks on TPM 2.0 devices](../tpm/switch-pcr-banks-on-tpm-2-0-devices.md) - -## Use `TBSLogGenerator.exe` to decode Measured Boot logs - -Use `TBSLogGenerator.exe` to decode Measured Boot logs that were collected from Windows. `TBSLogGenerator.exe` can be installed on the following systems: - -- A computer that is running Windows Server 2016 or newer and that has a TPM enabled -- A Gen 2 virtual machine running on Hyper-V that is running Windows Server 2016 or newer and is using a virtual TPM. - -To install the tool, follow these steps: - -1. Download the Windows Hardware Lab Kit from [Windows Hardware Lab Kit](/windows-hardware/test/hlk/). - -2. After downloading, run the installation file from the path where the install was downloaded to. - -3. Accept the default installation path. - - ![Specify Location page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-1.png) - -4. Under **Select the features you want to install**, select **Windows Hardware Lab Kit—Controller + Studio**. - - ![Select features page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-2.png) - -5. Finish the installation. - -To use `TBSLogGenerator.exe`, follow these steps: - -1. After the installation finishes, open an elevated Command Prompt window and navigate to the following folder: - - **`C:\Program Files (x86)\Windows Kits\10\Hardware Lab Kit\Tests\amd64\NTTEST\BASETEST\ngscb`** - - This folder contains the `TBSLogGenerator.exe` file. - - ![Properties and location of the `TBSLogGenerator.exe` file.](./images/ts-tpm-3.png) - -1. Run the following command: - - ```cmd - TBSLogGenerator.exe -LF \.log > \.txt - ``` - - where the variables represent the following values: - - - \<*LogFolderName*> = the name of the folder that contains the file to be decoded - - \<*LogFileName*> = the name of the file to be decoded - - \<*DestinationFolderName*> = the name of the folder for the decoded text file - - \<*DecodedFileName*> = the name of the decoded text file - - For example, the following figure shows Measured Boot logs that were collected from a Windows 10 computer and put into the **`C:\MeasuredBoot\`** folder. The figure also shows a Command Prompt window and the command to decode the **`0000000005-0000000000.log`** file: - - ```cmd - TBSLogGenerator.exe -LF C:\MeasuredBoot\0000000005-0000000000.log > C:\MeasuredBoot\0000000005-0000000000.txt - ``` - - ![Command Prompt window that shows an example of how to use `TBSLogGenerator.exe`.](./images/ts-tpm-4.png) - - The command produces a text file that uses the specified name. In this example, the file is **`0000000005-0000000000.txt`**. The file is located in the same folder as the original `.log` file. - - ![Windows Explorer window that shows the text file that `TBSLogGenerator.exe`produces.](./images/ts-tpm-5.png) - - The content of this text file is similar to the following text: - - ![Contents of the text file, as shown in NotePad.](./images/ts-tpm-6.png) - - To find the PCR information, go to the end of the file. - - ![View of NotePad that shows the PCR information at the end of the text file.](./images/ts-tpm-7.png) - -## Use `PCPTool.exe` to decode Measured Boot logs - -> [!NOTE] -> `PCPTool.exe` is a Visual Studio solution, but executable needs to be built before tool can be used. - -`PCPTool.exe` is part of the [TPM Platform Crypto-Provider Toolkit](https://www.microsoft.com/download/details.aspx?id=52487). The tool decodes a Measured Boot log file and converts it into an XML file. - -To download and install `PCPTool.exe`, go to the Toolkit page, select **Download**, and follow the instructions. - -To decode a log, run the following command: - -```cmd -PCPTool.exe decodelog \.log > \.xml -``` - -where the variables represent the following values: - -- \<*LogFolderPath*> = the path to the folder that contains the file to be decoded -- \<*LogFileName*> = the name of the file to be decoded -- \<*DestinationFolderName*> = the name of the folder for the decoded text file -- \<*DecodedFileName*> = the name of the decoded text file - -The content of the XML file will be similar to the following XML: - -:::image type="content" alt-text="Command Prompt window that shows an example of how to use `PCPTool.exe`." source="./images/pcptool-output.jpg" lightbox="./images/pcptool-output.jpg"::: diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md deleted file mode 100644 index dd44a1446d..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ /dev/null @@ -1,366 +0,0 @@ ---- -title: Enforcing BitLocker policies by using Intune known issues -description: Provides assistance for issues that may be seen if Microsoft Intune policy is being used to manage silent BitLocker encryption on devices. -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: - - Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# Enforcing BitLocker policies by using Intune: known issues - -This article helps troubleshooting issues that may be experienced if using Microsoft Intune policy to manage silent BitLocker encryption on devices. The Intune portal indicates whether BitLocker has failed to encrypt one or more managed devices. - -:::image type="content" alt-text="The BitLocker status indictors on the Intune portal." source="./images/4509189-en-1.png" lightbox="./images/4509189-en-1.png"::: - -To start narrowing down the cause of the problem, review the event logs as described in [Troubleshoot BitLocker](troubleshoot-bitlocker.md). Concentrate on the **Management** and **Operations** logs in the **Applications and Services logs** > **Microsoft** > **Windows** > **BitLocker-API** folder. The following sections provide more information about how to resolve the indicated events and error messages: - -- [Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer](#event-id-853-error-a-compatible-trusted-platform-module-tpm-security-device-cannot-be-found-on-this-computer) -- [Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer](#event-id-853-error-bitlocker-drive-encryption-detected-bootable-media-cd-or-dvd-in-the-computer) -- [Event ID 854: WinRE is not configured](#event-id-854-winre-is-not-configured) -- [Event ID 851: Contact manufacturer for BIOS upgrade](#event-id-851-contact-the-manufacturer-for-bios-upgrade-instructions) -- [Error message: The UEFI variable 'SecureBoot' could not be read](#error-message-the-uefi-variable-secureboot-could-not-be-read) -- [Event ID 846, 778, and 851: Error 0x80072f9a](#event-id-846-778-and-851-error-0x80072f9a) -- [Error message: There are conflicting group policy settings for recovery options on operating system drives](#error-message-there-are-conflicting-group-policy-settings-for-recovery-options-on-operating-system-drives) - -If there's no clear trail of events or error messages to follow, other areas to investigate include the following areas: - -- [Review the hardware requirements for using Intune to manage BitLocker on devices](/windows-hardware/design/device-experiences/oem-bitlocker#bitlocker-automatic-device-encryption-hardware-requirements) -- [Review BitLocker policy configuration](#review-bitlocker-policy-configuration) - -For information about the procedure to verify whether Intune policies are enforcing BitLocker correctly, see [Verifying that BitLocker is operating correctly](#verifying-that-bitlocker-is-operating-correctly). - -## Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer - -Event ID 853 can carry different error messages, depending on the context. In this case, the Event ID 853 error message indicates that the device doesn't appear to have a TPM. The event information will be similar to the following event: - -![Details of event ID 853 (A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer).](./images/4509190-en-1.png) - -### Cause of Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer - -The device that is being secured may not have a TPM chip, or the device BIOS might have been configured to disable the TPM. - -### Resolution for Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer - -To resolve this issue, verify the following configurations: - -- The TPM is enabled in the device BIOS. -- The TPM status in the TPM management console is similar to the following statuses: - - Ready (TPM 2.0) - - Initialized (TPM 1.2) - -For more information, see [Troubleshoot the TPM](../tpm/initialize-and-configure-ownership-of-the-tpm.md). - -## Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer - -In this case, event ID 853 is displayed, and the error message in the event indicates that bootable media is available to the device. The event information resembles the following. - -![Details of event ID 853 (TPM is not available, bootable media found).](./images/4509191-en-1.png) - -### Cause of Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer - -During the provisioning process, BitLocker drive encryption records the configuration of the device to establish a baseline. If the device configuration changes later (for example, if the media is removed), BitLocker recovery mode automatically starts. - -To avoid this situation, the provisioning process stops if it detects a removable bootable media. - -### Resolution for Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer - -Remove the bootable media, and restart the device. After the device restarts, verify the encryption status. - -## Event ID 854: WinRE is not configured - -The event information resembles the following error message: - -> Failed to enable Silent Encryption. WinRe is not configured. -> -> Error: This PC cannot support device encryption because WinRE is not properly configured. - -### Cause of Event ID 854: WinRE is not configured - -Windows Recovery Environment (WinRE) is a minimal Windows operating system that is based on Windows Preinstallation Environment (Windows PE). WinRE includes several tools that an administrator can use to recover or reset Windows and diagnose Windows issues. If a device can't start the regular Windows operating system, the device tries to start WinRE. - -The provisioning process enables BitLocker drive encryption on the operating system drive during the Windows PE phase of provisioning. This action makes sure that the drive is protected before the full operating system is installed. The provisioning process also creates a system partition for WinRE to use if the system crashes. - -If WinRE isn't available on the device, provisioning stops. - -### Resolution for Event ID 854: WinRE is not configured - -This issue can be resolved by verifying the configuration of the disk partitions, the status of WinRE, and the Windows Boot Loader configuration by following these steps: - -#### Step 1: Verify the configuration of the disk partitions - -The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 11 and Windows 10 automatically create a recovery partition that contains the **`Winre.wim`** file. The partition configuration resembles the following. - -![Default disk partitions, including the recovery partition.](./images/4509194-en-1.png) - -To verify the configuration of the disk partitions, open an elevated Command Prompt window and run the following commands: - -```cmd -diskpart.exe -list volume -``` - -![Output of the list volume command in the Diskpart app.](./images/4509195-en-1.png) - -If the status of any of the volumes isn't healthy or if the recovery partition is missing, Windows may need to be reinstalled. Before reinstalling Windows, check the configuration of the Windows image that is being provisioned. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Configuration Manager): - -![Windows image configuration in Microsoft Configuration Manager.](./images/configmgr-imageconfig.jpg) - -#### Step 2: Verify the status of WinRE - -To verify the status of WinRE on the device, open an elevated Command Prompt window and run the following command: - -```cmd -reagentc.exe /info -``` - -The output of this command resembles the following. - -![Output of the reagentc.exe /info command.](./images/4509193-en-1.png) - -If the **Windows RE status** isn't **Enabled**, run the following command to enable it: - -```cmd -reagentc.exe /enable -``` - -#### Step 3: Verify the Windows Boot Loader configuration - -If the partition status is healthy, but the **`reagentc.exe /enable`** command results in an error, verify whether the Windows Boot Loader contains the recovery sequence GUID by running the following command in an elevated Command Prompt window: - -```cmd -bcdedit.exe /enum all -``` - -The output of this command will be similar to the following output: - -:::image type="content" alt-text="Output of the bcdedit /enum all command." source="./images/4509196-en-1.png" lightbox="./images/4509196-en-1.png"::: - -In the output, locate the **Windows Boot Loader** section that includes the line **identifier={current}**. In that section, locate the **recoverysequence** attribute. The value of this attribute should be a GUID value, not a string of zeros. - -## Event ID 851: Contact the manufacturer for BIOS upgrade instructions - -The event information will be similar to the following error message: - -> Failed to enable Silent Encryption. -> -> Error: BitLocker Drive Encryption cannot be enabled on the operating system drive. Contact the computer manufacturer for BIOS upgrade instructions. - -### Cause of Event ID 851: Contact the manufacturer for BIOS upgrade instructions - -The device must have Unified Extensible Firmware Interface (UEFI) BIOS. Silent BitLocker drive encryption doesn't support legacy BIOS. - -### Resolution for Event ID 851: Contact the manufacturer for BIOS upgrade instructions - -To verify the BIOS mode, use the System Information application by following these steps: - -1. Select **Start**, and enter **msinfo32** in the **Search** box. - -2. Verify that the **BIOS Mode** setting is **UEFI** and not **Legacy**. - - ![System Information app, showing the BIOS Mode setting.](./images/4509198-en-1.png) - -3. If the **BIOS Mode** setting is **Legacy**, the UEFI firmware needs to be switched to **UEFI** or **EFI** mode. The steps for switching to **UEFI** or **EFI** mode are specific to the device. - - > [!NOTE] - > If the device supports only Legacy mode, Intune can't be used to manage BitLocker Device Encryption on the device. - -## Error message: The UEFI variable 'SecureBoot' could not be read - -An error message similar to the following error message is displayed: - -> **Error:** BitLocker cannot use Secure Boot for integrity because the UEFI variable 'SecureBoot' could not be read. A required privilege is not held by the client. - -### Cause of Error message: The UEFI variable 'SecureBoot' could not be read - -A platform configuration register (PCR) is a memory location in the TPM. In particular, PCR 7 measures the state of secure boot. Silent BitLocker drive encryption requires the secure boot to be turned on. - -### Resolution for Error message: The UEFI variable 'SecureBoot' could not be read - -This issue can be resolved by verifying the PCR validation profile of the TPM and the secure boot state by following these steps: - -#### Step 1: Verify the PCR validation profile of the TPM - -To verify that PCR 7 is in use, open an elevated Command Prompt window and run the following command: - -```cmd -Manage-bde.exe -protectors -get %systemdrive% -``` - -In the TPM section of the output of this command, verify whether the **PCR Validation Profile** setting includes **7**, as follows: - -![Output of the manage-bde command.](./images/4509199-en-1.png) - -If **PCR Validation Profile** doesn't include **7** (for example, the values include **0**, **2**, **4**, and **11**, but not **7**), then secure boot isn't turned on. - -![Output of the manage-bde command when PCR 7 is not present.](./images/4509200-en-1.png) - -#### 2: Verify the secure boot state - -To verify the secure boot state, use the System Information application by following these steps: - -1. Select **Start**, and enter **msinfo32** in the **Search** box. - -2. Verify that the **Secure Boot State** setting is **On**, as follows: - - ![System Information app, showing a supported Secure Boot State.](./images/4509201-en-1.png) - -3. If the **Secure Boot State** setting is **Unsupported**, Silent BitLocker Encryption can't be used on the device. - - ![System Information app, showing a unsupported Secure Boot State.](./images/4509202-en-1.png) - -> [!NOTE] -> The [Confirm-SecureBootUEFI](/powershell/module/secureboot/confirm-securebootuefi) PowerShell cmdlet can also be used to verify the Secure Boot state by opening an elevated PowerShell window and running the following command: -> -> ```powershell -> Confirm-SecureBootUEFI -> ``` -> -> If the computer supports Secure Boot and Secure Boot is enabled, this cmdlet returns "True." -> -> If the computer supports secure boot and secure boot is disabled, this cmdlet returns "False." -> -> If the computer does not support Secure Boot or is a BIOS (non-UEFI) computer, this cmdlet returns "Cmdlet not supported on this platform." - -## Event ID 846, 778, and 851: Error 0x80072f9a - -Consider the following scenario: - -Intune policy is being deployed to encrypt a Windows 10, version 1809 device, and the recovery password is being stored in Azure Active Directory (Azure AD). As part of the policy configuration, the **Allow standard users to enable encryption during Azure AD Join** option has been selected. - -The policy deployment fails and the failure generates the following events in Event Viewer in the **Applications and Services Logs** > **Microsoft** > **Windows** > **BitLocker API** folder: - -> Event ID:846 -> -> Event: -> Failed to backup BitLocker Drive Encryption recovery information for volume C: to your Azure AD. -> -> TraceId: {cbac2b6f-1434-4faa-a9c3-597b17c1dfa3} -> Error: Unknown HResult Error code: 0x80072f9a - -> Event ID:778 -> -> Event: The BitLocker volume C: was reverted to an unprotected state. - -> Event ID: 851 -> -> Event: -> Failed to enable Silent Encryption. -> -> Error: Unknown HResult Error code: 0x80072f9a. - -These events refer to Error code 0x80072f9a. - -### Cause of Event ID 846, 778, and 851: Error 0x80072f9a - -These events indicate that the signed-in user doesn't have permission to read the private key on the certificate that is generated as part of the provisioning and enrollment process. Therefore, the BitLocker MDM policy refresh fails. - -The issue affects Windows 10 version 1809. - -### Resolution for Event ID 846, 778, and 851: Error 0x80072f9a - -To resolve this issue, install the [May 21, 2019](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934) update. - -## Error message: There are conflicting group policy settings for recovery options on operating system drives - -An error message similar to the following error message is displayed: - -> **Error:** BitLocker Drive Encryption cannot be applied to this drive because there are conflicting Group Policy settings for recovery options on operating system drives. Storing recovery information to Active Directory Domain Services cannot be required when the generation of recovery passwords is not permitted. Please have your system administrator resolve these policy conflicts before attempting to enable BitLocker… - -### Resolution for Error message: There are conflicting group policy settings for recovery options on operating system drives - -To resolve this issue, review the group policy object (GPO) settings for conflicts. For more information, see the next section, [Review BitLocker policy configuration](#review-bitlocker-policy-configuration). - -For more information about GPOs and BitLocker, see [BitLocker Group Policy Reference](/previous-versions/windows/it-pro/windows-7/ee706521(v=ws.10)). - -## Review BitLocker policy configuration - -For information about the procedure to use policy together with BitLocker and Intune, see the following resources: - -- [BitLocker management for enterprises: Managing devices joined to Azure Active Directory](./bitlocker-management-for-enterprises.md#managing-devices-joined-to-azure-active-directory) -- [BitLocker Group Policy Reference](/previous-versions/windows/it-pro/windows-7/ee706521(v=ws.10)) -- [Configuration service provider reference](/windows/client-management/mdm/configuration-service-provider-reference) -- [Policy CSP – BitLocker](/windows/client-management/mdm/policy-csp-bitlocker) -- [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) -- [Enable ADMX-backed policies in MDM](/windows/client-management/mdm/enable-admx-backed-policies-in-mdm) -- [gpresult](/windows-server/administration/windows-commands/gpresult) - -Intune offers the following enforcement types for BitLocker: - -- **Automatic** (Enforced when the device joins Azure AD during the provisioning process. This option is available in Windows 10 version 1703 and later.) -- **Silent** (Endpoint protection policy. This option is available in Windows 10 version 1803 and later.) -- **Interactive** (Endpoint policy for Windows versions that are older than Windows 10 version 1803.) - -If the device runs Windows 10 version 1703 or later, supports Modern Standby (also known as Instant Go) and is HSTI-compliant, joining the device to Azure AD triggers automatic device encryption. A separate endpoint protection policy isn't required to enforce device encryption. - -If the device is HSTI-compliant but doesn't support Modern Standby, an endpoint protection policy has to be configured to enforce silent BitLocker drive encryption. The settings for this policy should be similar to the following settings: - -![Intune policy settings.](./images/4509186-en-1.png) - -The OMA-URI references for these settings are as follows: - -- OMA-URI: **./Device/Vendor/MSFT/BitLocker/RequireDeviceEncryption** - Value Type: **Integer** - Value: **1** (1 = Require, 0 = Not Configured) - -- OMA-URI: **./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryption** - Value Type: **Integer** - Value: **0** (0 = Blocked, 1 = Allowed) - -> [!NOTE] -> Because of an update to the BitLocker Policy CSP, if the device uses Windows 10 version 1809 or later, an endpoint protection policy can be used to enforce silent BitLocker Device Encryption even if the device is not HSTI-compliant. - -> [!NOTE] -> If the **Warning for other disk encryption** setting is set to **Not configured**, the BitLocker drive encryption wizard has to be manually started. - -If the device doesn't support Modern Standby but is HSTI-compliant, and it uses a version of Windows that is earlier than Windows 10, version 1803, an endpoint protection policy that has the settings that are described in this article delivers the policy configuration to the device. However, Windows then notifies the user to manually enable BitLocker Drive Encryption. When the user selects the notification, it will start the BitLocker Drive Encryption wizard. - -Intune provides settings that can be used to configure automatic device encryption for Autopilot devices for standard users. Each device must meet the following requirements: - -- Be HSTI-compliant -- Support Modern Standby -- Use Windows 10 version 1803 or later - -![Intune policy setting.](./images/4509188-en-1.png) - -The OMA-URI references for these settings are as follows: - -- OMA-URI: **./Device/Vendor/MSFT/BitLocker/AllowStandardUserEncryption** - Value Type: **Integer** - Value: **1** - -> [!NOTE] -> This node works together with the **RequireDeviceEncryption** and **AllowWarningForOtherDiskEncryption** nodes. For this reason, when the following settings are set: -> -> - **RequireDeviceEncryption** to **1** -> - **AllowStandardUserEncryption** to **1** -> - **AllowWarningForOtherDiskEncryption** to **0** -> -> Intune enforces silent BitLocker encryption for Autopilot devices that have standard user profiles. - -## Verifying that BitLocker is operating correctly - -During regular operations, BitLocker drive encryption generates events such as Event ID 796 and Event ID 845. - -![Event ID 796, as shown in Event Viewer.](./images/4509203-en-1.png) - -![Event ID 845, as shown in Event Viewer.](./images/4509204-en-1.png) - -It can also be determined whether the BitLocker recovery password has been uploaded to Azure AD by checking the device details in the Azure AD Devices section. - -![BitLocker recovery information as viewed in Azure AD.](./images/4509205-en-1.png) - -On the device, check the Registry Editor to verify the policy settings on the device. Verify the entries under the following subkeys: - -- **`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\BitLocker`** -- **`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device`** - -![Registry subkeys that relate to Intune policy.](./images/4509206-en-1.png) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md deleted file mode 100644 index 530b0f37e4..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md +++ /dev/null @@ -1,105 +0,0 @@ ---- -title: BitLocker Network Unlock known issues -description: Describes several known issues that may be encountered while using Network Unlock, and provided guidance for addressing those issues. -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.reviewer: kaushika -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.custom: bitlocker -ms.date: 11/08/2022 ---- - -# BitLocker Network Unlock: known issues - -By using the BitLocker Network Unlock feature, computers can be managed remotely without having to enter a BitLocker PIN when each computer starts up. To configure this behavior, the environment needs to meet the following requirements: - -- Each computer belongs to a domain. -- Each computer has a wired connection to the internal network. -- The internal network uses DHCP to manage IP addresses. -- Each computer has a DHCP driver implemented in its Unified Extensible Firmware Interface (UEFI) firmware. - -For general guidelines about how to troubleshoot BitLocker Network Unlock, see [How to enable Network Unlock: Troubleshoot Network Unlock](./bitlocker-how-to-enable-network-unlock.md#troubleshoot-network-unlock). - -This article describes several known issues that may be encountered when BitLocker Network Unlock is used and provides guidance to address these issues. - -> [!TIP] -> BitLocker Network Unlock can be detected if it is enabled on a specific computer use the following steps on UEFI computers: -> -> 1. Open an elevated command prompt window and run the following command: -> -> ```cmd -> manage-bde.exe -protectors -get -> ``` -> -> For example: -> -> ```cmd -> manage-bde.exe -protectors -get C: -> ``` -> -> If the output of this command includes a key protector of type **TpmCertificate (9)**, the configuration is correct for BitLocker Network Unlock. -> -> 2. Start Registry Editor, and verify the following settings: -> -> 1. The following registry key exists and has the following value: -> -> - **Subkey**: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE` -> - **Type**: `REG_DWORD` -> - **Value**: `OSManageNKP` equal to `1` (True) -> -> 2. The registry key: -> -> `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\FVE_NKP\Certificates` -> -> has an entry whose name matches the name of the certificate thumbprint of the BitLocker Network Unlock key protector that was found in step 1. - -## On a Surface Pro 4 device, BitLocker Network Unlock doesn't work because the UEFI network stack is incorrectly configured - -Consider the following scenario: - -BitLocker Network Unlock has been configured as described in [BitLocker: How to enable Network Unlock](/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock). UEFI of a Surface Pro 4 has been configured to use DHCP. However, when the Surface Pro 4 is restarted, it still prompts for a BitLocker PIN. - -When testing another device, such as a different type of tablet or laptop PC that's configured to use the same infrastructure, the device restarts as expected, without prompting for the BitLocker PIN. This test confirms that the infrastructure is correctly configured, and the issue is specific to the device. - -### Cause of BitLocker Network Unlock not working on Surface Pro 4 - -The UEFI network stack on the device is incorrectly configured. - -### Resolution for BitLocker Network Unlock not working on Surface Pro 4 - -To correctly configure the UEFI network stack of the Surface Pro 4, the Microsoft Surface Enterprise Management Mode (SEMM) needs to be used. For information about SEMM, see [Enroll and configure Surface devices with SEMM](/surface/enroll-and-configure-surface-devices-with-semm). - -> [!NOTE] -> If SEMM can't be used, the Surface Pro 4 may be able to use BitLocker Network Unlock by configuring the Surface Pro 4 to use the network as its first boot option. - -## Unable to use BitLocker Network Unlock feature on a Windows client computer - -Consider the following scenario: - -BitLocker Network Unlock has been configured as described in [BitLocker: How to enable Network Unlock](/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock). A Windows 8 client computer is connected to the internal network with an ethernet cable. However, when the device is restarted, the device still prompts for the BitLocker PIN. - -### Cause of unable to use BitLocker Network Unlock feature on a Windows client computer - -A Windows 8-based or Windows Server 2012-based client computer sometimes doesn't receive or use the BitLocker Network Unlock protector, depending on whether the client receives unrelated BOOTP replies from a DHCP server or WDS server. - -DHCP servers may send any DHCP options to a BOOTP client as allowed by the DHCP options and BOOTP vendor extensions. This behavior means that because a DHCP server supports BOOTP clients, the DHCP server replies to BOOTP requests. - -The manner in which a DHCP server handles an incoming message depends in part on whether the message uses the Message Type option: - -- The first two messages that the BitLocker Network Unlock client sends are DHCP DISCOVER\REQUEST messages. They use the Message Type option, so the DHCP server treats them as DHCP messages. -- The third message that the BitLocker Network Unlock client sends doesn't have the Message Type option. The DHCP server treats the message as a BOOTP request. - -A DHCP server that supports BOOTP clients must interact with those clients according to the BOOTP protocol. The server must create a BOOTP BOOTREPLY message instead of a DHCP DHCPOFFER message. In other words, the server must not include the DHCP message option type and must not exceed the size limit for BOOTREPLY messages. After the server sends the BOOTP BOOTREPLY message, the server marks a binding for a BOOTP client as BOUND. A non-DHCP client doesn't send a DHCPREQUEST message, nor does that client expect a DHCPACK message. - -If a DHCP server that isn't configured to support BOOTP clients receives a BOOTREQUEST message from a BOOTP client, that server silently discards the BOOTREQUEST message. - -For more information about DHCP and BitLocker Network Unlock, see [BitLocker: How to enable Network Unlock: Network Unlock sequence](/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock#network-unlock-sequence). - -### Resolution for unable to use BitLocker Network Unlock feature on a Windows client computer - -To resolve this issue, change the configuration of the DHCP server by changing the **DHCP** option from **DHCP and BOOTP** to **DHCP**. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md deleted file mode 100644 index 5292df2a16..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ /dev/null @@ -1,369 +0,0 @@ ---- -title: BitLocker recovery known issues -description: Describes common issues that can occur that prevent BitLocker from behaving as expected when recovering a drive, or may cause BitLocker to start recovery unexpectedly. The article provides guidance for addressing those issues. -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: - - Windows Security Technologies\BitLocker - - highpri -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# BitLocker recovery: known issues - -This article describes common issues that may prevent BitLocker from behaving as expected when a drive is recovered, or that may cause BitLocker to start recovery unexpectedly. The article also provides guidance to address these issues. - -> [!NOTE] -> In this article, "recovery password" refers to the 48-digit recovery password and "recovery key" refers to 32-digit recovery key. For more information, see [BitLocker key protectors](./prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors). - -## Windows prompts for a non-existing BitLocker recovery password - -Windows prompts for a BitLocker recovery password. However, a BitLocker recovery password wasn't configured. - -### Resolution for Windows prompts for a non-existing BitLocker recovery password - -The BitLocker and Active Directory Domain Services (AD DS) FAQ address situations that may produce this symptom, and provides information about the procedure to resolve the issue: - -- [What if BitLocker is enabled on a computer before the computer has joined the domain?](./bitlocker-and-adds-faq.yml#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) - -- [What happens if the backup initially fails? Will BitLocker retry the backup?](./bitlocker-and-adds-faq.yml) - -## The recovery password for a laptop wasn't backed up, and the laptop is locked - -Consider the following scenario: - -The hard disk of a Windows 11 or Windows 10 laptop has to be recovered. The disk was encrypted by using BitLocker Driver Encryption. However, the BitLocker recovery password wasn't backed up, and the usual user of the laptop isn't available to provide the password. - -### Resolution for the recovery password for a laptop wasn't backed up - -You can use either of the following methods to manually back up or synchronize an online client's existing recovery information: - -- Create a Windows Management Instrumentation (WMI) script that backs up the information. For more information, see [BitLocker Drive Encryption Provider](/windows/win32/secprov/bitlocker-drive-encryption-provider). - -- In an elevated Command Prompt window, use the [manage-bde.exe](/windows-server/administration/windows-commands/manage-bde) command to back up the information. - - For example, to back up all of the recovery information for the C: drive to AD DS, open an elevated Command Prompt window and run the following command: - - ```cmd - manage-bde.exe -protectors -adbackup C: - ``` - -> [!NOTE] -> BitLocker does not automatically manage this backup process. - -## Tablet devices don't support using `manage-bde.exe -forcerecovery` to test recovery mode - -Consider the following scenario: - -BitLocker recovery needs to be tested on a tablet or slate device by running the following command: - -```cmd -manage-bde.exe -forcerecovery -``` - -However, after entering the recovery password, the device can't start. - -### Cause of tablet devices don't support using `manage-bde.exe -forcerecovery` to test recovery mode - -> [!IMPORTANT] -> Tablet devices do not support the **`manage-bde.exe -forcerecovery`** command. - -This issue occurs because the Windows Boot Manager can't process touch-input during the pre-boot phase of startup. If Boot Manager detects that the device is a tablet, it redirects the startup process to the Windows Recovery Environment (WinRE), which can process touch-input. - -If WindowsRE detects the TPM protector on the hard disk, it does a PCR reseal. However, the **`manage-bde.exe -forcerecovery`** command deletes the TPM protectors on the hard disk. Therefore, WinRE can't reseal the PCRs. This failure triggers an infinite BitLocker recovery cycle and prevents Windows from starting. - -This behavior is by design for all versions of Windows. - -### Workaround for tablet devices don't support using `manage-bde.exe -forcerecovery` to test recovery mode - -To resolve the restart loop, follow these steps: - -1. On the BitLocker Recovery screen, select **Skip this drive**. - -2. Select **Troubleshoot** > **Advanced Options** > **Command Prompt**. - -3. In the Command Prompt window, run the following commands: - - ```cmd - manage-bde.exe -unlock C: -rp <48-digit BitLocker recovery password> - manage-bde.exe -protectors -disable C: - - ``` - -4. Close the Command Prompt window. - -5. Shut down the device. - -6. Start the device. Windows should start as usual. - -## After installing UEFI or TPM firmware updates on Surface, BitLocker prompts for the recovery password - -Consider the following scenario: - -A Surface device has BitLocker drive encryption turned on. The firmware of the Surface's TPM is updated or an update that changes the signature of the system firmware is installed. For example, the Surface TPM (IFX) update is installed. - -You experience one or more of the following symptoms on the Surface device: - -- At startup, the Surface device prompts for a BitLocker recovery password. The correct recovery password is entered, but Windows doesn't start up. - -- Startup progresses directly into the Surface device's Unified Extensible Firmware Interface (UEFI) settings. - -- The Surface device appears to be in an infinite restart loop. - -### Cause of after installing UEFI or TPM firmware updates on Surface, BitLocker prompts for the recovery password - -This issue occurs if the Surface device TPM is configured to use Platform Configuration Register (PCR) values other than the default values of PCR 7 and PCR 11. For example, the following settings can configure the TPM this way: - -- Secure boot is turned off. -- PCR values have been explicitly defined, such as by group policy. - -Devices that support Connected Standby (also known as *InstantGO* or *Always On, Always Connected PCs*), including Surface devices, must use PCR 7 of the TPM. In its default configuration on such systems, BitLocker binds to PCR 7 and PCR 11 if PCR 7 and Secure Boot are correctly configured. For more information, see the [About the Platform Configuration Register (PCR)](bitlocker-group-policy-settings.md#about-the-platform-configuration-register-pcr) section of the [BitLocker Group Policy Settings](bitlocker-group-policy-settings.md) article. - -### Resolution for after installing UEFI or TPM firmware updates on Surface, BitLocker prompts for the recovery password - -To verify the PCR values that are in use on a device, open an elevated Command Prompt window and run the following command: - -```cmd -manage-bde.exe -protectors -get : -``` - -In this command, *\* represents the drive letter of the operating system drive. - -To resolve this issue and repair the device, follow these steps: - -#### Step 1: Disable the TPM protectors on the boot drive - -If a TPM or UEFI update has been installed and the Surface device can't start, even if the correct BitLocker recovery password has been entered, the ability to start can be restored by using the BitLocker recovery password and a Surface recovery image to remove the TPM protectors from the boot drive. - -To use the BitLocker recovery password and a Surface recovery image to remove the TPM protectors from the boot drive, follow these steps: - -1. Obtain the BitLocker recovery password from the Surface user's [Microsoft.com account](https://account.microsoft.com/devices/recoverykey). If BitLocker is managed by a different method, such as Microsoft BitLocker Administration and Monitoring (MBAM), Configuration Manager BitLocker Management, or Intune, contact the administrator for help. - -2. Use another computer to download the Surface recovery image from [Surface Recovery Image Download](https://support.microsoft.com/surface-recovery-image). Use the downloaded image to create a USB recovery drive. - -3. Insert the USB Surface recovery image drive into the Surface device, and start the device. - -4. When prompted, select the following items: - - 1. The operating system language. - - 2. The keyboard layout. - -5. Select **Troubleshoot** > **Advanced Options** > **Command Prompt**. - -6. In the Command Prompt window, run the following commands: - - ```cmd - manage-bde.exe -unlock -recoverypassword : - manage-bde.exe -protectors -disable : - - ``` - - where: - - - *\* is the BitLocker recovery password that was obtained in Step 1 - - *\* is the drive letter that is assigned to the operating system drive - - > [!NOTE] - > For more information about how to use this command, see [manage-bde unlock](/windows-server/administration/windows-commands/manage-bde-unlock). - -7. Restart the computer. - -8. When prompted, enter the BitLocker recovery password that was obtained in Step 1. - -> [!NOTE] -> After the TPM protectors are disabled, BitLocker drive encryption no longer protects the device. To re-enable BitLocker drive encryption, select **Start**, type **Manage BitLocker**, and then press **Enter**. Follow the steps to encrypt the drive. - -#### Step 2: Use Surface BMR to recover data and reset the Surface device - -To recover data from the Surface device if Windows doesn't start, follow steps 1 through 5 of the section [Step 1: Disable the TPM protectors on the boot drive](#step-1-disable-the-tpm-protectors-on-the-boot-drive) to get to a Command Prompt window. Once a Command Prompt window is open, follow these steps: - -1. At the command prompt, run the following command: - - ```cmd - manage-bde.exe -unlock -recoverypassword : - ``` - - In this command, *\* is the BitLocker recovery password that was obtained in Step 1 of the section [Step 1: Disable the TPM protectors on the boot drive](#step-1-disable-the-tpm-protectors-on-the-boot-drive), and \<*DriveLetter*> is the drive letter that is assigned to the operating system drive. - -2. After the drive is unlocked, use the **`copy`** or **`xcopy.exe`** command to copy the user data to another drive. - - > [!NOTE] - > For more information about the these commands, see the [Windows commands](/windows-server/administration/windows-commands/windows-commands) article. - -3. To reset the device by using a Surface recovery image, follow the instructions in the article [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/surface/creating-and-using-a-usb-recovery-drive-for-surface-677852e2-ed34-45cb-40ef-398fc7d62c07). - -#### Step 3: Restore the default PCR values - -To prevent this issue from recurring, it's recommended to restore the default configuration of Secure Boot and the PCR values. - -To enable Secure Boot on a Surface device, follow these steps: - -1. Suspend BitLocker by opening an elevated Windows PowerShell window and running the following PowerShell cmdlet: - - ```powershell - Suspend-BitLocker -MountPoint ":" -RebootCount 0 - ``` - - In this command, *\* is the letter that is assigned to the drive. - -2. Restart the device, and then edit the UEFI settings to set the **Secure Boot** option to **Microsoft Only**. - -3. Restart the device and sign into Windows. - -4. Open an elevated PowerShell window and run the following PowerShell cmdlet: - - ```powershell - Resume-BitLocker -MountPoint ":" - ``` - -To reset the PCR settings on the TPM, follow these steps: - -1. Disable any Group Policy Objects that configure the PCR settings, or remove the device from any groups that enforce such policies. - - For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). - -2. Suspend BitLocker by opening an elevated Windows PowerShell window and running the following PowerShell cmdlet: - - ```powershell - Suspend-BitLocker -MountPoint ":" -RebootCount 0 - ``` - - In this command, *\* is the letter that is assigned to the drive. - -3. Run the following PowerShell cmdlet: - - ```powershell - Resume-BitLocker -MountPoint ":" - ``` - -#### Step 4: Suspend BitLocker during TPM or UEFI firmware updates - -You can avoid this scenario when installing updates to system firmware or TPM firmware by temporarily suspending BitLocker before applying such updates. - -> [!IMPORTANT] -> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, the PowerShell cmdlet [Suspend-BitLocker](/powershell/module/bitlocker/suspend-bitlocker) must be used and the **Reboot Count** parameter must be set to either of the following values: -> -> - **2** or greater: This value sets the number of times the device will restart before BitLocker Device Encryption resumes. For example, setting the value to **2** will cause BitLocker to resume after the device restarts twice. -> -> - **0**: This value suspends BitLocker Drive Encryption indefinitely. To resume BitLocker, the PowerShell cmdlet [Resume-BitLocker](/powershell/module/bitlocker/resume-bitlocker) or another mechanism needs to be used to resume BitLocker protection. - -To suspend BitLocker while installing TPM or UEFI firmware updates: - -1. Open an elevated Windows PowerShell window and run the following PowerShell cmdlet: - - ```powershell - Suspend-BitLocker -MountPoint ":" -RebootCount 0 - ``` - - In this PowerShell cmdlet, *\* is the letter that is assigned to the drive. - -2. Install the Surface device driver and firmware updates. - -3. After installing the firmware updates, restart the computer, open an elevated PowerShell window, and then run the following PowerShell cmdlet: - - ```powershell - Resume-BitLocker -MountPoint ":" - ``` - - - - - -## Credential Guard/Device Guard on TPM 1.2: At every restart, BitLocker prompts for the recovery password and returns error 0xC0210000 - -Consider the following scenario: - -A device uses TPM 1.2 and runs Windows 10, version 1809. The device also uses [Virtualization-based Security](/windows-hardware/design/device-experiences/oem-vbs) features such as [Device Guard and Credential Guard](/windows-hardware/drivers/bringup/device-guard-and-credential-guard). Every time the device is started, the device enters BitLocker Recovery mode and an error message similar to the following error message is displayed: - -> Recovery -> -> Your PC/Device needs to be repaired. -> A required file couldn't be accessed because your BitLocker key wasn't loaded correctly. -> -> Error code 0xc0210000 -> -> You'll need to use recovery tools. If you don't have any installation media (like a disc or USB device), contact your PC administrator or PC/Device manufacturer. - -### Cause of Credential Guard/Device Guard on TPM 1.2: At every restart, BitLocker prompts for the recovery password and returns error 0xC0210000 - -TPM 1.2 doesn't support Secure Launch. For more information, see [System Guard Secure Launch and SMM protection: Requirements Met by System Guard Enabled Machines](../../threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) - -For more information about this technology, see [Windows Defender System Guard: How a hardware-based root of trust helps protect Windows](../../threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) - -### Resolution for Credential Guard/Device Guard on TPM 1.2: At every restart, BitLocker prompts for the recovery password and returns error 0xC0210000 - -To resolve this issue, use one of the following two solutions: - -- Remove any device that uses TPM 1.2 from any group that is subject to GPOs that enforce secure launch. -- Edit the **Turn On Virtualization Based Security** GPO to set **Secure Launch Configuration** to **Disabled**. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md deleted file mode 100644 index c6628ccd73..0000000000 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md +++ /dev/null @@ -1,126 +0,0 @@ ---- -title: BitLocker and TPM other known issues -description: Describes common issues that relate directly to the TPM, and provides guidance for resolving those issues. -ms.reviewer: kaushika -ms.technology: itpro-security -ms.prod: windows-client -ms.localizationpriority: medium -author: frankroj -ms.author: frankroj -manager: aaroncz -ms.collection: Windows Security Technologies\BitLocker -ms.topic: troubleshooting -ms.date: 11/08/2022 -ms.custom: bitlocker ---- - -# BitLocker and TPM: other known issues - -This article describes common issues that relate directly to the trusted platform module (TPM), and provides guidance to address these issues. - -## Azure AD: Windows Hello for Business and single sign-on don't work - -Consider the following scenario: - -An Azure Active Directory (Azure AD)-joined client computer can't authenticate correctly. The computer is experiencing one or more of the following symptoms: - -- Windows Hello for Business doesn't work -- Conditional access fails -- Single sign-on (SSO) doesn't work - -Additionally, in Event Viewer, the computer logs the following Event ID 1026 event under **Windows Logs** > **System**: - -> Log Name: System -> Source: Microsoft-Windows-TPM-WMI -> Date: \ -> Event ID: 1026 -> Task Category: None -> Level: Information -> Keywords: -> User: SYSTEM -> Computer: \ -> Description: -> The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically. To set up the TPM interactively use the TPM management console (Start-\>tpm.msc) and use the action to make the TPM ready. -> Error: The TPM is defending against dictionary attacks and is in a time-out period. -> Additional Information: 0x840000 - -### Cause of Azure AD: Windows Hello for Business and single sign-on don't work - -This event indicates that the TPM isn't ready or has some setting that prevents access to the TPM keys. - -Additionally, the behavior indicates that the client computer can't obtain a [Primary Refresh Token (PRT)](/azure/active-directory/devices/concept-primary-refresh-token). - -### Resolution for Azure AD: Windows Hello for Business and single sign-on don't work - -To verify the status of the PRT, use the [dsregcmd.exe /status](/azure/active-directory/devices/troubleshoot-device-dsregcmd) command to collect information. In the tool output, verify that either **User state** or **SSO state** contains the **AzureAdPrt** attribute. If the value of this attribute is **No**, the PRT wasn't issued. If the value of the attribute is **No**, it may indicate that the computer couldn't present its certificate for authentication. - -To resolve this issue, follow these steps to troubleshoot the TPM: - -1. Open the TPM management console (`tpm.msc`) by selecting **Start** and entering **tpm.msc** in the **Search** box. - -2. If a notice is displayed to either unlock the TPM or reset the lockout, contact the hardware vendor to determine whether there's a known fix for the issue. - -3. If the issue is still not resolved after contacting the hardware vendor, clear and reinitialize the TPM by following the instructions in the article [Troubleshoot the TPM: Clear all the keys from the TPM](../tpm/initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). - - > [!WARNING] - > Clearing the TPM can cause data loss. - -If in Step 2 there's no notice to either unlock the TPM or reset the lockout, review the UEFI firmware/BIOS settings of the computer for any setting that can be used to reset or disable the lockout. - -## TPM 1.2 Error: Loading the management console failed. The device that is required by the cryptographic provider isn't ready for use - -Consider the following scenario: - -When trying to open the TPM management console on a Windows computer that uses TPM version 1.2, the following message is displayed: - -> Loading the management console failed. The device that is required by the cryptographic provider is not ready for use. -> HRESULT 0x800900300x80090030 - NTE\_DEVICE\_NOT\_READY -> The device that is required by this cryptographic provider is not ready for use. -> TPM Spec version: TPM v1.2 - -On a different device that is running the same version of Windows, the TPM management console can be opened. - -### Cause (suspected) of TPM 1.2 Error: Loading the management console failed. The device that is required by the cryptographic provider isn't ready for use - -These symptoms indicate that the TPM has hardware or firmware issues. - -### Resolution for TPM 1.2 Error: Loading the management console failed. The device that is required by the cryptographic provider isn't ready for use - -To resolve the issue: - -- Switch the TPM operating mode from version 1.2 to version 2.0 if the device has this option available. - -- If switching the TPM from version 1.2 to version 2.0 doesn't resolve the issue, or if the device doesn't have TPM version 2.0 available, contact the hardware vendor to determine whether there's a UEFI firmware update/BIOS update/TPM update for the device. If there's an update available, install the update to see if it resolves the issue. - -- If updating the UEFI firmware/BIOS doesn't resolve the issue, or if there's no update available, consider replacing the device motherboard by contacting the hardware vendor. After the motherboard has been replaced, switch the TPM operating mode from version 1.2 to version 2.0 if this option is available. - - > [!WARNING] - > Replacing the motherboard will cause data in the TPM to be lost. - -## Devices don't join hybrid Azure AD because of a TPM issue - -When trying to join a device to a hybrid Azure AD, the join operation appears to fail. - -To verify that the join succeeded, use the [dsregcmd /status command](/azure/active-directory/devices/troubleshoot-device-dsregcmd). In the tool output, the following attributes indicate that the join succeeded: - -- **AzureAdJoined: YES** -- **DomainName: \<*on-prem Domain name*\>** - -If the value of **AzureADJoined** is **No**, the join operation failed. - -### Causes and resolutions for devices don't join hybrid Azure AD because of a TPM issue - -This issue may occur when the Windows operating system isn't the owner of the TPM. The specific fix for this issue depends on which errors or events are displayed, as shown in the following table: - -|Message |Reason | Resolution| -| - | - | - | -|*NTE\_BAD\_KEYSET (0x80090016/-2146893802)* |TPM operation failed or was invalid |This issue was probably caused by a corrupted sysprep image. When creating a sysprep image, make sure to use a computer that isn't joined to or registered in Azure AD or hybrid Azure AD. | -|*TPM\_E\_PCP\_INTERNAL\_ERROR (0x80290407/-2144795641)* |Generic TPM error. |If the device returns this error, disable its TPM. Windows 10, version 1809 and later versions, automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | -|*TPM\_E\_NOTFIPS (0x80280036/-2144862154*) |The FIPS mode of the TPM is currently not supported. |If the device gives this error, disable its TPM. Windows 10, version 1809 and later versions, automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | -|*NTE\_AUTHENTICATION\_IGNORED (0x80090031/-2146893775)* |The TPM is locked out. |This error is transient. Wait for the cooldown period, and then retry the join operation. | - -For more information about TPM issues, see the following articles: - -- [TPM fundamentals: Anti-hammering](../tpm/tpm-fundamentals.md#anti-hammering) -- [Troubleshooting hybrid Azure Active Directory-joined devices](/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current) -- [Troubleshoot the TPM](../tpm/initialize-and-configure-ownership-of-the-tpm.md) \ No newline at end of file From 0df0f616643675880b39755d12d86690e01afbbd Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 09:27:09 -0500 Subject: [PATCH 068/324] Remove troubleshooting articles from USMT and BitLocker 5 --- .openpublishing.redirection.json | 45 -------------------------------- 1 file changed, 45 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index eca0b9e1b8..b4524b1497 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20184,51 +20184,6 @@ "source_path": "windows/deployment/usmt/usmt-return-codes.md", "redirect_url": "/troubleshoot/windows-client/deployment/usmt-return-codes", "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-tpm-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-configuration-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/decode-measured-boot-logs-to-track-pcr-changes", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues", - "redirect_document_id": false - }, - { - "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md", - "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-and-tpm-other-known-issues", - "redirect_document_id": false } ] } \ No newline at end of file From c6d145f23aee38da356d8f070c969921d0a7f169 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 29 Nov 2022 10:52:01 -0500 Subject: [PATCH 069/324] Minor updates --- .../mdm/policies-in-policy-csp-admx-backed.md | 2 +- ...in-policy-csp-supported-by-group-policy.md | 2 +- .../mdm/policy-csp-admx-mss-legacy.md | 9 +++++- .../mdm/policy-csp-admx-qos.md | 9 +++++- .../mdm/policy-csp-admx-sam.md | 9 +++++- .../mdm/policy-csp-admx-tabletpcinputpanel.md | 9 +++++- .../mdm/policy-csp-msslegacy.md | 9 +++++- .../mdm/policy-csp-settingssync.md | 9 +++++- .../mdm/policy-csp-tenantrestrictions.md | 9 +++++- .../mdm/policy-csp-windowslogon.md | 28 ++++++++++++++++++- 10 files changed, 85 insertions(+), 10 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 5270d3eb1d..0224b374cf 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -4,7 +4,7 @@ description: Learn about the ADMX-backed policies in Policy CSP. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/22/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md index f1cfc9181d..df5363e3dd 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md +++ b/windows/client-management/mdm/policies-in-policy-csp-supported-by-group-policy.md @@ -4,7 +4,7 @@ description: Learn about the policies in Policy CSP supported by Group Policy. author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/22/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage diff --git a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md index 431042dcfc..a22c707db1 100644 --- a/windows/client-management/mdm/policy-csp-admx-mss-legacy.md +++ b/windows/client-management/mdm/policy-csp-admx-mss-legacy.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_MSS-legacy Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - ADMX_MSS-legacy +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-admx-qos.md b/windows/client-management/mdm/policy-csp-admx-qos.md index 16de0b24d3..615fe1f468 100644 --- a/windows/client-management/mdm/policy-csp-admx-qos.md +++ b/windows/client-management/mdm/policy-csp-admx-qos.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_QOS Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - ADMX_QOS +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-admx-sam.md b/windows/client-management/mdm/policy-csp-admx-sam.md index 1b323dbf05..16f8928707 100644 --- a/windows/client-management/mdm/policy-csp-admx-sam.md +++ b/windows/client-management/mdm/policy-csp-admx-sam.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_sam Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - ADMX_sam +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md index 57873e933e..b8297ea689 100644 --- a/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-tabletpcinputpanel.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_TabletPCInputPanel Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - ADMX_TabletPCInputPanel +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index d12e7e99bd..c7e71ee0cf 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -4,7 +4,7 @@ description: Learn more about the MSSLegacy Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - MSSLegacy +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-settingssync.md b/windows/client-management/mdm/policy-csp-settingssync.md index add8ac2252..3be0b76457 100644 --- a/windows/client-management/mdm/policy-csp-settingssync.md +++ b/windows/client-management/mdm/policy-csp-settingssync.md @@ -4,7 +4,7 @@ description: Learn more about the SettingsSync Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - SettingsSync +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-tenantrestrictions.md b/windows/client-management/mdm/policy-csp-tenantrestrictions.md index 053642d032..936808277a 100644 --- a/windows/client-management/mdm/policy-csp-tenantrestrictions.md +++ b/windows/client-management/mdm/policy-csp-tenantrestrictions.md @@ -4,7 +4,7 @@ description: Learn more about the TenantRestrictions Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/02/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -16,6 +16,13 @@ ms.topic: reference # Policy CSP - TenantRestrictions +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 95902680cc..33e709f97a 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsLogon Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/22/2022 +ms.date: 11/29/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -258,6 +258,32 @@ If you disable or don't configure this policy setting, any user can disconnect t +**Example**: + +Here's an example to enable this policy: + +```xml + + + + 300 + + 301 + + + ./Device/Vendor/MSFT/Policy/Config/WindowsLogon/DontDisplayNetworkSelectionUI + + + chr + + ]]> + + + + + + +``` From fba8a94548339e1a92213a7219fda50ad9a01447 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 11:41:32 -0500 Subject: [PATCH 070/324] Remove troubleshooting articles from USMT and BitLocker 6 --- .openpublishing.redirection.json | 45 +++++++++++++++++++ .../bitlocker/bitlocker-overview.md | 2 +- 2 files changed, 46 insertions(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index b4524b1497..eca0b9e1b8 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20184,6 +20184,51 @@ "source_path": "windows/deployment/usmt/usmt-return-codes.md", "redirect_url": "/troubleshoot/windows-client/deployment/usmt-return-codes", "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-cannot-encrypt-a-drive-known-tpm-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-configuration-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/decode-measured-boot-logs-to-track-pcr-changes", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/enforcing-bitlocker-policies-by-using-intune-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-network-unlock-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-recovery-known-issues", + "redirect_document_id": false + }, + { + "source_path": "windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md", + "redirect_url": "/troubleshoot/windows-client/windows-security/bitlocker-and-tpm-other-known-issues", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 5f2e312fe5..de852a1f48 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -97,6 +97,6 @@ When installing the BitLocker optional component on a server, the Enhanced Stora | [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This article describes the BCD settings that are used by BitLocker.| | [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This article describes how to recover BitLocker keys from AD DS. | | [Protect BitLocker from pre-boot attacks](./bitlocker-countermeasures.md)| This detailed guide helps you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device's configuration. | -| [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | +| [Troubleshoot BitLocker](/troubleshoot/windows-client/windows-security/bitlocker-issues-troubleshooting) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | | [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This article describes how to protect CSVs and SANs with BitLocker.| | [Enabling Secure Boot and BitLocker Device Encryption on Windows IoT Core](/windows/iot-core/secure-your-device/SecureBootAndBitLocker) | This article describes how to use BitLocker with Windows IoT Core | From 3dba4cda7262ed2d5ca6d88be14982f74f00b022 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 13:56:29 -0500 Subject: [PATCH 071/324] MDT code block standardization plus style updates 2 --- .../get-started-with-the-microsoft-deployment-toolkit.md | 2 +- .../deployment/deploy-windows-mdt/use-web-services-in-mdt.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index a178e2f7e5..73c2d4b629 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -147,7 +147,7 @@ You can think of a task sequence as a list of actions that need to be executed i - **Gather**: Reads configuration settings from the deployment server. - **Format and Partition**: Creates the partition(s) and formats them. - **Inject Drivers**: Finds out which drivers the machine needs and downloads them from the central driver repository. -- **Apply Operating System**: Uses ImageX to apply the image. +- **Apply Operating System**: Applies the Windows image. - **Windows Update**: Connects to a WSUS server and updates the machine. ## Task sequence templates diff --git a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md index 3f9a73aaa4..02770d5644 100644 --- a/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md +++ b/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt.md @@ -83,7 +83,7 @@ This section assumes that you've enabled the Web Server (IIS) role on MDT01. ## Test the web service in Internet Explorer -1. On PC0001, using Internet Explorer, navigate to: **`http://MDT01/MDTSample/mdtsample.asmx**`. +1. On PC0001, using Internet Explorer, navigate to: **`http://MDT01/MDTSample/mdtsample.asmx'**. 2. Select the **GetComputerName** link. From 3538d7b7ee97359ad53d68caae242dd85b825e96 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 29 Nov 2022 15:46:59 -0500 Subject: [PATCH 072/324] Update policy-csp-controlpolicyconflict.md --- .../mdm/policy-csp-controlpolicyconflict.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 0a98ca8f3a..0e435678e9 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -35,10 +35,10 @@ manager: aaroncz > [!NOTE] > This setting doesn't apply to the following types of group policies: > -> - If they don't map to an MDM policy. For example, firewall policies and account lockout policies. -> - If they aren't defined by an ADMX. For example, Password policy - minimum password age. -> - If they're in the Windows Update category. -> - If they have list entries. For example, the Microsoft Edge CookiesAllowedForUrls policy. +> - If they don't map to an MDM policy. For example, Windows Settings > Security Settings > Public Key Policies. +> - If they are group policies that aren't defined by an ADMX template. For example, Windows Settings > Scripts. +> - If they have list entries. For example, Administrative Templates > Windows Components > ActiveX Installer Service > Approved Installation Sites for ActiveX Controls. +> - If they are in the Windows Update category. From 5a1cb35669ee6eae82add2a8ed24adb3bff66457 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 29 Nov 2022 17:22:55 -0500 Subject: [PATCH 073/324] Update new-in-windows-mdm-enrollment-management.md --- .../new-in-windows-mdm-enrollment-management.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/new-in-windows-mdm-enrollment-management.md b/windows/client-management/new-in-windows-mdm-enrollment-management.md index b87e711db8..74ca04fcc6 100644 --- a/windows/client-management/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/new-in-windows-mdm-enrollment-management.md @@ -348,9 +348,9 @@ No. Only one MDM is allowed. Entry | Description --------------- | -------------------- -What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. This service doesn't send telemetry.| -How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service will cause your management to fail.| +What is dmwappushsvc? | It's a Windows service that ships in Windows 10 and Windows 11 operating system as a part of the windows management platform. It's used internally by the operating system as a queue for categorizing and processing all Wireless Application Protocol (WAP) messages, which include Windows management messages, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | +What data is handled by dmwappushsvc? | It's a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further. This service doesn't send telemetry.| +How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc) and locating *Device Management Wireless Application Protocol (WAP) Push message Routing Service*. However, since this service is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to disable the service. Disabling this service will cause your management to fail.| ## Change history for MDM documentation From 5f19512340b464e585f6515a57505e55e5770d5c Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 29 Nov 2022 17:36:30 -0500 Subject: [PATCH 074/324] Update policy-csp-controlpolicyconflict.md --- .../mdm/policy-csp-controlpolicyconflict.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 0e435678e9..98923c408a 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -20,15 +20,6 @@ manager: aaroncz ## ControlPolicyConflict policies -
    -
    - ControlPolicyConflict/MDMWinsOverGP -
    -
    - - -
    - **ControlPolicyConflict/MDMWinsOverGP** From 49c5e27158bcef3119d502e8c232b71c60292ecf Mon Sep 17 00:00:00 2001 From: scottmca <89857809+scottmca@users.noreply.github.com> Date: Tue, 29 Nov 2022 17:48:02 -0500 Subject: [PATCH 075/324] Update stop-employees-from-using-microsoft-store.md Updating to add CSP specific info and also adding info on specific group policy so it is easier to find --- .../stop-employees-from-using-microsoft-store.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index db9259cab0..eeddc55c93 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -73,6 +73,8 @@ For more information, see [Configure an MDM provider](/microsoft-store/configure For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). +> [!Important] +> If you block access to the Store using CSP you need to also configure [AllowAppStoreAutoUpdate](//windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store ## Block Microsoft Store using Group Policy @@ -95,7 +97,7 @@ You can also use Group Policy to manage access to Microsoft Store. 4. On the **Turn off the Store application** setting page, click **Enabled**, and then click **OK**. > [!Important] -> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This configuration allows in-box store apps to update while still blocking access to the store. +> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under Computer Configuration\Administrative templates\Windows Components\Store. This configuration allows in-box store apps to update while still blocking access to the store. ## Show private store only using Group Policy From ca1bf2ac4e171bd83f23ed52af91fa0d2ab76cb0 Mon Sep 17 00:00:00 2001 From: Shota Kunishige <63525615+ShotaKunishige@users.noreply.github.com> Date: Wed, 30 Nov 2022 08:39:00 +0900 Subject: [PATCH 076/324] Delete device-restrictions-windows-10 --- mem/intune/configuration/device-restrictions-windows-10 | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 mem/intune/configuration/device-restrictions-windows-10 diff --git a/mem/intune/configuration/device-restrictions-windows-10 b/mem/intune/configuration/device-restrictions-windows-10 deleted file mode 100644 index e69de29bb2..0000000000 From bd4aa66b1960eb1785d2faee684de4b5600f68d5 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 19:01:29 -0500 Subject: [PATCH 077/324] Cleaning article --- .../stop-employees-from-using-microsoft-store.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index eeddc55c93..55b343af98 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -29,11 +29,11 @@ IT pros can configure access to Microsoft Store for client computers in their or ## Options to configure access to Microsoft Store -You can use these tools to configure access to Microsoft Store: AppLocker or Group Policy. For Windows 10, this is only supported on Windows 10 Enterprise edition. +You can use these tools to configure access to Microsoft Store: AppLocker or Group Policy. For Windows 10, this is only supported on Windows 10 Enterprise edition. ## Block Microsoft Store using AppLocker -Applies to: Windows 10 Enterprise, Windows 10 Education +Applies to: Windows 10 Enterprise, Windows 10 Education AppLocker provides policy-based access control management for applications. You can block access to Microsoft Store app with AppLocker by creating a rule for packaged apps. You'll give the name of the Microsoft Store app as the packaged app that you want to block from client computers. @@ -79,7 +79,7 @@ For more information on the rules available via AppLocker on the different suppo ## Block Microsoft Store using Group Policy -Applies to: Windows 10 Enterprise, Windows 10 Education +Applies to: Windows 10 Enterprise, Windows 10 Education > [!Note] > Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). @@ -101,7 +101,7 @@ You can also use Group Policy to manage access to Microsoft Store. ## Show private store only using Group Policy -Applies to Windows 10 Enterprise, Windows 10 Education +Applies to Windows 10 Enterprise, Windows 10 Education If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. @@ -124,4 +124,4 @@ If you're using Microsoft Store for Business and you want employees to only see [Manage access to private store](/microsoft-store/manage-access-to-private-store) -  + From 011c4be0fc556eb7cbc08dc1ad856e30a184a336 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 19:04:05 -0500 Subject: [PATCH 078/324] Cleaning article 2 --- .../stop-employees-from-using-microsoft-store.md | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 55b343af98..3ce882b362 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -24,7 +24,7 @@ ms.technology: itpro-configure IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. -> [!Important] +> [!IMPORTANT] > All executable code including Microsoft Store applications should have an update and maintenance plan. Organizations that use Microsoft Store applications should ensure that the applications can be updated through the Microsoft Store over the internet, through the [Private Store](/microsoft-store/distribute-apps-from-your-private-store), or [distributed offline](/microsoft-store/distribute-offline-apps) to keep the applications up to date. ## Options to configure access to Microsoft Store @@ -73,7 +73,7 @@ For more information, see [Configure an MDM provider](/microsoft-store/configure For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). -> [!Important] +> [!IMPORTANT] > If you block access to the Store using CSP you need to also configure [AllowAppStoreAutoUpdate](//windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store ## Block Microsoft Store using Group Policy @@ -81,7 +81,7 @@ For more information on the rules available via AppLocker on the different suppo Applies to: Windows 10 Enterprise, Windows 10 Education -> [!Note] +> [!NOTE] > Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). You can also use Group Policy to manage access to Microsoft Store. @@ -96,7 +96,7 @@ You can also use Group Policy to manage access to Microsoft Store. 4. On the **Turn off the Store application** setting page, click **Enabled**, and then click **OK**. -> [!Important] +> [!IMPORTANT] > When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under Computer Configuration\Administrative templates\Windows Components\Store. This configuration allows in-box store apps to update while still blocking access to the store. ## Show private store only using Group Policy @@ -122,6 +122,3 @@ If you're using Microsoft Store for Business and you want employees to only see [Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store) [Manage access to private store](/microsoft-store/manage-access-to-private-store) - - - From ef277156076d325e285b6b68fc0e6ad9e09dd928 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Tue, 29 Nov 2022 16:29:39 -0800 Subject: [PATCH 079/324] Update use-code-signing-to-simplify-application-control-for-classic-windows-applications.md --- ...ontrol-for-classic-windows-applications.md | 56 ++++++++----------- 1 file changed, 22 insertions(+), 34 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md index 953d9ae95e..c7b971eed4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md @@ -1,6 +1,6 @@ --- -title: Use code signing to simplify application control for classic Windows applications (Windows) -description: With embedded signing, your WDAC policies typically don't have to be updated when an app is updated. To set up this embedded signing, you can choose from various methods. +title: Use code signing for added control and protection with WDAC +description: Code signing can be used to better control win32 app authorization and add protection for your WDAC policies. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: windows-client @@ -11,14 +11,14 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 05/03/2018 +ms.date: 11/29/2022 ms.technology: itpro-security --- -# Use code signing to simplify application control for classic Windows applications +# Use code signing for added control and protection with WDAC **Applies to:** @@ -29,45 +29,33 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -This topic covers guidelines for using code signing control classic Windows apps. +## What is code signing and why is it important? -## Reviewing your applications: application signing and catalog files +Code signing provides some important benefits to application security features like Windows Defender Application Control (WDAC). First, it allows the system to cryptographically verify that a file hasn't been tampered with since it was signed and before any code is allowed to run. Second, it associates the file with a real-world identity, such as a company or an individual developer. This identity can make your WDAC policy trust decisions easier and allows for real-world consequences when code signing is abused or used maliciously. Although Windows doesn't require software developers to digitally sign their code, most major independent software vendors (ISV) do use code signing for much of their code. And metadata that a developer includes in a file's resource header (.RSRC), such as OriginalFileName or ProductName, can be combined with the file's signing certificate to limit the scope of trust decisions. For example, instead of allowing everything signed by Microsoft, you can choose to allow only files signed by Microsoft where ProductName is "Microsoft Teams". Then use other rules to authorize any other files that need to run. -Typically, Windows Defender Application Control (WDAC) policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This purpose means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a "catalog file" from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed. +Wherever possible, you should require all app binaries and scripts are code signed as part of your app acceptance criteria. And, you should ensure that internal line-of-business (LOB) app developers have access to code signing certificates controlled by your organization. -Catalog files can be useful for unsigned LOB applications that can't easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your Windows Defender Application Control policies typically don't have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of WDAC (compared to using catalog signing). +## Catalog signing -To obtain signed applications or embed signatures in your in-house applications, you can choose from various methods: +App binaries and scripts are typically either embed-signed or catalog-signed. Embedded signatures become part of the file itself and are carried with the file wherever it's copied or moved. Catalog signatures, on the other hand, are detached from the individual file(s). Instead, a separate "catalog file" is created that contains hash values for one or more files to be signed. This catalog file is then digitally signed and applied to any computer where you want the signature to exist. Any file whose hash value is included in the signed catalog inherits the signature from the catalog file. A file may have multiple signatures, including a mix of embedded and catalog signatures. -- Using the Microsoft Store publishing process. All apps that come out of the Microsoft Store are automatically signed with special signatures that can roll up to our certificate authority (CA) or to your own. +You can use catalog files to easily add a signature to an existing application without needing access to the original source files and without any expensive repackaging. You can even use catalog files to add your own signature to an ISV app when you don't want to trust everything the ISV signs directly, themselves. Then you just deploy the signed catalog along with the app to all your managed endpoints. -- Using your own digital certificate or public key infrastructure (PKI). ISV's and enterprises can sign their own Classic Windows applications themselves, adding themselves to the trusted list of signers. +> [!NOTE] Since catalogs identify the files they sign by hash, any change to the file may invalidate its signature. You will need to deploy updated catalog signatures any time the application is updated. Integrating code signing with your app development or app deployment processes is generally the best approach. Be aware of self-updating apps, as their app binaries may change without your knowledge. -- Using a non-Microsoft signing authority. ISV's and enterprises can use a trusted non-Microsoft signing authority to sign all of their own Classic Windows applications. +To learn how to create and manage catalog files for existing apps, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). -To use catalog signing, you can choose from the following options: +## Signed WDAC policies -- Use the Windows Defender signing portal available in the Microsoft Store for Business and Education. The portal is a Microsoft web service that you can use to sign your Classic Windows applications. +While a WDAC policy begins as an XML document, it's then converted into a binary-encoded file before deployment. This binary version of your WDAC policy can be code signed like any other application binary, offering many of the same benefits as described above for signed code. Additionally, signed policies are treated specially by WDAC and help protect against tampering or removal of a WDAC policy even by an admin user. -- Create your own catalog files, which are described in the next section. +For more information on using signed WDAC policies, see [Use signed policies to protect WDAC against tampering](/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering) -### Catalog files +## Obtain code signing certificates for your own use -Catalog files (which you can create in Windows 10 and Windows 11 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you don't want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by Windows Defender Application Control in the same way as any other signed application. +Some ways to obtain code signing certificates for your own use, include: -Catalog files are Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries' hash values are updated each time an application is updated, which requires the catalog file to be updated also. - -After you've created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files. - -> [!NOTE] -> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, Windows 2016 Server, or Windows Enterprise IoT. - -For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). - -## Windows Defender Application Control policy formats and signing - -When you generate a Windows Defender Application Control policy, you're generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 and Windows 11 Enterprise, along with restrictions on Windows 10 and Windows 11 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file. - -We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command. - -When the Windows Defender Application Control policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add more protection against administrative users changing or removing the policy. +- Purchase a code signing certificate from one of the [Microsoft Trusted Root Program participants](/security/trusted-root/participants-list.md) +- Use your own digital certificate or public key infrastructure (PKI) to issue code signing certificates +- Use Microsoft's [Azure Code Signing (ACS)](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-code-signing-democratizing-trust-for-developers-and/ba-p/3604669) service +- Use the ["Device Guard signing service v2"](/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business) From fddd7c69d65690e330a0b6da12c3bc05cdda2639 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 20:02:31 -0500 Subject: [PATCH 080/324] Cleaning article plus some style updates --- ...op-employees-from-using-microsoft-store.md | 67 +++++++++---------- 1 file changed, 32 insertions(+), 35 deletions(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 3ce882b362..b56d6ea94c 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -8,17 +8,16 @@ author: lizgt2000 ms.author: lizlong ms.topic: conceptual ms.localizationpriority: medium -ms.date: 4/16/2018 +ms.date: 11/29/2022 ms.collection: highpri ms.technology: itpro-configure --- # Configure access to Microsoft Store +**Applies to:** -**Applies to** - -- Windows 10 +- Windows 10 >For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). @@ -29,38 +28,37 @@ IT pros can configure access to Microsoft Store for client computers in their or ## Options to configure access to Microsoft Store -You can use these tools to configure access to Microsoft Store: AppLocker or Group Policy. For Windows 10, this is only supported on Windows 10 Enterprise edition. +You can use either AppLocker or Group Policy to configure access to Microsoft Store. For Windows 10, configuring access to Microsoft Store is only supported on Windows 10 Enterprise edition. -## Block Microsoft Store using AppLocker +## Block Microsoft Store using AppLocker Applies to: Windows 10 Enterprise, Windows 10 Education - AppLocker provides policy-based access control management for applications. You can block access to Microsoft Store app with AppLocker by creating a rule for packaged apps. You'll give the name of the Microsoft Store app as the packaged app that you want to block from client computers. For more information on AppLocker, see [What is AppLocker?](/windows/device-security/applocker/what-is-applocker) For more information on creating an AppLocker rule for app packages, see [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps). -**To block Microsoft Store using AppLocker** +**To block Microsoft Store using AppLocker:** -1. Type secpol in the search bar to find and start AppLocker. +1. Enter **`secpol`** in the search bar to find and start AppLocker. -2. In the console tree of the snap-in, click **Application Control Policies**, click **AppLocker**, and then click **Packaged app Rules**. +2. In the console tree of the snap-in, select **Application Control Policies**, select **AppLocker**, and then select **Packaged app Rules**. -3. On the **Action** menu, or by right-clicking on **Packaged app Rules**, click **Create New Rule**. +3. On the **Action** menu, or by right-clicking on **Packaged app Rules**, select **Create New Rule**. -4. On **Before You Begin**, click **Next**. +4. On **Before You Begin**, select **Next**. -5. On **Permissions**, select the action (allow or deny) and the user or group that the rule should apply to, and then click **Next**. +5. On **Permissions**, select the action (allow or deny) and the user or group that the rule should apply to, and then select **Next**. -6. On **Publisher**, you can select **Use an installed app package as a reference**, and then click **Select**. +6. On **Publisher**, you can select **Use an installed app package as a reference**, and then select **Select**. -7. On **Select applications**, find and click **Store** under **Applications** column, and then click **OK**. Click **Next**. +7. On **Select applications**, find and select **Store** under **Applications** column, and then select **OK**. Select **Next**. [Create a rule for packaged apps](/windows/device-security/applocker/create-a-rule-for-packaged-apps) has more information on reference options and setting the scope on packaged app rules. -8. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. This allows you to add exceptions based on the same rule reference and rule scope as you set before. Click **Next**. +8. Optional: On **Exceptions**, specify conditions by which to exclude files from being affected by the rule. Conditions allow you to add exceptions based on the same rule reference and rule scope as you set before. Select **Next**. -## Block Microsoft Store using configuration service provider +## Block Microsoft Store using configuration service provider Applies to: Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education @@ -76,48 +74,47 @@ For more information on the rules available via AppLocker on the different suppo > [!IMPORTANT] > If you block access to the Store using CSP you need to also configure [AllowAppStoreAutoUpdate](//windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store -## Block Microsoft Store using Group Policy +## Block Microsoft Store using Group Policy - -Applies to: Windows 10 Enterprise, Windows 10 Education +Applies to: Windows 10 Enterprise, Windows 10 Education > [!NOTE] > Not supported on Windows 10 Pro, starting with version 1511. For more info, see [Knowledge Base article #3135657](/troubleshoot/windows-client/group-policy/cannot-disable-microsoft-store). You can also use Group Policy to manage access to Microsoft Store. -**To block Microsoft Store using Group Policy** +**To block Microsoft Store using Group Policy:** -1. Type gpedit in the search bar to find and start Group Policy Editor. +1. Enter **`gpedit`** in the search bar to find and start Group Policy Editor. -2. In the console tree of the snap-in, click **Computer Configuration**, click **Administrative Templates**, click **Windows Components**, and then click **Store**. +2. In the console tree of the snap-in, select **Computer Configuration**, select **Administrative Templates**, select **Windows Components**, and then select **Store**. -3. In the Setting pane, click **Turn off the Store application**, and then click **Edit policy setting**. +3. In the Setting pane, select **Turn off the Store application**, and then select **Edit policy setting**. -4. On the **Turn off the Store application** setting page, click **Enabled**, and then click **OK**. +4. On the **Turn off the Store application** setting page, select **Enabled**, and then select **OK**. > [!IMPORTANT] -> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under Computer Configuration\Administrative templates\Windows Components\Store. This configuration allows in-box store apps to update while still blocking access to the store. +> When you enable the policy to **Turn off the Store application**, it turns off app updates from the Microsoft Store. To allow store apps to update, disable the policy to **Turn off automatic download and install of Updates**. This policy is found under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store**. This configuration allows in-box store apps to update while still blocking access to the store. -## Show private store only using Group Policy +## Show private store only using Group Policy Applies to Windows 10 Enterprise, Windows 10 Education -If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. +If you're using Microsoft Store for Business and you want employees to only see apps you're managing in your private store, you can use Group Policy to show only the private store. Microsoft Store app will still be available, but employees can't view or purchase apps. Employees can view and install apps that the admin has added to your organization's private store. -**To show private store only in Microsoft Store app** +**To show private store only in Microsoft Store app:** -1. Type **gpedit** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. +1. Type **`gpedit`** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. -2. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then click **Store**. +2. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then select **Store**. -3. Right-click **Only display the private store within the Microsoft Store app** in the right pane, and click **Edit**. +3. Right-click **Only display the private store within the Microsoft Store app** in the right pane, and select **Edit**. - This opens the **Only display the private store within the Microsoft Store app** policy settings. + The **Only display the private store within the Microsoft Store app** policy settings will open. -4. On the **Only display the private store within the Microsoft Store app** setting page, click **Enabled**, and then click **OK**. +4. On the **Only display the private store within the Microsoft Store app** setting page, select **Enabled**, and then select **OK**. -## Related topics +## Related articles [Distribute apps using your private store](/microsoft-store/distribute-apps-from-your-private-store) From df96542e0dd0e9599c373523ba43321793082099 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 20:10:03 -0500 Subject: [PATCH 081/324] Corrected new link --- .../configuration/stop-employees-from-using-microsoft-store.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index b56d6ea94c..b30b8313fd 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -72,7 +72,7 @@ For more information, see [Configure an MDM provider](/microsoft-store/configure For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). > [!IMPORTANT] -> If you block access to the Store using CSP you need to also configure [AllowAppStoreAutoUpdate](//windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store +> If you block access to the Store using CSP, you need to also configure [AllowAppStoreAutoUpdate](../client-management/mdm/policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store. ## Block Microsoft Store using Group Policy From 28e782a0d7483123ed5942949c8f6bc84488d719 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 20:14:57 -0500 Subject: [PATCH 082/324] Really corrected new link this time --- .../configuration/stop-employees-from-using-microsoft-store.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index b30b8313fd..c3536efaa3 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -72,7 +72,7 @@ For more information, see [Configure an MDM provider](/microsoft-store/configure For more information on the rules available via AppLocker on the different supported operating systems, see [Operating system requirements](/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker#operating-system-requirements). > [!IMPORTANT] -> If you block access to the Store using CSP, you need to also configure [AllowAppStoreAutoUpdate](../client-management/mdm/policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store. +> If you block access to the Store using CSP, you need to also configure [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate) to enable in-box store apps to update while still blocking access to the store. ## Block Microsoft Store using Group Policy From 2a444e4f94e2ffda99009373a24bd40b505b458f Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 29 Nov 2022 20:18:42 -0500 Subject: [PATCH 083/324] One last style update --- .../configuration/stop-employees-from-using-microsoft-store.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index c3536efaa3..3145878746 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -19,7 +19,8 @@ ms.technology: itpro-configure - Windows 10 ->For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). +> [!TIP] +> For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. From 3393cd911cd035f0e9b4948fb1ed51a15fa306d3 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 30 Nov 2022 09:17:38 -0500 Subject: [PATCH 084/324] Replace Type with Enter --- .../configuration/stop-employees-from-using-microsoft-store.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 3145878746..3ebc98f62f 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -105,7 +105,7 @@ If you're using Microsoft Store for Business and you want employees to only see **To show private store only in Microsoft Store app:** -1. Type **`gpedit`** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. +1. Enter **`gpedit`** in the search bar, and then select **Edit group policy (Control panel)** to find and start Group Policy Editor. 2. In the console tree of the snap-in, go to **User Configuration** or **Computer Configuration** > **Administrative Templates** > **Windows Components**, and then select **Store**. From 944785a64386a4a6b01e40490322920ce1e8f4cd Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Wed, 30 Nov 2022 10:42:18 -0700 Subject: [PATCH 085/324] Update .openpublishing.redirection.json Line 20235: Add blank line. --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index eca0b9e1b8..4fde3c26ea 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20231,4 +20231,4 @@ "redirect_document_id": false } ] -} \ No newline at end of file +} From 7b5fb1bde99596d120d121a71621ae1737f37058 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 30 Nov 2022 10:24:57 -0800 Subject: [PATCH 086/324] move and rename deprecated and removed features --- .openpublishing.redirection.json | 17 ++++++++++++++++- windows/deployment/TOC.yml | 13 ------------- windows/deployment/planning/index.md | 2 +- windows/whats-new/TOC.yml | 9 +++++++++ .../deprecated-features.md} | 10 +++++----- .../feature-lifecycle.md} | 12 ++++++------ windows/whats-new/index.yml | 4 ++-- .../removed-features.md} | 10 +++++----- .../whats-new-windows-10-version-1703.md | 2 +- .../whats-new-windows-10-version-1909.md | 14 +++++++------- .../whats-new-windows-10-version-2004.md | 4 ++-- .../whats-new-windows-10-version-20H2.md | 4 ++-- .../whats-new-windows-10-version-21H1.md | 12 ++++++------ 13 files changed, 62 insertions(+), 51 deletions(-) rename windows/{deployment/planning/windows-10-deprecated-features.md => whats-new/deprecated-features.md} (98%) rename windows/{deployment/planning/features-lifecycle.md => whats-new/feature-lifecycle.md} (82%) rename windows/{deployment/planning/windows-10-removed-features.md => whats-new/removed-features.md} (98%) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index dfaf5a09e2..6e6956911e 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -20174,6 +20174,21 @@ "source_path": "windows/configuration/start-layout-troubleshoot.md", "redirect_url": "/troubleshoot/windows-client/shell-experience/troubleshoot-start-menu-errors", "redirect_document_id": false - } + }, + { + "source_path": "windows/deployment/planning/features-lifecycle.md", + "redirect_url": "/windows/whats-new/feature-lifecycle", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-deprecated-features.md", + "redirect_url": "/windows/whats-new/deprecated-features", + "redirect_document_id": false + }, + { + "source_path": "windows/deployment/planning/windows-10-removed-features.md", + "redirect_url": "/windows/whats-new/removed-features", + "redirect_document_id": false + } ] } \ No newline at end of file diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 85b109b135..6bc3dc2511 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -59,19 +59,6 @@ href: planning/windows-10-infrastructure-requirements.md - name: Plan for volume activation href: volume-activation/plan-for-volume-activation-client.md - - name: Features removed or planned for replacement - items: - - name: Windows client features lifecycle - href: planning/features-lifecycle.md - - name: Features we're no longer developing - items: - - name: Windows deprecated features - href: planning/windows-10-deprecated-features.md - - name: Features we removed - items: - - name: Windows features removed - href: planning/windows-10-removed-features.md - - name: Prepare items: - name: Prepare for Windows 11 diff --git a/windows/deployment/planning/index.md b/windows/deployment/planning/index.md index cb2208b86e..eb43d12f8e 100644 --- a/windows/deployment/planning/index.md +++ b/windows/deployment/planning/index.md @@ -21,7 +21,7 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildin |[Windows 10 deployment considerations](windows-10-deployment-considerations.md) |There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. | |[Windows 10 compatibility](windows-10-compatibility.md) |Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. | |[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) |There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. | -|[Features removed or planned for replacement](features-lifecycle.md) |Information is provided about Windows 10 features and functionality that are removed or planned for replacement. | +|[Features removed or planned for replacement](/windows/whats-new/feature-lifecycle.mdfeature-lifecycle) |Information is provided about Windows features and functionality that are removed or planned for replacement. | |[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) |The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. | ## Related topics diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml index 5c5fc54974..d432c8a8ff 100644 --- a/windows/whats-new/TOC.yml +++ b/windows/whats-new/TOC.yml @@ -24,3 +24,12 @@ href: whats-new-windows-10-version-21H1.md - name: What's new in Windows 10, version 20H2 href: whats-new-windows-10-version-20H2.md +- name: Deprecated and removed Windows features + expanded: false + items: + - name: Windows client features lifecycle + href: feature-lifecycle.md + - name: Deprecated Windows features + href: deprecated-features.md + - name: Removed Windows features + href: removed-features.md \ No newline at end of file diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/whats-new/deprecated-features.md similarity index 98% rename from windows/deployment/planning/windows-10-deprecated-features.md rename to windows/whats-new/deprecated-features.md index c57fba110d..12880bd7ef 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,12 +1,12 @@ --- -title: Deprecated features in Windows client +title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer developing in Windows 10 and Windows 11. ms.date: 10/28/2022 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium -author: frankroj -ms.author: frankroj +author: mestew +ms.author: mstewart manager: aaroncz ms.reviewer: ms.topic: article @@ -19,11 +19,11 @@ ms.topic: article - Windows 10 - Windows 11 -Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they've added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that have been removed, see [Windows features removed](windows-10-removed-features.md). +Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they've added a newer option. This article provides details about the features and functionalities that are no longer being developed in Windows client. For more information about features that have been removed, see [Windows features removed](removed-features.md). For more information about features in Windows 11, see [Feature deprecations and removals](https://www.microsoft.com/windows/windows-11-specifications#table3). -To understand the distinction between _deprecation_ and _removal_, see [Windows client features lifecycle](features-lifecycle.md). +To understand the distinction between _deprecation_ and _removal_, see [Windows client features lifecycle](feature-lifecycle.md). The features in this article are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/whats-new/feature-lifecycle.md similarity index 82% rename from windows/deployment/planning/features-lifecycle.md rename to windows/whats-new/feature-lifecycle.md index 18da27cab7..7334cd952a 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/whats-new/feature-lifecycle.md @@ -1,11 +1,11 @@ --- title: Windows client features lifecycle -description: Learn about the lifecycle of Windows 10 features, as well as features that are no longer developed, removed features, and terminology assigned to a feature. +description: Learn about the lifecycle of Windows features, as well as features that are no longer developed, removed features, and terminology assigned to a feature. ms.prod: windows-client ms.localizationpriority: medium -author: frankroj +author: mestew manager: aaroncz -ms.author: frankroj +ms.author: mstewart ms.topic: article ms.custom: seo-marvel-apr2020 ms.technology: itpro-fundamentals @@ -27,13 +27,13 @@ For information about features that are impacted when you upgrade from Windows 1 The following topic lists features that are no longer being developed. These features might be removed in a future release. -[Windows 10 features we're no longer developing](windows-10-deprecated-features.md) +[Deprecated Windows features](deprecated-features.md) ## Features removed The following topics have details about features that have been removed from Windows 10 or Windows 11. This includes features that are present in Windows 10, but are removed in Windows 11. -[Windows 10 features we removed](windows-10-removed-features.md) +[Removed Windows features](removed-features.md) ## Terminology @@ -47,4 +47,4 @@ The following terms can be used to describe the status that might be assigned to ## Also see -[Windows 10 release information](/windows/release-health/release-information) +[Windows release information](/windows/release-health/release-information) diff --git a/windows/whats-new/index.yml b/windows/whats-new/index.yml index 0396341be3..d1f1ec51df 100644 --- a/windows/whats-new/index.yml +++ b/windows/whats-new/index.yml @@ -56,9 +56,9 @@ landingContent: - text: Windows 10 update history url: https://support.microsoft.com/topic/windows-10-update-history-857b8ccb-71e4-49e5-b3f6-7073197d98fb - text: Windows features we're no longer developing - url: /windows/deployment/planning/windows-10-deprecated-features + url: deprecated-features.md - text: Features and functionality removed in Windows - url: /windows/deployment/planning/windows-10-removed-features + url: removed-features.md - text: Compare Windows 11 Editions url: https://www.microsoft.com/windows/business/compare-windows-11 - text: Windows 10 Enterprise LTSC diff --git a/windows/deployment/planning/windows-10-removed-features.md b/windows/whats-new/removed-features.md similarity index 98% rename from windows/deployment/planning/windows-10-removed-features.md rename to windows/whats-new/removed-features.md index 3b686d66a9..ac21df98d7 100644 --- a/windows/deployment/planning/windows-10-removed-features.md +++ b/windows/whats-new/removed-features.md @@ -3,8 +3,8 @@ title: Features and functionality removed in Windows client description: In this article, learn about the features and functionality that have been removed or replaced in Windows client. ms.prod: windows-client ms.localizationpriority: medium -author: frankroj -ms.author: frankroj +author: mestew +ms.author: mstewart manager: aaroncz ms.topic: article ms.custom: seo-marvel-apr2020 @@ -21,14 +21,14 @@ ms.date: 10/28/2022 Each version of Windows client adds new features and functionality. Occasionally, new versions also remove features and functionality, often because they've added a newer option. This article provides details about the features and functionality that have been removed in Windows client. -For more information about features that might be removed in a future release, see [Deprecated features for Windows client](windows-10-deprecated-features.md). +For more information about features that might be removed in a future release, see [Deprecated features for Windows client](deprecated-features.md). > [!NOTE] > To get early access to new Windows builds and test these changes yourself, join the [Windows Insider program](https://insider.windows.com). For more information about features in Windows 11, see [Feature deprecations and removals](https://www.microsoft.com/windows/windows-11-specifications#table3). -To understand the distinction between _deprecation_ and _removal_, see [Windows client features lifecycle](features-lifecycle.md). +To understand the distinction between _deprecation_ and _removal_, see [Windows client features lifecycle](feature-lifecycle.md). The following features and functionalities have been removed from the installed product image for Windows client. Applications or code that depend on these features won't function in the release when it was removed, or in later releases. @@ -76,4 +76,4 @@ The following features and functionalities have been removed from the installed |Microsoft Paint | This application won't be available for languages that aren't on the [full localization list](https://www.microsoft.com/windows/windows-10-specifications#Windows-10-localization). | 1703 | |NPN support in TLS | This feature is superseded by Application-Layer Protocol Negotiation (ALPN). | 1703 | |Windows Information Protection "AllowUserDecryption" policy | Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported. | 1703 | -|WSUS for Windows Mobile | Updates are being transitioned to the new Unified Update Platform (UUP) | 1703 | \ No newline at end of file +|WSUS for Windows Mobile | Updates are being transitioned to the new Unified Update Platform (UUP) | 1703 | diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 5030a8b526..d56bac40df 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -19,7 +19,7 @@ Below is a list of some of what's new in Information Technology (IT) pro feature For more general info about Windows 10 features, see [Features available only on Windows 10](https://www.microsoft.com/windows/features). For info about previous versions of Windows 10, see [What's New in Windows 10](./index.yml). Also see this blog post: [What’s new for IT pros in the Windows 10 Creators Update}(https://blogs.technet.microsoft.com/windowsitpro/2017/04/05/whats-new-for-it-pros-in-the-windows-10-creators-update/). >[!NOTE] ->Windows 10, version 1703 contains all fixes included in previous cumulative updates to Windows 10, version 1607. For info about each version, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info). For a list of removed features, see [Features that are removed or deprecated in Windows 10 Creators Update](/windows/deployment/planning/windows-10-removed-features). +>Windows 10, version 1703 contains all fixes included in previous cumulative updates to Windows 10, version 1607. For info about each version, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info). For a list of removed features, see [Features that are removed in Windows 10 Creators Update](removed-features.md). ## Configuration diff --git a/windows/whats-new/whats-new-windows-10-version-1909.md b/windows/whats-new/whats-new-windows-10-version-1909.md index 67c62a1a1f..f901253d51 100644 --- a/windows/whats-new/whats-new-windows-10-version-1909.md +++ b/windows/whats-new/whats-new-windows-10-version-1909.md @@ -14,7 +14,7 @@ ms.technology: itpro-fundamentals # What's new in Windows 10, version 1909 for IT Pros **Applies to** -- Windows 10, version 1909 +- Windows 10, version 1909 This article lists new and updated features and content that are of interest to IT Pros for Windows 10, version 1909, also known as the Windows 10 November 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1903. @@ -66,7 +66,7 @@ An experimental implementation of TLS 1.3 is included in Windows 10, version 190 [Windows Virtual Desktop](/azure/virtual-desktop/overview) (WVD) is now generally available globally! -Windows Virtual Desktop is a comprehensive desktop and app virtualization service running in the cloud. It’s the only virtual desktop infrastructure (VDI) that delivers simplified management, multi-session Windows 10, optimizations for Microsoft 365 Apps for enterprise, and support for Remote Desktop Services (RDS) environments. Deploy and scale your Windows desktops and apps on Azure in minutes, and get built-in security and compliance features. Windows Virtual Desktop requires a Microsoft E3 or E5 license, or a Microsoft 365 E3 or E5 license, and an Azure tenant. +Windows Virtual Desktop is a comprehensive desktop and app virtualization service running in the cloud. It's the only virtual desktop infrastructure (VDI) that delivers simplified management, multi-session Windows 10, optimizations for Microsoft 365 Apps for enterprise, and support for Remote Desktop Services (RDS) environments. Deploy and scale your Windows desktops and apps on Azure in minutes, and get built-in security and compliance features. Windows Virtual Desktop requires a Microsoft E3 or E5 license, or a Microsoft 365 E3 or E5 license, and an Azure tenant. ## Deployment @@ -94,7 +94,7 @@ A new [Windows ADK](/windows-hardware/get-started/adk-install) will **not be rel ## Microsoft Connected Cache -Together with Delivery Optimization, [Microsoft Connected Cache](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Introducing-Microsoft-Connected-Cache-Microsoft-s-cloud-managed/ba-p/963898) installed on Windows Server or Linux can seamlessly offload your traffic to local sources, caching content efficiently at the byte range level. Connected Cache is configured as a “configure once and forget it” solution that transparently caches content that your devices on your network need. +Together with Delivery Optimization, [Microsoft Connected Cache](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Introducing-Microsoft-Connected-Cache-Microsoft-s-cloud-managed/ba-p/963898) installed on Windows Server or Linux can seamlessly offload your traffic to local sources, caching content efficiently at the byte range level. Connected Cache is configured as a "configure once and forget it" solution that transparently caches content that your devices on your network need. ## Accessibility @@ -126,10 +126,10 @@ General battery life and power efficiency improvements for PCs with certain proc [What's New in Windows Server](/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
    [Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
    -[What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
    +[What's New in Windows 10](./index.yml): See what's new in other versions of Windows 10.
    [What Windows 10, version 1909 Means for Developers](https://blogs.windows.com/windowsdeveloper/2019/10/16/what-windows-10-version-1909-means-for-developers/): New and updated features in Windows 10 that are of interest to developers.
    -[Features and functionality removed in Windows 10](/windows/deployment/planning/windows-10-removed-features): Removed features.
    -[Windows 10 features we’re no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that aren't being developed.
    +[Features and functionality removed in Windows 10](removed-features.md): Removed features.
    +[Windows 10 features we're no longer developing](deprecated-features.md): Features that aren't being developed.
    [How to get the Windows 10 November 2019 Update](https://aka.ms/how-to-get-1909): John Cable blog.
    [How to get Windows 10, Version 1909: Enablement Mechanics](https://aka.ms/1909mechanics): Mechanics blog.
    -[What’s new for IT pros in Windows 10, version 1909](https://aka.ms/whats-new-in-1909): Windows IT Pro blog.
    +[What's new for IT pros in Windows 10, version 1909](https://aka.ms/whats-new-in-1909): Windows IT Pro blog.
    diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index c573b18f86..5762e44a56 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -262,5 +262,5 @@ For information about Desktop Analytics and this release of Windows 10, see [Wha - [Start developing on Windows 10, version 2004 today](https://blogs.windows.com/windowsdeveloper/2020/05/12/start-developing-on-windows-10-version-2004-today/): New and updated features in Windows 10 that are of interest to developers. - [What's new for business in Windows 10 Insider Preview Builds](/windows-insider/Active-Dev-Branch): A preview of new features for businesses. - [What's new in Windows 10, version 2004 - Windows Insiders](/windows-insider/archive/new-in-20h1): This list also includes consumer focused new features. -- [Features and functionality removed in Windows 10](/windows/deployment/planning/windows-10-removed-features): Removed features. -- [Windows 10 features we're no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that aren't being developed. +- [Features and functionality removed in Windows 10](removed-features.md): Removed features. +- [Windows 10 features we're no longer developing](deprecated-features.md): Features that aren't being developed. diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md index ac69c0d7b2..1b1b11fb62 100644 --- a/windows/whats-new/whats-new-windows-10-version-20H2.md +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -146,5 +146,5 @@ For information about Desktop Analytics and this release of Windows 10, see [Wha [Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
    [What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
    [Announcing more ways we’re making app development easier on Windows](https://blogs.windows.com/windowsdeveloper/2020/09/22/kevin-gallo-microsoft-ignite-2020/): Simplifying app development in Windows.
    -[Features and functionality removed in Windows 10](/windows/deployment/planning/windows-10-removed-features): Removed features.
    -[Windows 10 features we’re no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that aren't being developed.
    +[Features and functionality removed in Windows 10](removed-features.md): Removed features.
    +[Windows 10 features we're no longer developing](deprecated-features.md): Features that aren't being developed.
    diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index 67ec5e934e..2e40e1ddd7 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -94,10 +94,10 @@ This release includes the following enhancements and issues fixed: - Windows Management Instrumentation (WMI) service caused a heap leak each time security settings are applied to WMI namespace permissions. - screen rendering after opening games with certain hardware configurations. - startup times for applications that have roaming settings when User Experience Virtualization (UE-V) is turned on. -- a principal in a trusted MIT realm fails to obtain a Kerberos service ticket from Active Directory domain controllers (DC). This occurs on devices that installed Windows Updates that contain CVE-2020-17049 protections and configured PerfromTicketSignature to 1 or higher. These updates were released between November 10, 2020 and December 8, 2020. Ticket acquisition also fails with the error, “KRB_GENERIC_ERROR”, if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag. +- a principal in a trusted MIT realm fails to obtain a Kerberos service ticket from Active Directory domain controllers (DC). This occurs on devices that installed Windows Updates that contain CVE-2020-17049 protections and configured PerfromTicketSignature to 1 or higher. These updates were released between November 10, 2020 and December 8, 2020. Ticket acquisition also fails with the error, "KRB_GENERIC_ERROR", if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag. - high memory and CPU utilization in Microsoft Defender for Endpoint. - We enhanced data loss prevention and insider risk management solution functionalities in Microsoft 365 endpoints. -- an error when you attempt to open an untrusted webpage using Microsoft Edge or open an untrusted Microsoft Office document. The error is, “WDAG Report – Container: Error: 0x80070003, Ext error: 0x00000001”. This issue occurs after installing the .NET update KB4565627. +- an error when you attempt to open an untrusted webpage using Microsoft Edge or open an untrusted Microsoft Office document. The error is, "WDAG Report - Container: Error: 0x80070003, Ext error: 0x00000001". This issue occurs after installing the .NET update KB4565627. - an issue that prevents wevtutil from parsing an XML file. - failure to report an error when the Elliptic Curve Digital Signature Algorithm (ECDSA) generates invalid keys of 163 bytes instead of 165 bytes. - We added support for using the new Chromium-based Microsoft Edge as the assigned access single kiosk app. Now, you can also customize a breakout key sequence for single app kiosks. For more information, see Configure Microsoft Edge kiosk mode. @@ -131,7 +131,7 @@ This release includes the following enhancements and issues fixed: [Introducing the next feature update to Windows 10, version 21H1](https://blogs.windows.com/windowsexperience/2021/02/17/introducing-the-next-feature-update-to-windows-10-version-21h1/): Windows Experience Blog.
    [What's New in Windows Server](/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.
    [Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.
    -[What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
    -[Announcing more ways we’re making app development easier on Windows](https://blogs.windows.com/windowsdeveloper/2020/09/22/kevin-gallo-microsoft-ignite-2020/): Simplifying app development in Windows.
    -[Features and functionality removed in Windows 10](/windows/deployment/planning/windows-10-removed-features): Removed features.
    -[Windows 10 features we’re no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that aren't being developed.
    +[What's New in Windows 10](./index.yml): See what's new in other versions of Windows 10.
    +[Announcing more ways we're making app development easier on Windows](https://blogs.windows.com/windowsdeveloper/2020/09/22/kevin-gallo-microsoft-ignite-2020/): Simplifying app development in Windows.
    +[Features and functionality removed in Windows 10](removed-features.md): Removed features.
    +[Windows 10 features we're no longer developing](deprecated-features.md): Features that aren't being developed.
    From cb1a901f0b22ff3d188537594f979f5bfb6f667d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 30 Nov 2022 10:56:59 -0800 Subject: [PATCH 087/324] add contextual toc for wn docset, add toc links to deployment --- windows/deployment/TOC.yml | 8 ++++++++ windows/deployment/breadcrumb/toc.yml | 12 ++++++++++++ windows/whats-new/feature-lifecycle.md | 2 +- 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 501d63b613..1aeb5fd677 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -59,6 +59,14 @@ href: planning/windows-10-infrastructure-requirements.md - name: Plan for volume activation href: volume-activation/plan-for-volume-activation-client.md + - name: Features removed or planned for replacement + items: + - name: Windows client features lifecycle + href: /windows/whats-new/feature-lifecycle + - name: Deprecated features + href: /windows/whats-new/deprecated-features + - name: Removed features + href: /windows/whats-new/removed-features - name: Prepare items: - name: Prepare for Windows 11 diff --git a/windows/deployment/breadcrumb/toc.yml b/windows/deployment/breadcrumb/toc.yml index a43252b7e8..3cb4555445 100644 --- a/windows/deployment/breadcrumb/toc.yml +++ b/windows/deployment/breadcrumb/toc.yml @@ -9,4 +9,16 @@ items: items: - name: Deployment tocHref: /troubleshoot/windows-client/deployment/ + topicHref: /windows/deployment/ + +- name: Learn + tocHref: / + topicHref: / + items: + - name: Windows + tocHref: /windows/ + topicHref: /windows/resources/ + items: + - name: Deployment + tocHref: /windows/whats-new topicHref: /windows/deployment/ \ No newline at end of file diff --git a/windows/whats-new/feature-lifecycle.md b/windows/whats-new/feature-lifecycle.md index 7334cd952a..11eaa12e7e 100644 --- a/windows/whats-new/feature-lifecycle.md +++ b/windows/whats-new/feature-lifecycle.md @@ -37,7 +37,7 @@ The following topics have details about features that have been removed from Win ## Terminology -The following terms can be used to describe the status that might be assigned to a feature during its lifecycle. +The following terms can be used to describe the status that might be assigned to a feature during its lifecycle: - **Deprecation**: The stage of the product lifecycle when a feature or functionality is no longer in active development and may be removed in future releases of a product or online service. - **End of support**: The stage of the product lifecycle when support and servicing are no longer available for a product. From aa232d69877c041b4fdb143eec6e7ce4af599d5a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 30 Nov 2022 11:03:17 -0800 Subject: [PATCH 088/324] add toc and bc context entries to deployment --- windows/deployment/TOC.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 1aeb5fd677..4ac1a97b0f 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -62,11 +62,11 @@ - name: Features removed or planned for replacement items: - name: Windows client features lifecycle - href: /windows/whats-new/feature-lifecycle + href: /windows/whats-new/feature-lifecycle?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Deprecated features - href: /windows/whats-new/deprecated-features + href: /windows/whats-new/deprecated-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Removed features - href: /windows/whats-new/removed-features + href: /windows/whats-new/removed-features?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json - name: Prepare items: - name: Prepare for Windows 11 From a4974dac82c39761962873079196e72356b20193 Mon Sep 17 00:00:00 2001 From: Angela Fleischmann Date: Wed, 30 Nov 2022 14:41:06 -0700 Subject: [PATCH 089/324] Update windows/deployment/planning/index.md Line 24: Fix link. --- windows/deployment/planning/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/index.md b/windows/deployment/planning/index.md index eb43d12f8e..4d26878cb9 100644 --- a/windows/deployment/planning/index.md +++ b/windows/deployment/planning/index.md @@ -21,7 +21,7 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildin |[Windows 10 deployment considerations](windows-10-deployment-considerations.md) |There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. | |[Windows 10 compatibility](windows-10-compatibility.md) |Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. | |[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) |There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. | -|[Features removed or planned for replacement](/windows/whats-new/feature-lifecycle.mdfeature-lifecycle) |Information is provided about Windows features and functionality that are removed or planned for replacement. | +|[Features removed or planned for replacement](/windows/whats-new/feature-lifecycle) |Information is provided about Windows features and functionality that are removed or planned for replacement. | |[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) |The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. | ## Related topics From 45dc209393f9eeec70119cdff6a10a4a5f75172b Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 30 Nov 2022 13:47:05 -0800 Subject: [PATCH 090/324] Windows quality update reports. --- windows/deployment/windows-autopatch/TOC.yml | 13 +++ ...utopatch-all-devices-historical-report.png | Bin 0 -> 51960 bytes .../windows-autopatch-all-devices-report.png | Bin 0 -> 116993 bytes ...tch-eligible-devices-historical-report.png | Bin 0 -> 43829 bytes ...h-ineligible-devices-historical-report.png | Bin 0 -> 39892 bytes .../windows-autopatch-summary-dashboard.png | Bin 0 -> 52748 bytes ...patch-wqu-all-devices-historical-report.md | 40 +++++++ ...indows-autopatch-wqu-all-devices-report.md | 56 +++++++++ ...-wqu-eligible-devices-historical-report.md | 40 +++++++ ...qu-ineligible-devices-historical-report.md | 43 +++++++ .../windows-autopatch-wqu-reports-overview.md | 110 ++++++++++++++++++ ...windows-autopatch-wqu-summary-dashboard.md | 44 +++++++ 12 files changed, 346 insertions(+) create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-historical-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-eligible-devices-historical-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-ineligible-devices-historical-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-summary-dashboard.png create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index f2950818eb..5d31d988ca 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -50,6 +50,19 @@ href: operate/windows-autopatch-wqu-end-user-exp.md - name: Windows quality update signals href: operate/windows-autopatch-wqu-signals.md + - name: Windows quality update reports + href: operate/windows-autopatch-wqu-reports-overview.md + items: + - name: Summary dashboard + href: operate/windows-autopatch-wqu-summary-dashboard.md + - name: All devices report + href: operate/windows-autopatch-wqu-all-devices-report.md + - name: All devices report—historical + href: operate/windows-autopatch-wqu-all-devices-historical-report.md + - name: Eligible devices report—historical + href: operate/windows-autopatch-wqu-eligible-devices-historical-report.md + - name: Ineligible devices report—historical + href: operate/windows-autopatch-wqu-ineligible-devices-historical-report.md - name: Windows feature updates href: operate/windows-autopatch-fu-overview.md items: diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-historical-report.png b/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-historical-report.png new file mode 100644 index 0000000000000000000000000000000000000000..4a7cf971979b2e7106d30ed6049ec842d205409f GIT binary patch literal 51960 zcmYhiWmH>T7cERn8{CR}ad+3E!QI`0OK~fdQrz7&xVu|%cXuri+}$pH-usR3{>aEU zNlv!Sz1LiG%@d+1FM$M)2M+}Wg(M{@rVIu3(H;uwg9j|&{S)GA?A!OZ4^GMwB2X3M z1PAXIpUj2jgrT6SqY$2rKEGeX*-L6UK|vw+{Cj;E_+A8pf*OvH5))Q+*FS!NNhg%> zTt}FxF+HlKc;X%GXvm|}TF|O7^@+79chyKk=Zb4x?QI(!Nr(GA$YXAZO1YozG|n@T zk`m`M{vhjls^dKl#nx#L6$`~J+V)0FZ$NG^+!_&ASG&J-JIQED+xVzrVJB4yY3F=WFCdxk>rnVD$;IAy z4>m>j_^F9yoK+XjgcE3l6Zqg?0aPp54(w)YH=w>w*3>&t~5>`0;q1hx_+c z)&2fpC%uv2mT|8LPR)b3qCTz4SJ#s~llZ2Diiohw8koJ!f|`)F z#2IA3zF}?+Bk`ATMqL2|IBh+_Z(SetxExOYjc!jr5Q)HYsWT!nGN-s0&cwu|5wwXI zNlhEHHb{Jz<2;PiOyRGj@=2PNt*7PdGUkVCd=cgr6UZEZ#fS_&!JctT5f*uv4J%A) zrMlUpZfJE7*BNX(AEsmiE9zXz@TA1ECsI9%K$ilf z!sU!JNA~ulCDTiDQ28~y+vlHoS*3zIXu~PjG$m$X zw&mxD|8L=gTI~+If4FjD>IN{97{U8n&RDR=+U;VN%o7QJ#%&6&Pcj7*Z8PrC5|l-{YFgj470qu#TfZrg&c3% zGXm9uuYq$UO}`O}j-0X!1_IGCh?|{P6I|(#xmFaJ_k`~=w!rW0VKYln78)E#EQG^wTz+k#X)i$I z!^8OCJn@*fTq`W6SYn#y2xKuvG?qP+Nb5!+!{sjRiek}&LSqea%s^2Cc?GHoUR!)* z))BE#1sGO+27_zr2R}m6FLGjLr96g5Ny3$R_zKtRCPWM9ejz6iYcCLZ`SM)PxQ>0o zm15N}_F*H`VBG==6wB|4mo5i=h`@dUeT8u$nT^G@1wZ%lDb^=kQnGOg?Ven~>S+c5bDCa3)o z#0(%`CzVE4OTHW(;$mPyvYzi(DC^A_U+O&|JJ_iY}5Az{})7{feR$2$N9uGUdureMY$4z@-Jq3+AHLuqet<(loT41(Llh(C3mxMTj^C49Ct-v# z9%n>uBJmKWk%!F7WP~T)%0C6yBe{D@c2%fQx0_aIpW%d@2_Z$iWqynoF1DG%37ENH z93I&W>B7|(`q~2ZO{$KDU6IHvmM*r)C)X(@*P60|@E<@{N2+{vB)Hh@-2(i#S}_xU zfPXFrj}vr{mIo{j`~%P^m5Cg*IRy^^r++)+y}&}hSnEO^2_nIN=o)odHQe;~xZ)nt_zH38wu?GLKj{_Yuf{N1Ab!*Og3tZ$AUEP9Ek#Ucw$LvmB&mePY=?h_ zh!N|L;P@(+O3a?cZ^Q0T%0^`TwO`!2b|ja(_-9qvf>!FTU7_ zspE2E-h{>@C@10C~_NFqsH=dxa?&#R$Lhv#^XXB?(MHp(>Brn4V&V9*h#W|;mg00*aj~CAX}U#IN3dqIqhU9$IF_j`8nT`XD?L_=l9*dD=l3!o(uLq7d5vEM(>%mNAUy< zps!>x5|zRsM}4cV=X5e6Uc-K%rni&yheEDJwjCRrOid4o<`#s}GY>*o*vr+#k2C%v zSH1>Y=~SM$2VFEck^NMO%dY_azWTMesAS@>vk}E$%nD;1We^g7#&(3ul~S^v*I(Y|E0y76%%4P8qz%~ zVaS4;tvZ;`Dlb1(Pw`uy4*&zmW?MnK_F(4WMWoR43*h;tEKk_koX3BT@cn&PnX!E> z2%NR5SH5ERO_mg5|JI86zCD800;>ih(|@wP9yY-Tczd?#mGp7NvQH)-Ph(dr7xy0@ zBeF|l0+*jA7d4{-6VR%br5qBe2PEmdKR@j=>UQE+wg=Y)3d$n8Y(A%` zaQmFn!-q*nr+R&cR&j1Ggo*LGAeENxb+PetbVV$TJeE+l!omPqwWM0vzh1+obI18t zjO&AxGpQ!hh3|fa+XXifrV-f=n!p$Urp>#q z-P`B~+3*Lfi(K*>{&n{ofpoziUy|6a2EF96YqD|VKP}CI$~}#(zX`Mrd@HJT)~WG$b+-c@R{i zLsaxL!M8R}>}tEEGA?o7zTyF2b zIE=b2{*CKCC<$^Iu%BKe1)5RJl@W~Y`d4ZgMuU`8^na-o#(h=6+c82ThG)v6AWQUr zZQv!K5KT-l2oIwg|H@SvTrne0AeaUyoe8+SW&`bAvIx#cz5H+kmzSbkf+>#|>xt(u zAKZ7#8(9Qp%<36Yp6&>Q9n=B0#{wS{=Aohn#J}OR*k8;lwLMQGaA(8^((@Lkr-!ED zaaS(Tt(E3r*EdOsf)$NX{tKqwynK8ysj0Mc{cE(Ph^saJF}2aMSad11_j#wJvf9!H zUT`tZXzlXiOsYnE{!3c={XYuqPFeoinQhXi(j0HRVnt>tNJx0|xZ12l#*gZz^ZOw0 za_mY9I((#AN(jMg`ka@(7-oX)1XeAsHXpH;9AoV2VyN8l6Btlb(vCcRMWY7wxbNqi zU%Y0bGvgo?4gCow18v5RXY^>X(sUSp8orQkdl+_#HKJpx6gt~vW)H>9OXmsCkQnbg zh-kgb+*7s@u*U#rV>c%u$E5s#*-cQhusahnRU*2z;rkQ-4C_wEAmI7=kqU)a3@Fdz zT*8tr=t_WHsoOQ~C&5g!AbGG$LD(CEprwJdy1mU`XZ0B`^ z+|?GXbUw#V8p^B=kDX}j&fy{g0^w`KUccI=c~y4}x(?`?aUf^?nHj{{?dGU#FG!2c z`>0lQ2vsH4g&b@l6OipVXO5^$UI2<~XRAGo)yL=cvOarUQZ;yfn-cdxF zQgNDyM<7@QbI{y3d58$HD(TsJ`4Js!;44I~zh1m0uRA;lB**fT5(r=$K-rpYCP!2l zVOd-cZuGfgP3ckLc6$9%z=2gX$WNKU8`%Ei4%}9a0RKQf&C14H${~3WQKw;YSK$r8 zRnpJUef1Qh3M{x3iPv!JG*!(d=fdW2k)s}=6QaVcYq|6~UTwxcY0sUMz1bS{^((SH z6_s#8k|+8WE-DcTHZlAXm?EqTHXvL7MO^c01~SL$vY912y0jz^@F0>a*P|Yn8epM) z%OAm3QdSQPjWwQ~Z*Zal{0mJgUlG%bV8g_^ryDfiG%FRgN?q8XsR9R3PyQtGLG|X4 zSh9Li1%#lGZC;U7SrtW7ERF&!ZUBpfu3|Z)YoCj&JAkDU%mlgAVdqU5_EPNv;`nS# zA4x8{7`yD|MJrTE2+{_oy%2%zSf057mtP2p!Y|lK7Y?&>Vo>v)%DouVK3lQ+tP4S{ zxlr71whQ1WTNpO*eqq_(O-rDoA*5ZI{>V?nl~aBHFd;z}Ur1zkh9{a!j@oYi`zP`9 z>sPEj<8zPVXWy?GK?YV#=92Lq`r&Xj+$goe3Z{sLKN;cM)sZ+-l&07;oNG|IF1xpL zW^qLkQAknQ{HQUcn=JS+u0<98XpXAmf9!&K=FPLPW@HYcRDjyKkM&Ei0Ygv;Ly||7MHV{dEOFqF z#`pgqvr9U%(&0YP)aE6SF9t|o^J0!9JZ)DRY7Ai8LejT!p6Xd`$h{Mhbm{Rz7GfP- zF#jD6OlGI-BILYV`Soxdj8h+WXI+6v}&>Lw@RJ67~CT$=eXyh-XR%^4=gK z%F|)6v0mTZnp9O{yCj%SGb2AxJb-!+E%?y;`gkPAnEF!URoNG?V!)+9aR*H8v?E0o zoq)P)XWd~2aWysE!_rVC<(XeUo6$Z*#r@wlM;YwLI+yzBR9Wq%d5~SXOnemBT-`Xg zUv9Mt4sFF>?@>n?Vb~pUL!D}sw3H%R4jqpLJTVR)ng_=jg!JWEJp&&VS0)1yk{EN_ zxQP?y>ZwPE#MNA4*wH(;;`U>d)Tv2*XuD-$~BQ43Mwv89hdfr=|D{PZ1CQIh+#x+7r6K zlywl~sJ);}fQvzksd}j;J3*TbeleD<#9hJw)k<69z_QT34%gUxs`fScA1rHzJK^Ba z_ep0+t#-B@rDf2tqD+EDb`yC?xg}3~9~~tE-M_1{p!+3*h5eZ(hQHpn?yzwMFX0`B z*oW3C!N8e8|1Yrw{sll&kt5D&Ytx;YYyE$)2`;nT)O7g&8w>QUm8s;)_jRqDiE#L~ zV*LN!47hGj@kPIK54B~v`aK&N(V$UKow#jT*8V*=^#4VIkz2Q+x{2&kz=0O7nVA`j zfB=J3?v!L;eIZ^Bpb0 zF4Et{aXDiJOMG?6Q(ms@gRr+h{Fjh2yZtH!$j`Pl6A+E!^(%2ChgWoPUc26bOG^9Lv= z7G(R}oSIlmIto=T4~w91HcKp| z20Gg@21=5LQiS3}09hKVGI4c<28sKV^Wt^h^e1qvPX^^C*C%yFJ!luY**E(slJWBIb2c91e72Gr&m+7W*qulh~L}5@Rrl z2~JmYA11&SF4sE)LQD`iXB4z>6wqb(m8{fvVn3iSj|%}gBFQylJH1m z6Ob3YJZ)H?ys5*|R+V<4MTO)XscWG)WV4DDC14i zD;XSSar^3xh&C3c>vbM_Jr{cfi}LcW$xT?`x>xrc_suT9?uWgZ}9U z$v=G6-jC8&1gjlH+#1L5a3n)#5CIt(h!+@0l0>&zqXUi~Vdm!yytr_vb9M%|{=u&0 zMZe}n;!VSUmkdHn4z=rUk>XfXgamnjKoh8$8579ifrN%R_Odqq)a-1y@2g;4LxV^$ zhotS^|Hk(S?=ph31Lz>d*r;Q*Poa+%ipNpdBLx@~ zzYr@7ydOpEM(x{)9zx5&h2R81P=z1#vo;FL-xo#9G_9XdG=o3bRSxzv7&2{-R5*s1 zJN2nmVBM)PzZ9Vs9`oaeZ}gN5qnt1zzRVvxp!CqO_pq_h&VLwkYN5de9i%Shy9WI9 zf!#9v)Rheb@PqgC3m6`-{V$~L>2Cv}spfk7enj>My=n@C4-St5H10x9c5f1L>MBss z10j#hVC#qP1m5J(63FAkdhu54y5twqE&?Ax!~X?EBSBf~pl$LP8M8Gz z21!aSi<6hKmHgeKQR8aOvIw#*Ho@>xz&Ool%2;SB3;OgxJH%-;R|&i8VjL=y!G6c9 z6!L5HcTbMQcMTZNry#?69&{DcrTokUPG0@oIq7;=1ZHm5y) zSiPOyJQemkHfkRO+3atdtcE%XZQMvr>4VwY1^LqtIt>V`xBVPL_Z>w!*di-#s zvWq?i^odhfmWsL#e^%9)%Pwt3vczWk%0u?Kn8&op`p~!Mz@Oc06+W&mrasd*Y>bJ- zXEdz*hBJQXId-@ZnmXyTk|4TBJ-_VHhj{r1iUhc+2E_vmh9Pnd#kSol$7OweY=?Z4 z-beO)i55JjYC;7rG#?~}{nn}anz9j7Ch*NkgzMjk2WGB6ut`10e)@mReu%OF*By0y z?IGGtc_`Lt)O~W0$Mb}dgsp`jh9H@vg-9L79pKC*kFH+fW$29|Gc_(xHRv6yoG2Pd z=|#Bc0*aWPbjyY1kc6;>V)bYGIsdmGg+zab*t(9-yNfbKr1UvUXssrd4I;w!;}rEa zem^c-vAekB7Pr8v?e-OwmJ6F5nu7K)bBgi^@^>SurkK20EY76=HvrJ#-W7#)| zy20Thw?)_iJ00#&DR2*EAAxK18Kob^%h#BfGybyXXeNhsVn)0(fO42-g6&D|wIXncAwB1lU+G=3-xW|G;K$dr6reL>panft z*wojt;H_-yGgnUt8%x)zvyv}o$CPGzmfxIBEafS7uspjR>qCx`_eDH$3Mewb7d`Hw zlHFcC?DGz~i8Iro()zkzre!|HspBEbEZe8uJb-$fcw>6nSdi)MSaDP#7AxC2DhAI7Yy47Q;V|_Q5kb$ke?oe z7?)CoKisTEog>1f$ks+oMuLu4r$lLH`gchr<2!qtaizo4!QZ;%Hk!wuTolTB7hslo zj}$j}e>Eij90Yn!%Isn}J*JjB_|>7I5k>$5gIE~iq+~E(V9|kEoq))HlkMQ=tCPr4 zjgf)B3fj(-N2a^oKxirUCG%5a#(mpnvnW(DFo@V&re$wz%qcQ~qAW!CnMNSMa3fi1 z1GKYb0krB&&aFfh#A;u2vS-(k;?q3zSy-Nm>NsI4SL*f$%Z5BeV|$O)Ta=Y{ElLs( zJITa&@Ze{>c;gTr07XR!4^#0cm!|xems#_u3`EdVq7wJ8oSh>SQ}**6ZJn{O_b9IB zr`CbraE`m@q_)K4IyjKhH}*wz=rVrTGH4HaVb$9$|`K=XE%ZfXiVOjkEun4lk zJ#}7JNt;wR2y9r_k59lf7OCj%2HcEwmxZK` zaPq$4wya-WEu5nKmzt$Ty?1c!XU2T66BESDc9S)zeUR|V_@@Khlm*U~q4kXtV&K-Xxt2Dqtt4U)3X?TE{PoBMFyaIIx_2kx@GL!S8rdyP)Rj#up6WyqI6Drrgv z46qZHQ60l_*KX8PbSASs-AZSO5!3H2<~rvaZ_LX6rNUzEYn5m zy|AFya+&eVgZoLR>D0pd;0pC44zxb6f|*68s6zxBC2<5RWlDODGD7Q@N~ zahd7M={^qoQq+huCt&-c`ge&rStyQ6R2uqXc@hkfIU7ag4BAk~6l@PNPSt7G^2JK{ zTy-fKQ;eHB1OJc{PZtahj6%o2ZK)@+qL^)oFBc*gJD6xv^>qeCk&);R(kmE+vBRn? z?L4X+_<7>6%Auy_%G;<3bgda;wKwmR}DW&ggx$+4KJFR{0A z9|ga)WkQ{V5u-xJd;wfmc8@{7w*QK zfxBBmiRN0G^Nx#-scBkAxZJ+O96@x@MCoTPGA2oS$5BVhB6N+Fh@K9ngFz!9?jsKB zRyb zRZ(OykwX^YZp&IGZ-Gfb20ay}k#Xop)^~k~@m(L9+LN1Yz#VlxE_K~*rpMN2vft{{ z#nvBmAo;W4n{9z0wkL~&e<3Y{x45Qop8i&87q6|S9`bBP0n(q2IqPv z9?OLhVRQ7($l#EE8YYPlQCu%e9PC#bc>-nj9BaLCE*R>n| zQI(Su+`tMez74kS%jo%@Ywd$CFRRc0-0dX_F2B%i65%S>BTVYBu}s=U^uO)2J4>@zeavpR3o| zjG1|w=UfJr`ybyGHai-rE>`MZ`QTo1?Y)e#u5X;m&74rm^uT z6Rm!GWG>8@M;};6UMe$#xM&ws*`!n4ugY7Vo44|@;9TnowdHgW`E)Y5Kr~U5=nnI) zsul^St#>RYiN7%w;tT&l0q}CA1&y0n3Lg@dDU}-LHs!e0uUq_{ApSLE@oQ|$f59{f zaEnZ7HmRwd9yDk3EAuBmBRWFRR_-;yHBT}jEZUe;F$c;cBXiU9#aDLEJ6dyDM$JX}ojFFM%jWVb|*XfeqekKNj9Vps+Vd(p(2A z`D!U!X-uR-S#-2hQBggxJC+p@=_Z#s7k12cEjc4a#9V`TR$Cw?YvPt}R%Oj@^=^;+ z^oL7&BBb)7-*{M*nEm3u1C ze4e+6>bj47{{b-q8})VtzkGU7oj~L_p6t%Ev($pNv-4)9^*7@ccB{V^&D`R0$;^sd z(f6##t5_k;(tV2bIqGtVj0~Rop(&U-G0}BI6d_Ard)rE!uKUiedaWb-p0l?mmo0x{ zFl2=d8nDv^vjtVOu(myShYixuB$=@&QJHZ~O>HDXmaI7N4$ejqQC?74@tiHnibXaS z5qnjwjO}edzYvCMagBN+T?5!gLD9X4)I^Oio)M|xQOr@C794muko%!xIQBZ{$tb#f z_LTMv#6%^Y(DZFbNIA$8;%R}AqvD5v%=(R%BOz$}{x``desx_zr;p}L1xD({{j-w9 zB_+cSJdHTza!8WR@%}_9SVW~*dW7ZFbfe;C>R7ZRBlfq)9a&v=Y^dfr+GTa`Na4NK9vopDagVLgU8rYXL z%JzS+#Vu^@q>bRjlN55Z3qE`6op8I}697DU9WFPK5or#BsNO{g^Jq2OO|kFnMt>-$mY? zGdXt$-{XX1!v|YIv8Vq24>{LwBXF4O6}3BK%IF=g`Vo}|)0@^qcwTIBL6zji7fI%7 z_xdIB@NccPR?i#!u-aQE9Jz)}zcqqn@i82r&GVn6aJZG6(9fR)o4@QF z(d@E@hlh(u6bxEmv;*rWixNP}v(ra%?fP_b4+Y9YEF2twrBV7eK~{ZVj_K!MZNa1_ z9yy$*09ab5ip?p5SNOv5to|-&nDfW9v#sHWT5hjv*l}{buBF@{hrbY-Jn{?)Pctli z?^msKS-QZ9BcO{uYs2xf1mzyaZO0w2D=~KfdJyu~eTW~o!a@7PV;c9*$8b>2xN>?1 z-+GVEO5@In?Mn5J0eKsbE8BE#4|s`NyS}3p6d`Lz!;(U{A8yBA$z0%u_T`Q5)_VpS z%P3XEDW{D(#~HqF1?;bjd8(uF^0u;Y@mp15(m=LdPj*Z)#VR6GIm38jfNOBgt#?{fwY1V& zp8qdK%Pr}k-|HuS_YJoU$yNG0T6qgl@Oh*{bZ+6spGoJ;f7VhF7TbPE9R!oUVf_|`ftNrGvsU`u@HD|o>o3A&w z>*c5Sq(ayXh{bwUnz!6+F&PwID{NkZ8{j3iojh{BPycUs8hh62f;h@UN zF3OnIosVE{Pr-m+ZyLZY1z_c1Lx;IN78Ca-3uR;6+Kgd~E`~^Caed90c-Z;jK*B&= zg8P~GaM=ESQ$L;0DW+nA#b&7io#Dmg8hYyY_$j9|G7`zrB~RN;mwpjF(I_JOR5L+W zrs$7B_5!k(MX8pbRQ9LOO0w2S(>L!7@S&`FxKodf5ssnKpwUN*?ng@Ka%;kqAi^># zKps-=@O+>|k;%}wDO89)&`RK5+8aC&DtB*GL4;zab1obQ&7_8N@yYfL5{jjuq3uw& z9=d-i>t3-M>Skqo|BA`+^X`Sli=yurS1E)0W(_h*9^Qp=0&bM4^|@FBQKia#2ary% zsD67QlFohu-)+6~rIk+`8e6DyKTugPVkm^BIMCMF8TG|aG&woX_JJHY*d`}8AtXrG zGuVq`W>KtcJ=ppAG~HJxIqoM^h}4}+2`+2&PBhY84mlMP4@JVHQj?7hMy^R5Gu|M5 zK#qMXM>O4BaKA{=SZjEazBj_nnrO6wf}u7^e?D868HY%@qM@-D0c`|uSfNtQ#NHjp zF#?%3|D%eD2~JvSAh5KH8+WD40k^x_!ygi)Mi!YL3(FPP9f6B9rQ^$}u_;HwHN&{slDg@7eQzcl~MS`-`A`uOZRDTkgBb`O&lGD8j;q zkgp9hRkEwb~FX1hAyM zm`|mzh1#tH#xc3RyR{(^=5+C-3D?9J8i%;(_bIuF|s%Z&Jd0XbXa#qC9zQ01<2C*y;o$#zQ1g&qfV{ zR!)8|93|@CJxP+v))8JwZV}zn{G@h%TJD4^w}Wm3gekFBQQr4(rNvqkT^1YF-68(+ znk}FZ=^w)nCvW)2w4=KJY1b(f9iu>1&g-#dqiX#$Un8yV*b_TOW0o8!KinK##VThobqgyk<%4U;qk9B7|rSG6gWh1tib z=lJ>6F_7Pe<-;08(ve$jR4@&k%#WDdbAkBr;~k)>WD_mInLNW={Fho7zBrBZ<~Nw= z8%^@pT{jJu@#G_a6d{$hF+ji`C`*_hh@O3#dzU_`=34&qfl%$H`qr*&7BJy9uSe?5 zc|NaMViL*MZ#kC2h&r-5)O{1IZqFD^6SbnF^1PNh*@SSTcz_xBL?pZ<4Szgex6 zr!93saZ9_lyi<9d#xa}TpR>3T!^xQ!P|O~&>Aw|F7*>O(s^`00oMN{eAU?_L^JbFU zWI|56nE4CE`lJ24Wv4Quw=Jq&j}Rv%TB?>obMSA|(BE){A!b1~hKMbSxn-V{_u?b- z;mxF#3$qUWv|x%2d@XH;DjmsQBRjs_b$~6HbXXsFGd$2BrK{dmXK5XT;s$# zHOuuOOg`jvobmbwB{y#S<_0;ZvJg5$PcK;=kC}!2_wBM(ovRD!Hzov)X~#(}X8({2 zC5T*s!mai#mP_eBZQ{L)dv-M?Na+)ne)FInnEW@pk+`qwJ zDF*@-lM^D^V&VT{CFbz*!SrEbN)9s!TV3+xVJDFC@nHuP<4&vU6z?l5%C0o0>{2t0 z1A(rzsX=B&sn3rNHDOq0^C`L9&8oIV|vzlNB#ga~2K#E_}{01Nr> zR`@jwE7<#9R^VNGaF3t`x}Rk>Y^7mG+@Jjja^P%-!VE}J9!s7$3({usYYBCXSL4cQ zb%U+x5Uy)%AgwIJGYvS993B=m)uZE0#aEh{4dxA9m|KoqKXnL4zRS(c#TAWn#Hpuc zpHiRu_CmSJdP3v>cF&0=?}I!@ zmA_${AH(>H#GDDwBEF^lo=%J8)c#J^s4_4TT`Ph!$u)r-odhc9`->iW83qh}1=ey& z0VJ-!V4Aq4SmXPt+mTyqY!+x%K=7={P#l;VcyMeb>U%4U$2(Ve3Hv z8e36PZ(8&d^pmYRE1s6+6|nlzpz2x%kNS7BP5E7_osPGM35N}z2g21m?7HW$w|}KN zP5ODW*|$)p#+Oo`$mXY4j^nq>JLb1#?@pF!#_7{m>X;2IQwyq>|HyD zl5w+|41(E1%uP;45gxwCw452D56%(wn_Y?T7XPkPIY8D|za(C%TsWJn+8b7h5Tae{ z-V{tVjV7QjUa1l@?}##g-;i7)b8Y4#{SeB`!cq?zqe9$S!%I3f1DqOLQvTdOd&RhW z$?^&Fx$pB)ctroNtf-l$c;|hfa31w`s!;Xz?fJ*(i{IO)fw!lDK3-IIt)BIH{P4X| z5eMGau8mi;)2ES*f$vk7jjy*TT4nV&%^cnTkXmo#yn+3S`Ubi32^R3Vlt}(_rm%It z;}i67_bODi$#*C{u1K&Gx&Ud}K zcs1Z72{_&8xsZ6{+S_<3A2Zn`&jt3suc0)cUsh%cDEDs7T993RS6E^yq-KO*X!#D6 zmes?iZ(Ev{{VjB~^;NVabW3~0+s5*T$JJHc+_KAT`#fZx)H6-Ie%v_bpLRC8)kX7K zvWG#Kmhu%<0OOJBbL$GFmJ=%`=GrtY)RMVfZ*J?YTX~-wN-`?+Q1p5# z=EW9W9>^<>9PbaEqxMPL6OceX8%BPl>_9;sV z7`t$2rqX^^rTF!%GU<%AnMu)D-T$k&R}H#RcZ9Q~A=_#-G>`@+wSdqf%>nE>9MVri z#||i+?J_duYnTgdj6shD?BwUOtMtrO;mb_}=if&@aum3l4W#}e@4t#qPrry7Noy%5 zOVJU7I-_bSg>UnFa*>}o7x0`0GQPTlFpjJ*3CU1htSS`eJw!I zJ`J~TEa+^}Yf15KRZWceY4Bn!g*<#V?x*>hcV4=dV)8>|bGeqPl zBVR$cn_lvk7MOf%##hRA!9TO5`usib@r;w~y?~osrH_;N$ih}Kil+Lo7tMdznSh2+ zftaGmZ`G661()Uu_}t7xU0P1X#wwNCe?5v32zX-VEA9OYLGACS%2plCuFr=H5D&m1 z#Ovz4$0*BDw+j${FS@1pt|YnQy=`9kgwLjm(8rSCo@EJ%>IsxcvoiB=hP``CRFigd zE6UMTcGz(2j{47q@U660?0Lx04=jg@D$D$*3}y40F0{0@g*={mxKm!9V1ewg+{c5h zs-eid-^+!4kJG*WlJA4_t1|@O%CIjxfb(LfPDfhRsHx# z?PxX&@zZRiS~ITeONYF7Cw*BsdpwpYNm2*7%GH&k{82(a4|S1MHj~ApGU-mNmU2W{ z8E94=1KgaCiKX-Ga_E?eulG(ff@;Ti?m8Z`qLnm0J*GreXA;FH#*=Uz!FzfFzb4U5 zs%r#Z2CB;{&_QG>3ETBRHZ8m{N zMMK|vEhN}xfrKrO63o*A;V~T_>Nw|ei>P7Dktt#hiX^P9=@?{`R5WDnB%$>TE{3me ztBZU-gsHr#y$k4tpG{_VAQor9z68X0jk(;G4gw@l}+Co0f8|Pb7?WZi-jHWFE3r+>UDkg1@*6uMNl^<0+aZvMaAF6 zTud3_L7R`QI#cu0kp;tEv+CGiOG`p-F*|pfBNnDOKc&C837w#8rXv_Sss~y<9=BM* zM=O}sguZr!si;I}c>y#+M`F?p0{UY=g5ohqOLIOHtURau)b;nJ%bRG*&qWWrLO4G_ z!m;=+?Cnk1!eO*_crakHt%O!0#`_Z zB~@x+Srzx%B(?dZs)k?5v`D&u6QVg2)sD0$JUlC7ZVh=5q8^2`bf}`1O5~%j6#IPq zWRfdU&Cp-VG32H})N*zye62>~&DVp4SGH-$h-ww{HAOSc?~!%RdBc~8$Y>+8e#4DYVk?s*G@hlTS~Tn`-~sh&nl=9M#%+cM$? ztp<`VA1?O=F4ee+k>IO`jE^5n3k;W}2X3H|;QN=WHM;Wnq=GQ1L4WVN8yxwQW~G7s zzq2I}53PfSK!N(^zvOefd;fBqVMw!csOD5xBg5z8&Ahv6Q&atcrM~lqza3riRN~^I zhd|6aJ3XP{wdx!?+pr}cd8!yFNE2S(bz1Z} zXC6LUMh&OmuZBH2#$n9liS&bs0#}zSSWPlAAI(X2*aKSK&bqq1e^ecv!yyi;PIt8S z1>th1Nkxp(?N|G}31et*kfL@x0qq!|vF%foGP8VNo^DAQ3gZQ%P_l6D<*O5Y!~DH) z4$j0)wFJsCvoWyps}fVc5G=OBV8^n7XMNx+=QZ$}0^AvDnkp06;);rje)R(vzB_zi zGkKBZ^^O%hdl{ss4w`Z}X#xJWo7KQD{FX8Be>i)qsJOOm3p9Zs!QI`R!X1LUTks&k z-JRg>!Gb#kso?JJ8X&j?cXxP;z0bYpzW4b)tF=|NW=-vLjNbbwoYmbMb$hKlxQ151 z`C6mz|5R>Ls%w_00wSFUTO0%mB75opl!|F2Mf+=?R-Bt0ZZ_OMP)V>8;rZC0Y4uQa z$s3t@quY~}#?%bRme-j_(l?GHK=8BG+I0CjfBbEL(lfSl%~n2@pvC916|YU*M-8%= z0KfN6Y3ViEZuwP||8*36KIjC_sj?GU zbZhuL(%B>@)B1Xmc-I9f)CVSh#B9GFv)foG)#mdZWGqIQ5ZUu4aI>ju8T9l!70mRatv55G_l$+`AH?XSJ8nP=_yc_i}rVkvZVD&+mIVZi^Fi-V#~v9ZVPY zp{>!~8JXyQ8+>+1P1M)W@$&WQC>)!G#^8^?Ich}sdxEtZD1)amp&nJR&$~b?7skJz z^f+HOU!TdnZ*#HNqk+^TX@u(OE41IW&6~Jzk)Z+fYMnJ47O8Z@F7`x5WJXPQch`wDv>fzlK)Rwp5DbwIW>yna?VQPGilShkewtu> z>iS80nU=-6H!0n~G+IO@LEoCsy^cBIOaki1Nso>IJMYH<9F3KgA1Q~3x^6C1?Keqa zvceMOMJ7d_C}!^$`jV5Z)-p|-Kb^se)8*#4_BQr;4e{$cA|<3&BF)vd*obZ3Wjm`6iwqVms>byUbf7e%7&L3O!9B1By_8E+Q`!yHlPt z_qv*(%}AK@Yde8&$`yo+g(>HO#6n?Fo1S|JRHHs{#|0XAjbCP??(K0}^nD-?T*#ziiSDvY#{C^Z*m`X$RZ>PKF09<)!jh zGc*z`bRg`*v6MhN{+izzmwgbnl7Vx);4X1~@@OH6^^b0Jp+{2v6%Vv5`zOo?J;Ofw z*}^6ik=$Ria(V6R1VrxZE#{fEQd7M?B>kl|I`Z6Z>puK9qv;?|k&;pVV7upaYIFP_ z@taL*`R;!QZjDE}BG1H6^t~GKd0BJ^oc$QvFYCbTgWJ_&QcoGJM96uDTsLi3R{W2f zUd{^P<5H+X3a38AI;&pD69V@%nWrsRO}!|QcV`cmitA<*t&o34k8FtX03P~IPh%A# z!H~GhXF?jb<|!jr>8*zFMQ+2*WHa?JtLv(44j(i~t|_fxnD$GK*7`#Vf_5vgYAYvV z)^lIO`FK_&Y+o4&w5$}6EqG^4AmD%y`+6iyz@5ny43AgMy#50A!;a3UyHdwqhgo}p zCi33fb$>b^aJcfuV;HxxIT8`hR@;%XKE8kxrSW9(MFYmiel+0MKy(VR-#cbIKL4hm z>biUY1DL2Su0CFn-)+}`g}=rckf)nM z#6JJkxm#D_6`7)B0Jx#zw^cLG8wSmJ*n8AAp&hQ&AtX#Ee#AoVdtbSINHGj}gHB)m zqB_fmr%{A`!($eFK& z>ba{2XB&c9%t=>%hc~Q{=UGaLHE~KeGodFw^3$et)Zmr`v!&YlzQNOn2^&6$(2_KO z8ql+!d;<=~vG=e&N#r>~KJNY0C{OwoKkLL^d9o=jl9+;T&0&zbEP&bL3 z`1*Et^lREONvKwgv(KE2adxt{0BMfpDgh_G0)6HkbC2M%(2hjeYDi8G-Ej&pOI&GH zc;U>)20lT^z@_Z~deW(;u5HIk88@~AW8B7IoW(N7^Ui030d!{Du5v;B$C{{tylz!w zAHvg<7CC4dTP+EE*>g5l`_NdzZgOOSZ;)oy1@^+mu4pH(2Mx-!eeQgktL+cM!u+$M;4d!>gA zBWL~GFG_eZWH@25cYbUdxQ#sUB3JhvXA8*Z!#Ap*E2$IeG!y+FnH2ucP0f*oG~?Ot z+!>l+s(rF^nz@c5L&@<*mzc3(`{HN{{qpIZ5p*nUTGP9V0W2((kI)6UFt*!=$3Oh> z6YJgD&gh>G{&3~EekibMF-40_^j~tNNCb=-7>1>F1wGJGRHs?k^Ai!`VlN_8n#6WR zJC;KBs~nmq1kMta5hv@SLPS-VdvK&vKd=ytj(wi#WV~}Qd`)ijzl2t{_a$zZgszk< ziabS5@b@~R298q!`-k0iGV=sI1y3;Kl+X!M=}lPzA{2KaEJaZHwL1>JtRG)I0n;LTXtf%k3Z#Sgq*N~TD{pku+ z+<^`rkR4dw?k@m%ZE%1sf^yGJU1B)7Q@vYv)LNy|rXPFBR1POO)tLVQfbjiwses&H zfQqn6BvA>~-W7DJT-8OSbEdIgQK2WI)ju8>o&(WN2IKeT z?%P$w8~Y7Nx;B5;l(S-pU-v>y>}AfMCj7p+A!kINlE^R-cX73!LpsNRiK-#tiCXV2 z?bbI^RzoR&g$2hU?kZ%8X<6_n5by`p9(hw3NOw0y4$+kTl(2K-s!mXiPfU+I_=%=A zKbKQg2`#-lPRcBVTv|G`hnprt@v>3QZlBB3%slw6{dSr8EHb5DkHbFjI=JywXH86@ z2b8?yLo?PCR9lNtP*kw791K4=B0bO-nWChv;os%&YhqSJM#%^7@*9(e`R6AmC&=+E zq0oQ?nZL!wdF4f@Qyd{qjai3Q>k7VS1in|1#kuT#R$ikuKJI7f2EFH3mSVdppoPyt zGogz4)wQrNNQA=5`dH%`f`Lx~WX{gFdCly^*ov8=^5T>-bUz0XYRUMn$@G@2|L&NO z6c^wjosR8tJ=;Ux3bwzlN7@JPDy6yL8Qky0PVtjaF%>=b()A>E+`ZRd^THCQI}~#x zO#4P(!Z6(LA4sjFn-HtIJ5El?2$^~HXHG47OGSm1j_y!NJu6m&mFfOZTBA1)Zqpy! z!O^i$4{@90P)9aME>y6Vj0u1h%q%Mj+uMa$X4uyxByiu)g8@MP5E-1HIr8?8=+~-=JAFth~y0EZovk zDcK1L3kSjKy_erQcB@s!h5kB3aAK(qn%QKkuYck92*Nuy^%8^pAIH*L3|$_7-Chrz z8@xREt>32rJ^-ifA*bG3BX>&^ez7&;7A7I=tgg zJenI~2t`dbh$<;Ed-~}2%}-AxC0$U*sSL!#Z5SgWWF}YV!ke7^ z4S3N4B)D=Dz{=+rpS^j12u#bByJu&ZWhNmhtDSEL{#Fn9p3Q#W=-&?qKM$1WmqRL7 znLOY9&Mj@nkVix;DJhejUxzJh;-RiG03yT7xuZ^ZE8r)|0xE=MXFo`yr}6pohx+_8 z@ts10$=qK!2$-;*gaGXy73tpoevZtZf8&HZd@H8?}P^}Bk_vlZfJh?==~KG=)O zsSZTqglaN@NH^a#tmW4pvoE=)yQQnz z-j5>&z3nsmuoGkXb$e*-*Vkaux>j|%!!NS9<^3YT zTb=C!?)SmiRelo+N8Hueb~DeeXIGRMU-i4-V+8_`_jp^ccb42Anz&eUL9!MAIicJn z$=@m71D#jMxC{H?*j;vGpeK>&$z(FZunp5mn7OE5Qd#|T*h4cO26hTL9~cLlS+CQd zTr%EuAB5YC^%pw@hye)WHO|xOH&hN9v+V;)zT2d&##8VsB2&_U*YbAuO62Pu^(ztb z%Y}pYFBf=y?-$(Gy07>}(MYWDY3`5DnUm8gLE-`tyF@P^eI*R!nA`67iJpc;2g}Wi zF_KB}t-HyEp5Oc4FU+{#%*SpOcerDy6Xy9$k^OX<*x26njpkbO2JSTHZs#+SS)#Y8 zy2Dsi7AM4|h0OW zUI>#)D7NS0g~wH_QmV3$lckJVS!baXhF|!|iD=gha$2(cF*qJx;jg`;XxB^N+f`UJ${Ub$gVF zKu#gN{K#Z>PHlY}iuFVAHqEG9R~LFQOKCe4`Imjjm}m5yBjM&!w7N)>bs3eLjWUB* zG+qo_?h0*!#dFS8_d`NfJ?4$jwH9KqjljD=`mp;P^kUbx;8WjI7C?f#xg>S(*42QOB%XC@-0u?Ld@%u z0w+QHqYok5^j?PG=%p=jS3!Z|A3B9LE9QLdHyy78ue-8qT^bLamcWwN15uTFUV#pl_yXtwPdAB;DF9sqI?Jeqy&ph4Sp4U%& zSv`HdX*ge9Rkgp{vXQTgFnm~cH9Fl;EwM8fu`uLhDmF0=c)?=M=8lkgP*z=0iOtAB zC@?X}uWU{boT$07W=ymUx+Uh0!F_l?2I$KL-b9Z+mwd;d1dDs|GKg1pKeX4^pIT3k z(-u#{=NL@UhoIBTPLs)ao)Td_A94u^$;rj(n8gFj@9JuK#Wf$d@)88g7i3vpKKP?2 zci3r;jmlW zddbjaZNt-OM_2+9k^=>t>JWh%P=S5^C9^wY(M{%R2k-Z5(*YBqb<{vmsQLWw|XtgQw!lqgw#GveEkw3r3?-=TcG`%sdUt6 zu|ofB@pKXvr(p9I%53H76ma@*LBN!GfJQ|?pRbj1E~7`pFB1XSQN1z?M;vu2dEW2} zod&X+UvMXwgtSH*D5liZp!~4;y&!LSD>4b$FqC01X`+$A30kU=kMBX8}iy3usQll z-PgOa^KB?tXl{%UT<*25L~GGj@jc&7VR{d zsGC2ytOEH!Up0-<6f7P?oi~lqt><1|c?ev2K%u|}ql5?LC=VId^XwC`30J6yf{Qz3 zGf}G)tu&B;d@*~O<@z!bzMP3R6Jpt!YZ=06gW}c-CvN>zwV{S0vMC=y_QH^@2AJC9btNB_eR0@E`wdCI1&j>*dY;tcKH0Hn z1X7pTaq2*H+~`c7FAY0AwdH%VYgK_k*ZFfETcBzJh-(B5EYs)Ml=5@(df%3Fg$c3& z<>HH_B?RYu-49qGcjJ@1lRr85Rmmb+1z!N*!;N(#X5#ctGZsxb@@iOkFwJ^NH;ii2Fi`$Z0;c>Iz2d)vNn8P01FXQa$qx`RB zB^M4i%h%*7OUb&SXtaD7Q&x~Lc3R`MW{HVq22%>V(55L7*-+!l2RKnJ2#;a=+McPrRbX*Te&E?o*ea0xf$YairCG(OCVm>fXWwP97Zfw(R3?w z)c#!kaj-~avtfTY+ah*@Wc zhu*$g(rKVZf6j#{^E5E6X?=QaOEa&s z5d-RvW}LcqRLu}A4fC+%R~O8L#7j{AtTfm_6R#ke>Hq!{7WAIluBee7I)Y=>bty0b zcF1=erSva#VeUw@Sqc?FBDvob%8Kpjue1@r!*R$-K&sJEQWX^|YZ=6*X+cFn2eLCp z1#kZ0{L_2$Uq2epU^`LWAm+=M)f_Ja4KWX2(}J4o@a0 z*)I=A-PfbBTZ8-G`49~qLt(0CpYTy98MZ}mb&SF@yArcK?Y|GarH5`0j^OG4+h3u0 z+{I&Xu`6&LBUI6^t}Y~NUQ+*UkHz{XA>I+7w@#h={DpmK-C?m%o2O;veZvxB3Qp~O zyKiyO_KgF5Lm_2w_>GgwonxxIdP|1Bk>2;M5O$3qo)U(#7}+BO{nr9ODUE&eNaF{C zmHe$Rn1_46`CfFRcNLRC%#ia33f!768&2ehFRVH!(bZFL4gi1?3BXxPFQ{LPKZG^v zSdOHIpS{Zw33RA~62wm9t@)^3f#u0c?iz|-DK-EFs0dlr$)f5DLE0UrmA!I^;qE5x zVyEg=$IX_|6)L(ZBZS#aT}(S)Fdep_kF_82dc?f-a2O1;3R-CpX$=Xfyv0hmk7T5 z-tZ#}Z7gNuF%<$5Lia|vQaekp5esc}aIm<=M;UqoB)}px#lphyeGlPpZucXaTB=!6K9I z#i(%i45lS=-B%U-;Mg)?gFW}>wDx$$v|g%$(Ggq-Xp>ajT>g{D{p%H^z4*9s34?Ox z!7@7^II&6rd-)fpmj@o`FxF*RREP_}(1C^~Bx-+c(w|FG$Bo#3ywd#^yyl zWu|VKNF}9IMG0o?(*4qes?;<*2}6A z;A)iBHG--`B-A)&^M5s>V5_nzC#ZhQYPbE4sYxP4k3Y0eTS5{z^I0q4pc#5LStFN% z4`$oNMG4ntx@-fxmPmUZv}3TnjQ6S zycOCB*aH9m$M%& zJ|M+pHwB%XypKYP$!#emfI%YYZE`C9WxPbBE9iiA+IGpA<$Ez-VzVbXoa=UeRi=|u z`%uWPuG+THVFjO%P-9QGPgX=F>EJoB-o z1O(y_i}zPxZ>Tf;e3UYjGh33w`Pp{FY8F_xQk{|YAu<5fx)WbNXr^35-xZHHlq%l5 zN`m1_K{1q;)_zHaUEv`p=*Lew)y z&VYyu85#__L8<{3`eG}I5!_$`z2l0(;n7b%I@kdlQe>F_pd7&wfGcfO|Dmlf0yP@d zhfd((yQiGFyh`IcDY~n-YqltzxSaL@*S@ zd)oHU7?+u8#?3})BJ9GH1u7oe%Fnm%%NT2nh18p2nvE~ti1lfi`f_WpowrhRy5H4gXBgl-i$$_MqIS%$J=uF^!_!4L%4JR zQYhhgjMUOsGMGz7SRqRs>;tC%wI8>_Yy1j0*P-o<83v|}jym2Ary&cD{MS;hpVOWq zaV&-^AH59=`v?pEfGP<`>0sS8LJO7P90^t>^gRn@GP;6UYi7nQYWGHzVx72Q9(iCG zIj;ch4E1I|A8})04C?fG!FC#!7&TPN68Tu~uY<#=gkgcRk1Qa7CVa+T%s zORG@zd;&o_3;4{fU~7yd?l&wkIy7+(7P zW}5>{G?gW;7D7=h>eV0BTVNgM1)-df86%0w?KsQ%(Pk~Rl;k|_4g$uCOmjOMVJlgB ziGHe_**M|D3Q1){-r++&d%1S0@7w23}x$NId!3RGa|C$&GzfOW4n)#*{r+|>o zduLZyDahYgI|aGHF&6vgqI#kNfUn8a+@gQ|xIU|w3D&jDtj2tCb2O3OzzTGUhCGgna%V?;Rg%{6KcDLH$bItPDh)d0&Yt%Wd^y6eQMfBQS{F4 zoMrfa@r$9vwWUgQTwRC15)B=@wpfjF+7QKY`)G#1BFYLp2g4UbDC#*sb79nZQsT2y zVp^-U3kU>4%STNJ1YNMwwC)F)M@2Q1N#QP3l=XjvZXVzP>eYN2Hgp$8o53*!VZ$4b z?`oLjv|Pk}Y4;^G44)J{7~y2-zkv1(r-$OQGQz1?ZJ0taeF&4JCTKnhBo*e@;p{^- z(G*;j(Zj|6(1>W2wMd|4u(KBRIQgok;;tZ#i-%`vSRZFd8CZXSS3U`F!0+ms=fDdb zlydlm-x;hJ1V{L55fG_uy-XX0PjnJw5E0)eR)jw)f-)UOcWzGJ{ z3?y^Be#OfeRcph(XQ9VjXIG;=s*<|bM|aGYwsk*MFAUBHkr$eU#Kdr7h%o~YCMcV+4*q-fv|5Ys- zQgP;JA{G^^H79EcnNWNv$ovoy!dnNCAbC&QA}0i%jz@} z?hXJQ{6JMG+Q!q4msk6>>}RHvN5xmzmT5&2)0=J!M`6VY-9KNjp}o9vIrvbW@%LdY zVEU;{a0t@_R`!D%|lR^`)9dhlu>( zRyFy$L#K3z!mQ(c!F;iaIoe}zX}qUr1Z5iSRPHD1$o*$E8ezd zA%~1OkdXr$)pXcEyl0*ang!p`yB{RkNj+aMR6Y9;cP?17nona4?9(8mQQ*T;=D=V#FpypxxGgmTQYy){5GL0&Q%#C)r@N@I4t`973>2Em6)_emQ>jt&OfSLqMzJ(mCZW8Z?S~~h;*SrzL89DL{ z@vkg-o>4Npj!a;*AH8y_JbwZ8G19e=lT`e}hj87WOyC0b<)UIfm2!3Fs2WE_WlNX^ z$Z$lSpDTMxJfiWiAY3YI&2-wZSCl)nq&FvNmW&Xh*s9OhupT`$zP+2vMWCt)XW5r| z`8`k%s&~_gD^fu#Z@`j!{SyeI(~%e|K4cHUp@Qo$!2}K)3u{Y9g~)2R4>T%itcug9 zDBIBRKi<5@{)o%GZwLLTz}PgzFC1waxur6LDprKc{Vr%*!Z*9w9eq>U$q?~lu(V=) zR%ZfO+w*z<_5lSp$nJqoEeevlzda+iL-;Gs4rlj&zcCaa6x_8Yvv>M_oE+9m)V#7n z)X54PgD!J+2x$ML6DyjZX~fjKQD_U3cV)`{S>e*D5d0_jJ&<#_he(>6e6p7asGkZ0=z#$e?mB=*JPln{SR+K{xI zoP2&u4ZLVz&y`h@B!wBy&JInqcB`W|e%A6Oo~y24gzq0IqlpUgQ5_F6fmQxGc)cyi za3$c}Mz>y{o5}8w4Ov&|DJDS z`bQX4gkUrsV7w85kJx1-FvvgU-b&i#-^tO*pV{ak6RjRpBT_KHd!zXfaQ7q z1(+>wTkD;6q6oP7Q>Wrc9J@p9#BO48E|Bd2_nkjJE8#n*D${?dTQaQIDuk&Yvg{hX z`oJ6FMLPfUOO*~_JT~|NuySkK)2t>!YCsp3p+|uwK|$!0yvJoUr9}kK!>5F9CRo(A z5Tt61u&}ZTdn^>dfU`G4XkKvy1`A=@-5Vp!DnULYR1O}r+LV!@Tzxt*EuRcn&xal~ zv)Ll+%9Xeo(td1vNv6V|=L<7X?!BOe$S=#1dH-<_d$i(dcSbl)IT01Hh7Tm~-Z3tl z(N@r*@dfL*n5B$GgLvs@B6c$ejsG}>)fSw&3u<2GY>8#5tQx&Wm<40Fx)29bU!eFI zSm~u-vn$Sv75(VbDR#}b`K8nBEBt_uZ4u6TBag7r=Je>mddo^ho0XD9`kr^3IScaR zez}A$(?~y`*$tp^`ovo-#a&I8eVFYcTCKX^yCHZa)r_n&u@ZVxx{`Vu1QOtgZue)B zQy4~xVf^A~^lnTZanEkQcXX7&bXzs9>~Ea>=oe>agyDT*z;waL#N?f7^+&m3QxK=f zh75@7rj}c(sIZdQ6W-r3C-TuUhWz10#3o27bs( zOhgivUx}Df%*fm7VI`|4w$i~*5T^$GK^Y;eCUcnNE$tX7=C7hU**%F~YdHpcP*N4c zk}~Q<2{LTwBgY+Gn)*+)3X`Hjk(xCQE%IkjzARrf7k6{%x=sVX5Wnlbr#HAFo%iK$9spDHztC5pu$ zR}7x3m2s@8Xb|vdz12wb9~(bdIG-X-D10hPGS)8pHe4WzoR-|Ysxip!XkGzLD`&;> zMTRZ%=ZQqAO{y+9;R5B}HRgKD*_ZX1@T-xzDS`3#`Y=9O2klTGeK+IHVS`Gw_~Tk0 zF+c7F>!C=ZM9y+hnl3T&ME#_^;7#qB!@4PTH(Rk))hP=GgsG3g# z_o7|BzZ+dd;(uK=r0Axl!#1G?u0+i%9Cg0t?)IE~M<2AR`~)q4?}#^2U^dWT@JQ)< zcaw;tsX!gm$Rj#aT$MSxG#+_th>zQJQY!HIVqh=~F~6!1BJ=oq8o6U5mkHqp`AcIv zvFLN4xox?KkCVX9;UCJW2H#>rtZQ9r*EjFkXqXtqrNyCG*{YS+CSljSyZ->oH2!Uw z3Ib}49GE9c&-M0fXV|(cD9TY)cma|n2~SE$SMI}BlgdSlmUggSM52i4$+;eQx*eXz zqAVWavx604wPoaadcMve%896!4&l#cyh3KWb8$zq+k{!z=AcdWnUr{LsuZG|P4&^f zX$D;yg#nM;Jod%$-j~{$yY%Ar*wBU!ir~m+X%mLNl+BbZzi;gXS)WLrraCfGy+T|2 z9iMiyec#(k*+42ay;y8C^DeV!8Qhp)p-@ZEPkBk%Eyps*q7#rEYX#h|YSW;J z@wPatYu@(~rTukhYg)joo(9t_Qnirts}Py-<-DRdjMw0uE)D8^;#7WzKk#$kUL`Er zJiS|-!P#^<{ClYaw8dvBip#OterNniw3x;4TOP#49i?_{5A;vRY(l+N8IdYPD%w}K zPkZB(@QzkND_0r$7b}AnGp@*_fHD{0Amzs4^(lx*E{p5NX?Gyv~7^7^Cne< z-N-@4tAoI6L&_HoEGerDPL``3*!8!zgwxJ^uf51cpB=oKBPlk!!v@TOw}Ty+1Gf(0 z{dwVazemR=q!Ckukn)}*aP&z~kh(UjrF*dCCYjyKmXOLu-s2B#*2dqL^`;lQk#>us zf)15tRiX(sW28CsBv@G-Gx5-WTI>%+U=3jF}RwMZ7gq5s0L% zBiO=VQk(ii@|flptcZK|BeMRpVKNfjEWZjey2k1sB? z%?A>o`YjbntdN%sc+mlFC6ty=2aih*P5hy9`#b~`fs~dvY~PNd~~nbN4w6@qAn(aVgA@Q+F}ZFI&x8ZUL4(6&<~jD2^kLa zbfkx<{CH4WXYB1(ykY9~zkqOsx4ScQuqCMfB}NRkr<{rxyJu*bUd5}XuE?f&{#Q$8 z$%$pR)j)%+Ji5M66Qm}cqkSp6tmP7&{*dq1wt*DnF>hN|uW~l@W{oy2fRi8qoP>(s zs3X~GBwsn2$SVvQ)lNOaI#T3=Y!Xg{HT ze?fMOOYfa>T^plH;Mu*nuM!&o zarFtFf}c9E-$Z%ZWg%lHLBEZHy)8em)sQQtM}hENCimn)>Cre=2fb0+h&5fX+a+)^ zO%Se{B=OupI{E`p2QmzCSyGgpVJ*c~8xK0zuu`&>2}6Ki;JqJN(4RAeYzWsxhowZ2 z!!sZ1SqKX|f0XM3|5EyalD&F&F;LP(n8K9X+C!KgcPIr zJKzV7gAON3<^bfbKmG@H!aFH*AGrc015@`?%A)5WU%s*H@0r@^kwL?)xNLKqy8Hx2 zPggX`f(9_c*Pj}tGQ8rqkBeIB>OeligtleQi>Dl=`<|+eyW zD+u*6S3pY{;W+8o#q+^4P_*WF>oEwUmRQ)>1zlf-#(NJ(i={f>nOjO<7vOc4B^Py| zfn9d7c0fYJ;-K}wfvuzv7PRAaiAP?*Fyx~hN!YJ7nBpa%(q33l_jDAqA&b`sps#V> zYHljvaD(+C4-O=*T(6Bx9N`l4drH6+qMB=yMPUEPQE}x3-Qd3wid9n_HKeGi0 zkV#tEu!e$VV%>%x2FqCxoXp;)`x`{;c?JoT3r0W)B9Bs`TWi2GaPmC~5+8j}anEel zcp4*P!L4spKy0g6NO!zA_`7A*_jN@_TlcfrD<0t;8;8_2 zW;mu>Z_^O401ZD&LKj|(5V;y*$BQJ9Lzdm|l9n}e&a2g>e=&_u?e!JJ>skLxb3>8+ zZM-0biqU|c>2Nh6)m@;8AKMIGWy6^Vb?ebcROSiM;I&+55+AkVr(}8a`>J8yQTkbx zyD@;Ii6e@qA@-NWZ;XP8k!kWW*7vCb7Pytp{RaT|nqQP#<-LCSl~%~3(Z?=g)n~Zk zg|@bB#H7OF2Tt9wsNgP-&QB6!y)=AmctxxidU9IueH9{ib$bl0p)YsRp0Fjo65H+60Yke+rBGlgG|Kj25L0b%1w}%duDhiccJ~mC)40H{He) z+of5Zh9FaZ{cX`v$qbY_n}2K6i5Pz41g{Y+Doa&kDoM8ChpcbN1C9wGZXYWr4_5rp zvtYH<(?`8&p}_rizo@}3HrS9h^HWP)zg>h~xx{ zvk4k*h!*~TR<0xhzxJdGWi-)5M<#Apxk9)AEp_3??X)p*8d}7ij@yYZFBN|8XVxAC zf{-(XY0x^$9r0YE8TYJhBt&(v@ydobp~tra71$zkPdu-Xk#cLB@qYJlfOM8&#q;-w zi9eZ1!Vj0F8-f;dIQECiU5s5FA;g<-8y#N|ENLn>r@aXT#f$tz;%Pntz0~thpy1Kn zd0O2*uBy~)rybgU;(%{=|750YD9Z&Di1C|C*tQ0#$ z`kPySXqpA?6&|A;6?tnej))*K)c|#l(*ESqjQ{zN#fN;SR0G|hvF#v@if`7I&>Mpg zPl84V3@5f-SwrZ*=K}KH1uUhlWH8Ff2LTm}jp1-(OsR!?*g!x&ep%z~zRYL1ZnW_Z zs8^Js07IaF&8PcsNKtv6q zsMcHPT8x zY~Ioe&5z@ zysgy>MPXY}9+jUL4u$+MDfEtK3zeGZepwG$>=Osu)eIDv#pG$-Yk=f8+w0-c{rZlx zKx2C&0JhjTW=FS|OaFx@Yw?zfDe0@Mae^Ldp3el4Hw^NrJFZ!ziiH6d6IJc=v@-wI zi_`Scdt8p-!JqUJ?{O#pM)0?~*$OG_Q0Eu5;Qn5bH{Y|Pc3D@Nu^& zJLuwpNj4U-`4TDCy%{{HqB=O>4!uv12wd9x_w|(U>caT|YoPx#B;B8%w$azRZbl^I z_4R1d%G6lD@>x7ODf$pk#K+5!s!}2(o3l|O{MPilROLTgRaN5sn1T)7-g;1N8b{yvT^^Z3(pLLB0h8a@vODVDSetl4XD8tEbuUHP5Drm-L@C+c z=S5ke#6`v;<@OXBTR7Y^LKDl^i*vh~x@A&AKZOkH%v-@`jcmW2(7PKeWZ7N%$~5j! zRVdAZ){fhq{C{X=Cn*0yd&L;{3R)^w>^jywuDsu0Q<6OwiGJXQ>ViX7j=yhy)G~h^ zJTlo-FE#L_Y<4_ZK*mS9>FMsH*NE?D9dVlSg!FCnCfesXg|La#tTdw4A6qQpH=t`7>`n7IWRy_WE+zQKn&!NUj%$<^aiw@54Wb+CR2{snM{& z2WM)8I0L7Ye-)qGFTkYssnRe>*K!SriDq=@aiFGYWhG%-rT|V>YWKn*iDjAPV*YAQ%A4I3F_s14!=*+OQzh z@cakwasR_4NmYdV|MtfJvKQXE=Ks%!x9)t>#js7m@A`(Upxq1$|^CnrRot;fX>{(bD9TQ87TfPW<1Ge7Q^dIeDxn}Im_!SWI z)l;>fVn`dAzzv71K*{`D-mXo|)Z2?72iGvOP9o}i9u0{r!e7|(e6$)g|tQ4TPqX!G}(JQN{I z|5FWuTv!VKzqrWdHd^m}*Zw0j>C&e2;PM;VXFY}RuK0!Vf22@D@Sn*i;|K)A-V^!&-QQj=z?_jYn0JWvTCNL-oNBz_AwOdkF4?+?-4Cw%MG z@s>#TJseSt7%r#>E@1PsnD_>Ae%&qOU!?|-Wf=YU&_orGUH&`#RkbeGLXW-Q05XuQ zh4yd%#Xs+4`X9YO690-*|B-MF%KwuKh<2rg1?tslY}j%_+G4Y&5A|xm$Z2VEy+8kD z^MwCIPFRgLodN9`bm7-`+194etmp}a#f4p^l1af`|B^o6-zUW{@(F|fmKLjLtO%2@ z`NdDxugm9$wDc(H|DmWgQNqNrIg|Uel>u_iE1;M3rh%BzwarDI4!1*|!okt=|E{2_vhUg&8~;FdgEY_E=3$<89xl}Gaa^Gkdtz^2#d=K^s+O1j@fGS2$tSofA%tg<2w+k7FKl`VYtNm@V; z^CytWXJau!(VZlQT-vM~FNyDB^wPHg_@S{Zlg)3}bE;S;It*a(TLS4~rb)(X{Lh{r zY2q_Ox=YLTOl2allDT}aW!h_jIkhskd|c(Io^fK3Y*bV;YHyM}!6TB;}@8?zTo`HoK# znb2LdtWP9g+ zVL8*6Ji}U;0@)nzL#zN^|Ly9x5LqU5&$uA6t#8sQI(IdSE{=Oj`52 z$SF06J`I%5_JzkT+F*ice2{~zLMnNlLujfOMLt=$Hh)0KWnu$wIE!RS+?bA~l&GB3 zhX~IK;=0WW$_h-1vgum6ZCh0)YYkRiL9-(v#Z_YIZL+zrG(rKV6E)Il$|1_~Fa}42 zHhLw3H!Uh_o@W-(eJ&?>Yq3D()d2>{C86%xkgM#g@v$SWGfbrPHHXXY2r1t|CU~sEt(UXVG2nlQXt8z zsm*eJ&N9@NuD4Q8@2PAV*tj0bVw?M^m=d#)k=U)>j$OoNs+dBFe|9-4`IMOCCRL(* zwR2Olfnd7vWq)|9ojhNjO0L5D>DPN z>XR^DiGBQ#uvy5pnbz^u)J4wk&1K=TtU_At#6M~?kDNT!!rC#a&m1ugJ8yE*$0# zvKdWKm<5qJvdAJ75$Yh#Y-xz2ZFr;cMxoy}X%ljUYc?ahc%W)t-+x!o=zNh8^RT?s zlsa|o-#uUZnlk$OTtDw!6tXdA2MZO?*0zv;C4z`{L`I{0GoM{U>Fh*J?Q z>fKeLT6a9P0twz|$g!W~r7!=uV0Z|ivlvMNQEQVGMvQdE@$wv{D9eG}ti zOFj;SaE=}V5J&~f5<)3~@**++d7pn`63FmjrSV?syYu10kCx_oUZ0%iX_`gvdJeG$rZ&F@jISU^ z)m4#Zm_Y&n2=wscebT08gQwQM`%p>Wg2aql#f)^tgj$8mUA5$VYB@fV-ne2;Qh}l6 zz!VQ^rKl5DASR2cCe@11MM>XpyUX|n$A!%DZi82zBI|ScXM&x!w_9(fFQjlj64ccT z&t53HhCBSs2YYMQxyJ&mD0+ny{qh9gkjQYxU_^K+MW-9 z855Yd`|NoB<)lL90AU)wV{C=~CcLsbkj(UCDB;0-`6Vx0Wwut;earvVG$<7rHotJ$5bqup{ zUy?gITKs`pHLoJ))vtnZO^y?t*ugNT{R;GKYG)6mcWj4sKM!9jJn}J!{FgON*Wrbs zoDF(W^^!H6v&)UNxCBpCW=IS}&G&NVRnjAoAuFK&dj&XucLhCwk5jv72prkX7ri3| zpbzFCs^Fh8U&!mR*supK&4+iVF50-@OrhA(E6uke?B05U|IiTmM{7YL{Pr_f+l%6fP>tU_E$(9fj&~gLN-mm&)rt`4^IPh+D6(d2qzc# z`@eK3iJOCDXDMfdiBltE-BSQ+=%KaFo8T!Fh#c6zK-Tv{fWk!LoSgV6sNx6}N= zv}i);moLKA;QdR=U;pBpG%dG+$x3Quv^&0TB~)MC)%tbn^nd+4U8zuk1L3-;oQ^Ks|}RX+k)nZE%(k z^TaH?HgU`ZK-Amwv&EU9V@rChSHDkEqZje?~ za|0TtwW5_~fZLIkfARU)($v}@oADuiA;_t(;NCBexB)U>#CPP|7*z1BvWJrLT_dK4&JWM*_5hfdu# z{Fq$SXz;DrH|x*x7tFDJ_9!h3u-P@tF$>T9DBSlv&jjQjCbt<5bo>M_d6n0+PFjlF zYYrQX?=M%tH32S)Z5PSgyb9g54)G7_Piw#}wonT6u|i8T zZQpOws|ZAM*3ZN-UVbS{A+FcIL%~Eog!N#{`yC6S05Fjbjyf2PV{IK)I=Y=E&e5bZB+#v#-ZgwE{-@n(lLere@o~|ZD zR?3k@&#CyjPdg97-@9R(ZIs$AAp;Z)v`GB|-w2GFztq%6&>U5~Prdz+F!g%unq+Oj zO#-xIocK+4rIK{HPct)Jv<7`GE?v|hs5@6F1iqBi0DWtVkd&ITGFI=oe@et7itrF%3IswJ7Tr=u?#?=02KDb)V%Sdd0HT`24hP4uqHAEkD;3-Qh#b@>Vb{Ca-Ar=1 z6lNKB#-k%GA{+T@`|ZON?iop(lO^p}Z-1+k_yht&9QE%%|p{!FkxIeB!;~h@46HXs&k_}r_8RLga zt&*CfFH3gt_sXA_1mFfuAzQS=0K9f@87`<4vzKNN$u8mPT)`zmHv6f_ zXjH6sLT5q@z4fw(@aE7+$@uIu^z%s}P1<{tItTfLp?70*+!89XMu@Yf0Pi~Kd}alb zcT}sXx#QgCMjGjSirJzFrLg(a)l%(VJv_`AOSY1SiF4x&J1Y3COj}jIGLjNAOOs;x zQT67}y(!{T23=tw*Qu9vG2ARyl z4zD_yv9-l?Wfl2kCvp+pj*@PETaqiWUO~?&wrtw%(h=8n zQkpNZi9`0^%I9i!Bnk2l76b?sMQ7`03$xtCU0XuQyhJMoaEZ2OI@C<~<2>WfLId$& zRh)0Mwp*x;FP<^=R{;t9T1*v}s@|)CIgx3Pbg9ki_-_GbF~6 z@QWc0KK;D<#)$7R7+DT$m9nu~wkigZ>XX?VB}F5Wizdrc6E2b7I2rBqQ%hm5mAK8# z!NnkZx2@m9 z{~km}Z-gAyo>cUFrFNC(^~Er(NqJW(;uigd;)(ss!Y%jD@!ZF~OOa*?m0VwQQlW_G z!po9r1675Z86T$nVkkvW*-R@2CKQRPD>bNcJ7q-L=a z^V!UiR?$ms1_-B0en-CGM+BF7tkKZ5D(&=ir8qdESCa3>D0&aZx>$$u?xBQ#q15(tOXIY(_6Ar&&I|IBrQXbf%A$ zWgLX+-A0OdG)TNEsC6}4O65#Ei*y=N4L6f-cQ3MF(NB#*C2`Y!UEXP>>)>WLrTIkU z3=MHSE0aovpB}PhgJY)Y*a=vuVn2hnpmOQVQxuiGmUjr6zq2T|N7G(rPZo)4J50}fi6#b%fco!HP_@+m5#)A1p-4Ym{pgDQadV3%JU?(o`l2$SIE><(*+xz8gS)cxcRt>PVNJH zQa6~kMA5gNyDo$l6!lufm^c#@UbWyt2L`oxnyBAA zew~{tn&f$XV}R&Jin9-b7WLhiJ;E&8BSJZCP?W6ZS*PZxgejLuOb&kHk{*qGB-qjS zMoBw=Brm=xMq-fSj=k4A_&tN~j>1^VG`lH-X-L&C5GECrS5OTYBEA4H`huIGVu8mA z;%t})B$0kwh+krN?ZrPf->7HFg^SXE-L(_Gs}Mc*z=#D#h-)6jSTaiBIDXajQ@>?P zNotfC@qtk5i`Bl{ zvxDJhXdTN#T4pGW_`BBK@m-v4NRdLi5C2EA!Rq)Wzj(1j&4^u7SS^Xj%<+gkO^o0n zuO$}d9gf_nxF6P?+nuv&OM*&Fs{6xP@mUEgU;fxZJu9kT~=SP zUYn$llUtN68r~<&>GqoyP&AsN`+iA0avjn5a93m9{V<_^&zG6MQ!@0+h7a|lZprK6DmPLI zM`gU7zC-BEn()`zG2T#qK(--=1GmQh_7CItcPNTx zg*WroaVPa%FGIo{gkG9QBZ9c3^={MX`SqVhbYTXdayML$NEj`(ND(HvC^O?HZ)QqN zALrLP`HoP96M^w#wgGdT?&MxD^T`*QCK&4Nh(4KWB$bx5&)%8TJ8mjmYX@*NI@A}e za5N}`Y^Nq`fqSD!b>rab{OXlh$El0ac#qW>J8_(0c1aH?U+M;N5G!msXbl~e0r!21 z+C^vRXzF_>-Y34+IOBar%B1fP$0_I7%k(8Yq~kt~$=Yj}{N}Fr1yUgDrIJ=(>Uv26 z`}{ah$y-k^Q4PCgx_am_vMY+O+tO#EluQV$wY)sd>JRn|lGU+Qi?NRhS+-U?kh@Us56Or>+RY;N@Wd7-&@CUM@%q%lOiqhMA9 zG}Jm1V_wI(E62((veRym!UatQ3$KzCux~UWc=Ap-s6Y`O9 z6ci6GYw0la_GiIOF>dh&xQR?I^W{P-YU8;UL&CyQzo$eqHjNn@PV}wHXoGh#NdPM3 z-_>>#lp$ng=c_$%C(BWdIJ`BE+S(Wur3t{$S_OJf+_dst)e||%?s!?P2w#cEs!*H< zL`xC%b}@5kS}Qa3>FM&aTv2e&$3Ac~=Cp$AOzO2l7fxKp+&a(pco<;SK|0~bR9H#v z7$!n!m@+|e>!ldQq$zf+YT7f=P!iK1;V-_2>5U6wbhI8CV_I}X3zDFrRx?qX)vv$~ zSowC11foXEbYqwVN<{0mp!2TW$1^{s@-Wpu);@Uj537BlLp!j6BtZXXlD}!V?sTWf z2Z9CemdV-0kD%!Q7r_YgJPFd6N-xg^v>SamO34j2t@=e(W z2j~;96S&!oYz0s@E#*{L>w%fz@I<;wh7XciVk5hfNOF$m@ykmbp4o^;RO2GlB3C@P z@4WoggoD1Q+XZlkmT+%yP#g`OXE)!SW`Cd-M#TG3nkR@`rvwU_p(I`-pYD^l`cYb` zeALRiv(s~TgQPEyc|_uI;3AEN2DSfWiID?2Xwf21oUVtGBZ96Ol)sq`bVs39bw!g* zH3GYt3zJb4Fn-5xOPq6+D9I9MZl%iHKe#$@iRqQ<{cVY+Om4^;rs;6VeFe@VI zBhDPO3hU$=qbZZ0W)gi@4!2MqVv;W}JT75VWVOg}*fudtnMtCm=oQks?PNc}1@?+o zpe{N);?Ny69zQj}l`WGxDwg-Dq@pn5n;TM|_YecoSe<@M#kwgEd~3AJRns}-FPR=n8S9i` z*BE{7rm$KGf3gCKkt`64wPGJ?U5*&%ien;r{@)Y}x6dCZ;_sI@2D17*I$nBfIw*OxUEW<}C8&vmEWCxui z(Gi++ao{KLNSt0tcn7vo`BigosQ83fBT+F5e?Q60Pg=?lTrd#J7E_8!?|0p~2`@Kf zQuBv2*3m#kz!Y^G6EJ0o#u}n&i0k-SW-1Cl{+dhVPzyNIL2rqPCzzSXFHQNrK-Rwv*q5~U)=aEj@

    iBi(Tq zA+i5P?>!-kI$P%v4A^0pjLdG1l#loxm{=C1``TGJOs(j7nbwWMDR?UR*TvAn$nrKl zHsTcUZT5u!_E95yJkzmX_+#67qqc2 z)FKwq4wiybb+{5|5~O}R;-Xs7(k>!I3c`<{U^g$ao_9;wX$u>~Df%WCz285~dW#9p zO;-dd;@2KxDU;LTcg*RPJiIS*MOSm=<|rrquD{S2S_BO2PmoZsWyQy19}?%vH2llJDDtmmR-8qh*+4FIL(f8XD-ASme^_&CAoIEM0cE~^b8^}K?D4tEJ0I8!h z2u*cuFK7tNoX3XsB_yZ`?ktu_ziv2as}W<1kb>XBT$r%qfIOF;x9}n4q`M+C#h1bP z25tbVh>c76BM~FQ%}*U3?awX9VeWO81&aDMu-<3Z0ePYcGn9I)#i`1>T==+7p7}mI zl9x+y*AI0lMvma6w;tk?>yl;wTYfkv(RR5H#0u1yZ6;08tQwvIXXd8^>gSv|(h(h; z9lMN=eo1Wttl!a@u$x=#W#xEKH8+P%t|$ebo_^Usq75iIbw|^6K`8^ePfV*7(I1tF zX+3>HL-!6Y*j@R`E>S95aI?Qp^}}_RMtPn#UY)hs-J;HDrH!?a^(B023TaZ0Kiulc z%Yn5*P;J`Mfz>OZJTPj~=n+|Gmwp165_DQGQ&~qSC^5@3!+s*_?Ctl5##}gQTS>VM z*(8i#XhJC}xZx9#9El*{i?8PZ%CWXzbcynA8rf>rKzbjXQ)$u;xglR$du$6q*J&Bt z?Qz`0qm->R352eQw9K(u_9P$JstS#7a^v!b4dmNq9G)RQQX!h4biFnlYz;-QoF;WW zMg_(^bh(Nz$58KRQtwd5KKRrcQeAb8Atg%9$Kud z-4WMx)6Sor)bY6ls}z>%R#Ys3z!j^37Pt*LrN$_hEBOaNQlu13aHN!`{p4~6`BkyD z8^P@>r zUJ_&+G`&APC(w;x!VeVYq^lX?X$aV+*%p%OrLe2gqM5?44wCeNZPIlUic6TSP9Uh=rzFXHA zYk3Ata7lZ8(AS>30AJUB@O*q0Se{RiExD?85uUTZNnLjgw#8Gw)7Ok`ZxG=_8tkbU zqBeVIxp@e?fC!sDs-y@DwXF3=!d#Y-xlWyoz^$i^c0O-ytD=eC;wo+b!Yui&g#Jd@ z4aH@Bn6hio=~KcGwJV^iRk5Quvd)vRR+_qECILL(WeZ%(UxiIzrx{>cKk`wUtr#vI zJsO_6M2NqeYA+07(Y4LJmMI&T3)4s3>v2U|?Mn4yZVpaq8&^k1h=ps5-ygI{qcX19 z++OLNgRqzr5~(UO5;fPh63#$9pMxwx`PqH>t$dUfH5yA|-kl|$nL%E66=JfWV^Gh< zu#tZEhs&jlu=_emAhovu)FFFm1>yTNok$Q;l~0TICn9X5zeT9gG^|tA*hA@LE=>ER zES+*k%mg)^AvPOMt%6)|SLcq6^OxcgXC>D-MfIClS3x-J&;OLhASE#5*pRQQ|N$^6xL73Wzr=wGmhFQ=AHxUs=`?hRP+=LywoOsIV zl;!p@Ei7^|6^$L6xpd~lNyD?^Rp{NtTWq(T;>3IFo>g28CgFU2vgZ0>tn@zx`GM`q z%0=9oZZ64BJ8g2BIdl_5W=&{{WuK&8L<|)7F599nMe_(|FXoR_tqBz#@Dj(1U#Oy>+vaCFQsYVsc<|>{QXXF+GR8mBo53lu@h;DF0%m;L>J8UT{ntcR2J`q#h zl(ZWZj}Vp7N~MV>aeA>M(4z`kQL@;;G&>_`e=VcMm`N?O;d-1jHxo!N`qcJ9=TKXp zRaAxOh+xdZra1|o^EI}hPEEsE$KI_%Y4AIZRGpch@7}n`1`P)~X<IkZiZy22;y0Q8pz;(GK_4)KwHhy-dC)=vA3c_`vku3B$T5;D&3ztT*Vidz{jqWD2c`2#}gkM)TyB~9=W-Z38xdhy=z00bpLGog> zWTPyZH4j{z3J(NpLfEq;T=Qkr%l5AdGM_}@n)d#do!Ttci3>|91}>JbOsgEtF%|9{ z9U*7`mAI^#sfNe08(U#icIu{L=CfqE5)KdTI6NAbwD)USl!@+UY-hAi^qE?IGHS?c z%Kv)aWK!2Uu4GZpZ7%=3)3;MdNiU?Kf`D@1!GL+4sWUnIOp3ggroSYmu7*ZHe2r#!4EAio>^UM&;f+&_WKPShe-HV1=d$6C zFsuy-)t&Yq`p%|hCDWRvzMpJ4m9-yKW?2i1D1=mOvy-1-;^$d9cP7^+U9}|0CZ^Q= zUKX1wgCBr}lp^i5L2h9PW%^7dQkM#3!1`KYuutvU;USd*8P}sWIG4?e-N}MhHgiZ+ zLI(A5dtBVWzUG;zx(mDze%fxucnzT}l#&N%1P$d7E6>bj1BP_fl>F%S@C$VX#YO+- zYwq)%WD`afs6Fz2ULYlI+FjeGb-U)D7S@4%Q-u*&b&`7vr1*71-+uFQ~|1O_h@D^HxyWLO;jNLE$%A! zJ{u=R;=uXr<#R5ERVKRX6Ux2cA%1C6uBfZkNmdH!oGoHyI?N_fkAWR1BrO%0*9%7? z2rtONl4B-4#81Il5wRVL10#$$af8IbA6d}qZ})^wln=KK;Md!Euk}UW&>~ZkZ^^vh z+%B8LLMgb;fG<<7WlLU%dHX78LJ>0V^wQ4ZnyU^}Rub05YsF5S&F!qFK_wq7{K8K% zdr>tatY=}>+Z1cJ(CoI6a9JWI;gU{p@A-Ot!|7>S&1N2D)JQNS9ad%f^yX7=3kCMj zDnU=bb%GEdv7}HbXluW-aL2?`q^C>5rQ?Kw_$Dt{9)hG-bD|_MckMnE1<)^NKFG`? zwN4Yi@fGr?=@8i>=S;P>sZx9u8DORJZFUC;fws(eMjb+lpt+;YSvOz+e<9U@^NL+F zdFTC#MEY5BV&_0i#f%ROrrmesn3y&b%B;;D%aC<&sLgJwQ)%H-;Em~MZ-w6*NADqW z+_`8}&`69rOyw$6BfpX0KCN_?SPt3;cC1Dr3;wD22ytBH1D)v^W62`7k6+yN z%uOdyTcPrvAH-*#$r)`3gD*m|Xx^ab&cFdOxXyY{r@WA%v;B)CARCu6zT@RqsHZ5r z-qjx1^^3YcmJ$F*P|3!#d9=%7d=y_fpj zg$@(k>RYSc*c10kt34vT#VTm-TkEds2=_{}E<4EB2Uu3en}*TOhk{Yz@s6i)@pSsY zrWR~>HoDGL{9#*$J!r&J&7imdBZ?wAF)uxWIp8YklPwy;s49zcyunTP>>qCGlhRfH zR@A4MG_o7#>u+q~Efxy{O2ZubV}bX16KwBY|sQHN=V2RaBZ#_uf`k-)7hVE@f- zeaN6k1QXdz5iv2Oq0g5##Oz2nb8NMtj103Xxy3nH?$wd&rng>r{C3a?#$oj@=>oVu zB~Oqh97=r;{e4qwNUIBp9U^{@&kL+gb{;&Y-S|dw{9WfM6o=z?OtKyHc~7dw-de0L z^$^TjY+aICQeHDPO4S0BCIZ2dx}V-yhvjR$Q*d_KBeYyLyc)V~UEfHbzA9J);9!uIKkK|15KBsj z^>)7CCNJHZT`?A6I=1PU|JiXm1k*VlE?O1`mJMXLk+9G_JiT~9KfiyGd8cO3*$I54 zT?fvKPQz3y43N;6^^%Um-bA;J;w&Qg?51VOt){-ovuA;VNUs9y@N9-C(3=M z*NC%LeUT?mMZ^0ytGTBFTLIU%+_kVr#axrC`&n%Y-*RSi=eK<2z_D&Mzlw7kYei;Z zau56RA^YGf(ce&F6sxhTPz|9kFgfnM@B23qAzLzEFM2_kemayWa}c8eyX(!{4$SH0 z^VbVF;wmkJcXZesFKCB9;~DWZ3E6KR3yEN4v%^7Z($P%5so3$ZjvH?_O?ieLZTig> z{!GaYp%8W{1|r6%7z>Zz!ke20x(>t}-}Kq%X&}2lgbNPxEi|C^_N(-knvIelFAP06 zue9*^bpw688rQ7)3RJ?*2M3fG4CbOZl$3A2Ky4h?=p8lhfNwLUU*MN+cREixST+;F zA8il+07jlK?L8PSpez@f2wx{6_!sQeA)R5HBUMnzuRF?=J$nmD=|O*FaQZgje}gKZ zmgZ^uKuUbw;b+FVg}YNLt?Ye$N`?CC&uqdy0GbSb+_>*DvCVJLN+6lOTC>c}CBogD z{Jp7?czq(mvEAdIwT@T3IC8oEXEKYQW@i%gA1xC#X|&Es3Z!3=*G6@MtDATA5Y}%P zW;z`kSoB{mMeeWT29qBj)E1n#S$wPXM4^ocEhNYEM!~FwrlymE@12ouEddd7{I77j z9=xbxvO6TbCZQ;TfB515N(meCF3nZyEq*Kx@;KN;J9U$XNsy5Y$tBqN8pG2R_T zF+3LSF?et2OQ+v+_46GiMt4h6v+F|p-a8&2+>WptCMa0XOgX{@e~@TY_e@25*N7bX=0!(j_t+LD9nK`K zUZIZ^OuG8x3riVadnPX?DgZmkwxShENh`Ddxd2OleJ1X-0g_`An!E)Egkk8v{ysb3 zCw%=V*Lu!o`I00G_J|}nM!R~6!^;eS9HkEqBJ6$2eEDT%jn=-ZD((Kp%Jb4~aqs$I z*LnxG$GQWPDr+@QX{})iA!rL-aMC1mV@f5`_K|zLBOviSs~wNZ?rU$p3)7Cv&<596p9wF^%E)oyFd@Q7Op-iZ_0?7$l39s1k{Q0p2M;CkU zhyA=eyJIWx| zJi~Q(A5+G&a8Ihb;(0&5oK=}l{{YUEt*@Iu-@Uz(A9E>`T6_4xv)cT~#H4Ewvmmju zAj)vrM@oJ^vAZWZn9eIgYsM+A5)9wRBy5X9kqZ};t-^kNb!vUu6z6#x!wiKQ~ zmKssO7Q~z-Tl;wf9jo?b?x&gOTK ztTlt52)#dxAg}@XcFcO*w+1$?bzezg4!>IyWA%6HkfL;jo`E(N)zYeQqT1kW7{aCvbQ% z$~RZ*;xdf>=g|gpQVKXZS)qgf*OWoa`AnRF?Y&1G+fbvy&4<>jQ{ghtW56Br_tqCg z#0)waYY|8fsZ|gp24;6h&^9~e3&+1;=;wJrBk5$ZC6Jwfwla#Bf*zdvVP? zzD|$C8$77{1}(?ITg@au9DK#e&9D)1;d0*v%Xk1Gz&TLevgR9kdL&tP&g|t&2|Uo1 z=_wQ=>|Wzb516}l)GiX%Zn0262?IR91b1mO*$|pv8G))99yfw2FU~oEfGW>H6D;Oi z4YYYji!1Xy$(26J0Fh&yGdn!<_4<*_5R@%|m`u&9aiHNuWYn4$K}84q7oTW=lcQQ; zHSOWpq<{0xr6wbT4Y2Mb*4=#2#dJZb!?s=N%}z2S@N0(4F$&K^_YsGd*Fg+1>>Pc! z0n$p8Nk6Y2?CBeGyKeJGAD@Asv!SE;ldZ6U+94>m`rUp(xUl8nbX~ zCvJ225TpO6BiZU0?eGrlp=&|Q_xl{DU@X}$R1@{HEJ0@)J#Ux_xBY~9dFQrs|JD&< zVpe@QL6b%c!>g-CJ@3&aH-nM_OBz)r@Ce3(|LRLC*DHGInx`O72&O%sH-3lvPiVwF zbO{Z28<%O1=Oa%fy@4uX+KB2_8a$rZh?>36bQ-v%Bb8m~wr| zpiHrVSs&rvfYO(z=ydxJWchuj_1sey*jG|e>`>mWyDG}MEH-Q&*SGdAS3PGaaH2o0 zi~Ba(mZIIup+)*cY;?yRz0{a&205H)-(aF5yxy~(^dv1!8i?Iy^Qu?dL?-X6oj;U5 z?AwS;sAmMt>w3MnPXa=~k6%z)Nn1^O83XM~WST2WTG9*kMqfUMh04n-Q|+|X<4Qr~ zAIk`t4z7Px;Fx@Kqa5zNgJ3y6gu5F#LrP}|oGlOH(X{k!X~1XZbA>(g=0dGQK=_li z#j#O`$!Ia@=HFZRkq1I+Zh|TM`;W*EJw`CM`}D!z{&KCq!3QKDH5fe88@^*W zd|;oPTZ%GTlkMN%TNSWx;M<&=kBQKT%!ph zj~CVr5;^q3pDWdgnEr?kCsI+?+LJCgD?#-2(%>*{e7&iG&-VorG?d`8qCv=@wdhR{-Q<>EUUt+;CsOIV6bN#BUtlejN%W@ zoICYnNA}eSpR$+Z2_E#;{Y3!!qLPrXkKzX@*M!vHI-Tg%K(H9dU~aVjw#WBet)G7L zx1x{`c*B=C8}=MH8O(>CT}&9{#>DC7?-1U!*iyOEC(;7^Z(3?5%sU?OV~Ygdf316K zz-qiRqzh@RKvH_U&DrKeVa33;ya{m8yN2^1>Zi)mNlWz2EkS5$DD8U|35&6RCe@xS z!R_08e7HBedi!j@1VPRN}xYf?X*bcdu3ak6oy_I1DePxImTL15 zQnOo$0b<-1Us-eDm+RM{a9<_hwY9k5lE2iPpF<((&z_C zJxA3$m!hg;zoMc4?pi%Yt-RBIDS!e(m%nC4SL?bVYWF=@hI_wCwB8?DxZL!aFmCu2 z6Vlic@H8&4Nft67vAyUY0-6pcWf^WKS*pS@wC}tNksWVm{rOS zuqNhJqa-SLgAVM~y3LCQOwKx}2Tp~gJ?;>~pO3^xG^()M)jy!9!R|_DhF8h)MMQm< z>%WqV>hhP+&B~UkNQ#edXm9>1BGUJVvl3~ipx%PnX4-oKkdMx-RXBPEs6j&oxa&l| zp|!G{O7QS|eHcqhiwTFRvUwzJz1}5VXnTwXZp4(i*d1fxja9@vhObW~=DV0*i$9Q&y%V`}L6 zB!?f~kg3AP^j=a`7TVqUHM!hszg(bK*}Tht0985NP#uFa18(VFxJtd;nX3^^y7bTd z1||bgH6Z)QgWd6h=R27){G_&oZ(nV;jt6N<0c|)RvsX+WIV^v_h5=OpdHn0sbsjexQF( zVDfQjba>-Z$L*}7xMcG=PQAvM)z0o}0|@|5Qf3N?&MUhmLsP8qZ^qze`Bl2qh|2){ zm~)^Mp!f&8Y0nYwi00WY_2BO*`78Y!UQ2I3%}VEAcsA zZz|jpwensc5^}@L)&nwMw-*)C;+0P1_~t0xtx^0cUw!{M;Ex=k4vfnARo_xi?kfF0 zyJJop=#z9$wRQS8IVCWIqZgR9#WhK2?D zy7wpF!wPTR$}49;R7b3MY!I9Q8~R^38Kp8T=W?BKh>Ld1mNiGMk!Twz4|9I5=~8lt zVwp>suVaLo(p5X|Q|otSUP{#4;cKgt_B@3h0!61AM6g8@ojg8aZVOl_*VuFvJOniNPKo9ZgP52q>V5D4;p&Fr`SRM(rOSe$_>p57!`$ zY1IBI6|z^!t~D{EFGh+X77B9;DMsQc`bacBaaTH?NLnu1!Vkf^^AbQ1b@XYF+<^0% zr`W$2d%Rt;W+kk$-;;G|0|0*kA)r$+s@EXaWz_M&l*-YB;o1CLu1`zowZ-}-9Bf;o z&38<4`>>ek&@VxPkO5osRGw$6ZGWFjL}5Ok*ZtO%FQ>8+dBaAX*|>wnW^?_k!VFsa zK-IGS{vCAfjp=$hvC%qlOfc6@DFU$gXagpYbN0c!%x;JIpCx8)Bp-r(j@Dps8-_{S kNxnu5nOqQn-9A0Pf!+eQd`jjR-$DK)L}Z1_1%LYfFFCe+YybcN literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-report.png b/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-report.png new file mode 100644 index 0000000000000000000000000000000000000000..31350b563f8a99cf78173a5c97c9d8ee357253b7 GIT binary patch literal 116993 zcmYhi1yEaU*ENj0yL)lh;O-Pki+c!G+_hM6hf_;vwjDfwO!3aUB|^$7_7c8%<)pz8t!h0*)>13lb>{C^bVv3t!Lfe1sv9Y^RC23+f?s3;;z%E6uvst(U$7A6ddJwW?%*)19Lx`}9og#F4nl zw2>p4I{B^&>SU-ohW=LwCWm!mYyTTtvr3wO1JX%sQdyDhD8!sZ6mwX9#1->MU9gTdLWYN zL;eKbu3`-rCx}B@OQdax=90#fbHG7ufTOFZqgqV$G;>OB{yOW%D$$@^8wS(8X@To~AuheWH%E$}Ju7*=cfj23_w~2R8Hi$Ps(hceH zakW@4+`!&$#GjdbGjV$j)JPG`fj-jauO`f*!6%~lhpAk&eBZ2|WW*_X zAm+5&_>>!F^xY)uWxgs!Xpl_826@&&&!q4x>JktO4c>llS`U|?U)w_yErnY~E^sNP?L2g-TI zgtG7M1qHDscnm=j#9hQK`>3^&;fLNIaX|DqpqXSMvvD{A1rvT{--Co;P6elfPoa#@ zUk<)EX^bN{diTWCIB_g9WyvFmFc$KbQQ!JWKRF)*`4g#gk0dy;hFTr};me;c_*Eh9 z>H!@q-xX`LOrCEcJ?R0oUnMIe`;wW1ne5O`kC40xdgC)_CiQv_65yR8WX4kkBWycH zzaj%jkq16-GM-o}kj2DL+R$`!OTbiUDCNb-%uRwZr5}j&3ZIE+)OkVCz;HOoP;ys1 zb*LZ+ZjCNPYB?Rdh#mulcnQJFK;*~xJrB_Zc` zdBVHMbDZrz`sY6-OqF|xhow}32VmXY-ErA{PTNaAerF?cDFBM;aIL~UozFtM@0Makum|O&-C2Yy$7_=2cXX1iO^@-&d~pjx!Z|jn;Cjg zZ(Yid!(!G#M3+16wfR$o+DYP$Mk5S=7;bj}C3~YjmZjvplstI+bUY%{gfkV_ElM8g?HK4YB4u5O)vHRkLyFYO$?~!rK!X<>5)Z)IWrf2ZX>F<1oyIk<;*4^2*Ym21sN~P_ePS?G@VX)C)qxPCj0-bH)c6vdnVBs>$tCfI**$F81fc&or5UNAJO^g#R;w?=#2x!zxI6O zM#&$BIy|AXuq4D%HoMw4h?7~2TF+8#f|+U?U6T&Ia`Cn$<8k3;B;3oLOm{g;8+#v> zQC^iCAt@pRSFMuh(G1?TMMz^sUVVCb>~Ti9x)&UpMF0xmyGro#2FS*s1ocXD3blhD zy}yI)U0rW`$fI`+`Q=1@_0QfBMQeGihy1s>LH(LA>_ivcdyZQ=+3@}zJs}fWPFp*J zYo2#ta^H_E({w5XNvOr8%#yN-@IO>F@=I$8f0maQi^$ujjHs*YMJ2abXNq``>}vkx z%y5y@Uidd*{ssA(wbcBz$o<| zhrgDO)OG7m2W*qh98BvROzj$afh*ZueLbhpmwO)PCilb2nE0RH6GjXmT7IP{447?E zsMn(44IK3_gf_y-ubcc^hz z<1{K&`z+{N9a{~ov~Gkb{1|^612QFoz5HM}+8W52eZ~ol!P8l6aRXHis#*imVyp`L zn~wXo6XraMN{=$@h=x()ttUQ7(Oy>OyY$K zlQ?$Nq2TT$rb0fM0#&06mr3xl#iMF|$lcK(FS?;N$vh6mk@bwOG)P;zNb?EAej1F+ zscXYfQra)61`f^1FR_uRS9Tx@;rbjHXhY4K(MWHaS)! z89syJC*GTySixOd5rOEE_mbp1S%oyTzvVO(;Oe!=%{BjKEVT>u213{35J#%E#e`8j z5U6H~L^Whl2XE^Z?-z3Niba_v_suzzh#Hc|6Q3Y8vs&c?hzRD2D=Q@3G~vgyTA@Ow zVs(aMk{_5eh1`)UJ0F;j9tyW^m!>|b2amMyr@q%CTe@fMxV(tt1eAc)OQj6mh<_aE z0c!=hM5p7XznVs?u$g#8U8|>sr<0x!jxQMX9Xp&2WG)AnX$SQp-sY7Skw0Qm_AIs# zNX%?!#@{eto-=ee;>x8^>fN)BC@D{_^9ATKZ-_oiD}3kq#%}8B?go_MMab`mjgkwk zWr)kk1wo1VLw${)HehA$*<9q!BhqXhSEJx%>|x+VgcvL480%tlaZr&G-XKJZ%i?zmZ`Dunk- zi8UFVJ*jAluc{)}k?^^CT8}jpZpd%p2&e60$Am#4q5{q%>Q9Pc6!s-@=%~kyu`?`YX6o+tJ>Tw6F_wFs z6-mB&?|sw%xvkcPK~LC6-OmEk{Y*5Z@P`ZF%M&Y%5d%BfT43ln7od)tZ0Qlh?{e`| zlg50w1&-0KCSNhLP*i%Tm}`A9@NwLOlUw0Z&>M|5kk^s|8l$=_rnnx7)wugM1r3$^2dmh zDZCydo9&qa^+caYlj9Q=2DwWi6?%-#K&cJp=Mo43)>K0jd2`&RCKNnjaKVeGB&UT4QaoLZ-dmaYI zjwT$G80h?Vw#8~+M2r(J#7eu3h{);Ro_lGQP8~nsJ0|zmYEE)vWN0+TMgDx@e27=w zFtDLTe8XTEVwu<*ACh-+;$q!f{ZN?EtqBvG@ZPLSNHm^w4Q!=f*ObedV1+wS!?kCb zjsu%Zr75K@qrir6D3H9Z zhwIY&{>aefFnE-R2)RHG@ev!y^-f-~~6q?BtBzT9hA z>&d&bxMwu-I(v7rB!8<2#!{xv6mB34n@Gy3u8xqgC0$!_|2D@5tg0r`ET=h8Kp2?XcI9SjX>E-##7fZlbLaAYeEA-^?cvD< z;2k;bb&G+M#BlJWm?`Q82U#m$^tphN`_1O4Scy?7@|$drm0E@@%JcJ}aB)%Hm!sP^q-^w*mBo*g#!X+hKmd;$I-|8} za+lv9HH-m)L1A&5L%GriM5*A3!tRQcY#Qp>puih?k;l>^E=$**&-0tJfe_EjdI7G= zYUImsPc*5~<*7tjKwF&5!W8NUg?_2yh3Zd5)u0uYVmqtBX4=-vo3m%Y#SMF=pl0Ml zI*EqXLT*D7lHFP&=Z`+Rt}MBQR5GI|5)P3Y+Dujl`4&!32RCFxKEmoCxVjU;(D_YfS!LkJHJz2a#-%+Gd(vD^=3Zo#_Z)PnUh+Vrr++ zfyv<_go~haUrM&T&%vicN{u@Q2gGtbySw_r8*=-bM8Cc=kuA5PI&`+`AJjCYqgmM$ z_x)BAk2$(Ycn?qZH#Hz4J~}q8oc4U+u{i9qZ=@!}*p0J~MTcMYUe{^zz4PLMu@{5{ zyQ`zu_R^lLj3KZdsr1kVRxO~n_M*p)BA5PT8f$XZd5;9QLl^m+nwB15CW!&*W<>MG z^dcvs<>F;YqD|B7Uj9g80YPAQ2!BG%ow7<8VedWW1UZ|Mc_$|Iv`t&@G!S#X%aYT) zR6h~)R5_3rIMztbOpqv_qQZ*oGUowWc#~My6JUg)+BcG_rjXi)ksBGO!l|NMHS4BA z{NTo%Pgbj8^QZft@SPRpU{mqcBxwu-rffsBL_)QVmqIHf2|S2#mhh*&n2OC^us(g^ z)f4>^h-Ki8x@Td@#i89p8cmfLDNUc$WqV6Sf?*1@NBGT+pI1%v#~QxS(qiiZp{iw= zsHuLA^~8eqWW47)>O*?9E|8nZq*||gY%TStMKCDh$qA_!u8@I&8j>QJFR(kkzCTds z3FE9pn7mTriHDMg*5UZ|3IH7y5t1M!axyr(i1Zx=efnFreJl2-#2ro@vTy`nSO1yR zM5bW}=TR=l|Bj^p4^W`Kd3V@%WLV|u1WhLgxFZFGE&WwU(W&?uc z6}tL$!%lppXYFLCE~ObujwM*z@1Ha15|apI1cyfIidU^avq zA_eac5E!@R`M#sB!^&^wl|ub5js^|8&7m2P_;5@}iqJK!nb;XEriwLl)^g-RyeUNM z+`L4=O|`n^Rf1&Tc+?On@DLD}P=_c)5kut(Zs_!C1g*~8x2@Ym;tt}1inJY5zE@=g zSYv53{=YaK3?n^;%ftj4LzzZF3-1p&>Ieqy{Lm%)r~-I??j)I zl_$mdk(-C#v1WBnnT2D1HR$@s1K*fn)Eg6gqTAFtUangTm>JRic8Cw4%IMSoimgGa zdBDlub9UR6qb@BX$i&LVJGm0`kj(FT?VgwKj}-*LFRoyg)ddNwCK*T>d*D7G$R1do zc3li14Ge@%POe6$H`xDitkHcY4hrbr&!T7MQf!IgggvbL;Cw| zC)RvQ`5gZrieD4J68}@goJSRvM?FZaQvyi9j7-u116#{6K+jR7h+?~CeyN&|Za;E*FEk8AxKm@J3AtJJLgFi=P)9o~j z07y-0f8y6|1=SnnCQw77IoGOg`BF}0(0jy881XMLkx^K84pK@0HU}i+X-QgT4v0_W-3+-x3F~hXWe6e z(7vJ8rjnfxF4n<)N=!^mP0iV%S&mIm_|~&`F=hHi6qJ-W&t z-e!{Vd#Z6fEm;grqUydrh3}9BPk8VXlI*qugXyFd-v{e!@Z{+C9Zp8xDpH6-(bw>S z?ICs!TH?GfIlrZCNn@!fVyM$ps7Yd|(iMzc?Ed9Nj95%kcGRZT#YU_;e!-T#Nb2Nh zX>Ojd!^6*k)=4DTIFzCN@CG72aD%GGGN0e0|2P`q%$t-hh|e!5BhuVWalBjnd?IQT zJ+Nni=GK_k&`e>+X8x-azPA^)$@K*dgIqZBMe@DhG~t-Y zdn7##t|rsbW4#qEPNB&tL7cuQC1kpf#BxQ2R2if}D!F~Df5^VkU0C$jTG`slPh6x@ z%|?^3$>}|CaRH*Mmp-FK(dW!3bY&!%*nfhMCIC08{{x3L7RE!4I){m)ClW1fzSZH0)W!#KGX&Bx z1lR{XlBxCi=$c6D+1qfcPb|4PjtB^0RB7b0+LcIoKx{q5$+`IjXad>(w*Wy%k-iT6Ny}RibYrJ0HUZO+to-RNH;E+{GSy^4} zMMiWDYl1Ohyy92o=s#7n`x4kUmq@e-;E#hP2&3R{eNR+5U{$ZT<=VV?-2@*>gDn%z z?hFF0E;ieeWy~Dn4D?jvlco~=zWZ{~#AI;Q+k(2r&cI4w{NLS?N=jlIXiTWC}g?(H^%}pJsUgjhtt8`%&9e5Y#bahEx3u97>?0> z>PFjI1Cu?9Qm+DCI!qTWStktX(UDA93&~l)Y*$4s?T3L60o4dH+VWra1s0h9U&;|1 zYf|dss#(g*m4NFuu_rErSsGIZA}}MTua-@(mVJ_I_y{W;_ukRu(N?#7v{nPwPblT5 z>d&75{Mg+Ikg^m0cqc!_EsTR5+A7IY1intMa+Pc{)~K!6aF_HJd*ww0(tk&otTFZ& z&LFm#IFHh8J@WrvH=9lRO@RSBW^KgKgDt9p|HC<)L-5@ zmfd;1B7#S{K5~<}#WZc&um7Q~T!juN<$AE*H1@fJb#rmkvmp=Mb0U{A9rPkgDWk^` zS||3WSX76z8TkW@)PW-JFI;TDL-0V2_|@HRcv0xc?T z`pMjgTzx{qu`tIDe|PI`sg{~Q<|f7ztdzD|rB#1O_D^#SIq}W#wJvlvcqje_xl<(& zU2c~(mSQ#R$DTc1idLmv;O{(}?uh(PK;FYzMqP#NqB-iPIckn|TU!4>tY{&4i$0$C z@$tO8Z5nn62MyOkY-|O)D<(#6MGcX!?{g{{g}n6pch;moJ}k|KY()s>;-48AHu=%o z({CngFHANN^|Gu{WM&|5iCnI#=xpAnA+e9iSt&ox{PIh)72h9-g)oSxOr)9b@A_5V zzP;hh_VN92IUcc}2*>p&q=;^X76$n|vMu|l+m?4^GlbYv^?-6&nGODC%Rn6bu1=lJtgwHs@bp&P4zxf{?>%srp;OxB20{DB;!mf$KN zzTuG9xB5S=K2b+MzlHN4XxJ?H=a!VkXG20}8)DS>rmtxtR^PlQD=u=a=cB@+Aa}hU zWS)iV$ZDK0EXYlT%hs;$uKD%VB#*bJ($Y4B>FF7he7wO8EjYXav$?IcxcjPP{Y%OP zZxRdx^}>6YNj31n3o&J5T7a^JwmLm}zK&E9(EFM>^wTI3c5g}2sQnb09r02}l_7R) z*zdt5zwUGIy{BJs_~Wf@o$gB;Njt8p>zJsI>w6E6Ej8wB4h7RlN_#X4=GvRTo3@-< ze=~Jb*npqg=dPnV*K^(-wl{EA{}!9I`{e4c($#NT-S)2v7;F#i(P@HtE6ud2aGfNx z5vv0bwZcddA0cyK0Cg^EU3Dw>Chlmm$xP;i?-^=sISXO`S>AHjofKvZ5g?=Y(0Z;! zk)p*$ry+=$v?s7{$EHt0cA7WE`_r4Ffy!d=Jzt%bquRVlD91Z2=vv*PNhng4(>>SDRR*;w=aOyK~3`{V0h!O{AQdlu<6_Js4~BU&F#l1eTz68bRo-Eyn4_0y5tssC}U1AS>C{B14B?jC94>JyKqw}}ei%$?5F=7m~XeRG7%V%#D) z`FP>4w_y+vWs6G>`@Wfx>`2obT)X$tN){L3pkdwszt|E*%F+%zhD|QbML1m&jj5t) zEDMe)T2gD5aB^|O9R5Kg&j^~|?i+c~D)GTPL6wrGgo?7Rk6-^-f=AJ)jMa)B83Vt% ze1t+^Q8cxzgBoNMar6QV$I~nOdNET{Ky*Y1tn$U00p-W5Oi1wxg-vy1sHkF^s)$5+ zT>|!YxvdWKO`~PpHzY705D+=}`7lb%VDg5U!Y$~Ch_Qj+uJVd1Nh!44A?zbX$YVdz zOuw{Y27z$KR5>KL1VTO^iqH=*Y+k|#1J41$@0fB*%IMyyi zSy=-^C#-VxVN(W%!Kk}QR>Wy^PV^zpAHh>;$icK?O{eTQ`yW-%1%R2;{?>Xy>xF(Q zajuD2c=`3^*w*>Px7I%@zv@^R+xfP)>*PGD6;;*|{O74Uod=aibhzxR&d$x*y%ivh z1db{uv%@Yh?D&|p*l{$(SG~J+J$u*GNyDamxItd(5oz%72r{sf$7tc9?VLY$9n;Y{ zN#{6Iqc3XUU&-lHT}gsLie>EPn+3ipy)fA;7^3ExlBGp=o(hwIoCRwW?xU^mI}}%z z^K3o)ZoPK3@rxG*3&wsNppY}Z#Bf6bhqBZ7`mUs1_{{99?)^)Y!Ra*KCrR3YY##y{Ixlw6&NF%#F4^QB0RYRZG})fQ=YuaE@Z*sGSiM$e~1pOLp+T_Wk&>z z8J*SQQb6WlzHZCfr8Z@Z|0RG&6X|*P)8&xR&`?s;rudC0g~=#R{RC>Yd6+?M(=W`E;Cj+P8v|;ZB{Hf^ng=mT-fU8LCJSn_KeDMZoUb(|-8k>B4)g99JA9b} ze_eq5z|G+;SU5`XYVanFGR;HL(ej&@v&Q88iGd(wa42?o*tlC<*m%219H4gCH*Ghr zcqn_BMcoKX3;j*0cZju?01(I75s!>1mrOa2nkYct}Q88Q+b{sw2GFPtdObgwju@Xda%Kan6 zJL~<0FtKhfHBR<=rI^gMnAWHX4JVEL3Hl|}`{zo8M`39h$N&VUh#22qzZ1&KoeNK> zut5~GZKUcde>0Krd|YZ%ojW!%OMRLZf>o5qlwM%x@4&?CT6E&z?uh;m9(EQ->;O zhE#lQWxLG=5Y93ec-kZTrsp6DW#+62*^2jmX=5(=pvE3Lg4Vdkn|I%h+skqK)ekYLzZmXAi&^;Qt3`tT51NV#}tqizcA zUF)w+T+N`!VWl}&PQbbe*Wd%c9W9tx;!OONk3{?oTozkxnz1N{$zXx;lXYx`gFaJr zB^OE{MW$~koxVhD%_!g9CZc9k^{Q&tj>U1bIrfflglT*aY%`zuQ_dtP`YDoA#oJK zsPE@TJJC1qdMtQ|@_c3sbA4)4{A_BS_-t-lysfmm(_cBpztIKzmHNCPcf;lmv6bL5 ztW`j)0sqx8Wp8|)Fky{wr(~EaSu0RQ2s&eqhKSi+ki0R*J_T2dBV+hz`QpyI#So*L zU`=jtorT<;Uu+z#LhsN5vctc$LSj!LEt#F;kviwEIaFD9{1ek1%)nzy7E2%UY|9*> zz#HmG6JblQcz7hqnxG%af*m#K+l-}V9#8FWd(Y#(Ay!ElVTMwzfb}8~ZX_ni)!I_S znn@YE7mdcl%3%)2!*J<{H05dU+&}VBt7-4*>TA6FmJUpa*F0B?g-|P<>u32Lyzymj znk}T7(KegZHzT+==>41i&_~bWd6BQgBjzp>rv~BMu2dtrNEt*22>t3(T19NvLLL^; zkC2S0Y4O&Wn+G~O4Gjeg3V6G2)Abc{XgDfrI;(T^yeum6yea8~PZoR*HtiSH3=qd&m0myv8MT z7Fmt<;EdCXN!o|FT)l9-T71!pHTKDRTXnw67Q-*;J%x8Q*JhtaZKV3g`t-T6<@s*+k1G5~9u z;ih_`MT8;tD8fPU8}i!>ksrDk$}}_IUGCi8W528J70VH^=g$y{*vgeF?DK+ zPlD1lk&&G}XkO|CmOXq>esWqT?&i!W{GsK8x_U&j7ja9*@sub4+?=NPEh)L{WSm&k zNL7w=b_#qHs?`Kz3(*p%ON1rDL(eJbfSG%L>e%wk`I%sHekvku$;)*%DZi$IJP;{j zV3%<@eT0iux9`^n0c+Cb91vyNyIsx})Y9+&dX-)mUC|5zm@x_4FT(KH>&65p1bu;k7X|U7}96h|n5j5Zr&nHT-?vJ;&q=thBalf~& zzbLwGBh7Wcj=ZkQ_PjoSar2&9I_C~e>+aXZ%0c7AoR^t=gs1DzxG%@lp(22VYGd!>;edi=sXArXo191h#knJjS`(T&Nj++UX?c+Vr1k_IK(Detp07B#8V+ zT=>TzCHdqIsBWU?u@Y~+F~i_awVwF(2t9I8d7yo(!bB!`iV zq9Rke-th+`&FGY@XTcxB@>pszlgkIRZWkMo}D--PO44#~!i%VgZV@NYV< z=_8e+J}j+9w?v|3ihV)z*;tQi^k@%CEQ;N}%WY>Yt?bT%IP9zms7?JQ4K`ry+3Fpf zTGR>qG4dPWy~p~1$gp|wAbRHp_UXNOWG*;N{tiZ?VIfjPE`CY=b+yLh&yfij=0}MpIkMw zH8`Rf-nDN2%@dv2>Z*RT+<$6c98?;~fo|bkow<&V4qkp_R6oA;HuQ012aW%dm;{7r zXT31FleLAXqlQ&Kmp2}CxNpxbGy>Oga4P;P5SPHNLKsyY=BS3HaLiICN-fi7Hd-49 zX!LWr0A)`fI;{(?UoEJk^m%pS>8&^QxARjXx%E@=T97CWCB?DpP91Nsg)R}pKo3BS zxc~kV%i2u+8%OX5{=LD{pBQcYI1;0#NaR;Y%$7Y?+JhGw1?aCYY@+MLD4UyRP<)Yq zn14d^CsZ>lZN=PtSWT9JG{3p z1%PSgF}I!$YdvoWT$93P~yFkLsV35~iM$bFnHdp>6ZeDEg3 zZ*j)eTdWPLeU_`Z-+YU~a+6Qc9{rg zqC{?>1wlXc64UzKz8Cdd|J4(xm+6`EB(iZX%@yMDg*QNS&97~KtJ@wYvXilPGYa2b z!~oRaxsnhy7<%c`+13lA$|)=bJmf0jWg{f$csQbhQMP{RLI3I1hbom!`_G+Dk~@x zB<-q3GNkFO5|5Pr*03+x8HVu4#n&95Vu7q$ivauV`%4WvYEEKd+SJb|Py!HP%MX9} zhjCz#fr|wqPgfhMKnDYvhYDMQy96MYZebrpYu#mP)$z}QoK<6G`(fnd8LFtT^Yh!$ zO@~DgyqAOPEeDG%fORd{zn3Sc4B`@)kX6RSAT!A2a*CIqOk?}%&5RH#2RX_{Sr=Dm zm5K&Ai*)*?k5JG^_y~qD^Em3*i;_b!~;@ z3F8ve{qtq^?cv3v58vHdBjIJMFyEcAJo;T?ke>6*b{yu>#VeM-OBhP$%MX;!$8j3J zyQe82 zEm&*l$P8eK4g~dt)n{>C{(d1Ml))v{-y0%bGfzZWq=V-lFPFeXCb#HY9vpzc!}NFx z&OfKOvA5|nw8nX|Iwu9JARWpe(bp0{H?XD#92dyj6CC5vfus*8DdfH1?OU4f9+}T* zEodEXbyT}HUsji{Elpdn+PWLw)R>qgV$27XSL>x3>Q^x|D)m_3ldL$~{A#FcW4$xf z9iFb;rFTkopw7Rmv9!HUS412Oj)oHI_}clhta;lo08jFEs^k$eJaTb@G!m-MK9-I$ zlnr$yPof}H5b#st+rQgXRjE-#qmx>Mg9cW;l5g|K@DJxm@ZY_DUamn#Ia#*d25-ul z;WDGV1cPMuZdfw_U9mGAoL&J994wclDmh#N-Tvzk!?mKXBYW++@(f(#_Inud%wODb*$C!#wX@+7u462-2aF;cXK?>LdMaw z!6f!kexcYUPb~$?Mnl(Vyyw&zxm;6KSpV!uT4MgnvL40!^KSY)%YQ8t8U5(+WXJq5 zVZKD_K9|NfR+lytj2A^=t9RO;}Us?8wg&NX*u7C-z@M zhEIPXo1<+BYr=Gp__|G(xX=5b*SdwsPJn4|0XCv3bv7rvLMx;EC&L&{1WPlO;LBk} z;OFv|WYs#?MoHc=i@R#czTZS7IFcex>WTApkOoUiAfYfvQctiNuv!p;EHYMg`D#Li`BK6)gGf?u`7vU!iQMWIl9*FSv5mEyr5pOP zxA%wX*@&xYmty;KDQQDdJ?7FWasJTAJm&P zPG`T6H8eEy<#`qI9MNd$9@0mwr!)*gDR7+3`F4woOQb#27?vNyfNo8}^Uc>zow%!d zU51@|?->4J|5-LyImQj4dV>-!EzKS11A3#kIs(>o2hx>eQE}w8I~xuun_c}RuDlwi zU%rq{>7XG%a8Bvkj`Ui&c)3GD5}f|r-sF8RB)--pbSkXFiD6rN)0*U!wF&h|m$_zV z!nUZ93;RI_$LD>sU<8ar4D$Ea#jK?gPKsRV!a`FU8_Hxd`ud1U6G^}(8>p}F$Sq+H zTnY;g4tCvL;Y9Wvq@=gqja_bP7+a+rFGSh?dp>tpQE`sW|FF*Rw5lAp**YN(o;rVp zE2(_OQ~WWiUD^r7>rY|THd^)sH~A`pRr?En;CfM`iwmVzHR9Qsl9}NYtM*K7ii)6K z4@d)@@#4^^XHviX*F|;m*{oXu)-UF$kL5U+A|NP_YXmKsfqRGNlU%z`ue#pbk5$eb z;`L#Zmf6?tvTh3x#h~9baO<&h;)eWQwQmwJN{!Zw4wsocROz{Evf1%vXi5qYUiuJ? zD0bt&75I8HanY4MeWT`|k@ye4{Wi0o`Cpb^@9Z?5qc$W@0{w$H=XOhlDWGm}JvL;| zs5>NCA2tGvleLK!K+4dALweh$l9Z;@4J}|ob{zE(E=$`{dPcYxy_Etp7{v-RsLwN}Sh#{|%O6Uz|ql;!?cp{AHIi=WOFezRz#x zRqoe>A7N>$A38wF^r*}5m*lp7-}Wmk+&8ZfC(*y}OCLv-rt0J-@Igz7A}p9VUie+b zm4)KjS5MH}p@-P9=YuaEJvTwGB(K?>FTUI7PR{mYoy%P@f1mmrcB>Mb@@{3L_x!2< zJon7w6|36+i4yC6#y@7xLqUO@zDBF5RhE8xozCb16~{5Mt*41X9|d4B5)>iOjiDcS z|7`Q@x7h4PXpQW*GvQCz`6BLz+NnD7yzqMB0r<}VK8JnT>AWLVoie^tc{1gMfsdK5PbG&1YEgj(kZD}X5cAd8Q0@5AxTen@% zv(vUAlQ`cu_n0JrlvifdOpB+{`b5F!ty^>P=;Pi8D6hIb5!H_^*~OzNQ(u-1I|v7) z+7=*#!^8JeTaw-{6B=1zdt+W^aro5weh4<(y~U(B?JQ=G&bsH;93Gf3G>!pEs-!f!ENcx*MITN{1b z(*o|#ceK>sYlwksa&kbSEA*fJ^-H!0f5pEEia(YvmWTO92Lcy!C|n2bv5s};^OSQUW<2hQaUu|^+lrX4Bd^-o^dl+_PCt_Z3t4VC99sR zoTo+H|D7R72!zv*LrL(5y$?*G!)md3GQMgCFZq2+D>b}}USP6glYs8BSLUs;Vu`3l z*rD;%-Gv2OdwnfHP2?V{rJn{UPN7JJgF%}V{n02sz$6JFLbyTUc6pkcwMCXlMT>4m z*R0rCvFMPfdBa$z_xlq$FUFTNW(CaoT48GK=?AlYaYo8(oE9^@Ky^m+?)9AOVnc=t-YqftMY?p>TPN616-?tKP&| zxpQLl5t**$R#jJ(?h{r_G{~s1kHlAFu}(-~Uo-rjuJ@-0^_FUU?$pn8e_J;np)*hb z^g0i_?0@2|j>FmWH7I1R^Dxa(Fw@P&7|SH@Y=z!@>%3ZHIEW->`xI2ZI%a_Z0&WCu zyIzEBOtMTC^312igQK%hy^>I^{IIb4zH(fJTcJ0J^*otuQ2gO|Lt0T=biVkb<`^?I z37L$sC0m^}?A|`z!Lfb!WFK#x68WACDD_>n0H;`BWDCOVtOm%_M1nKPxzohX4&E+* zqj&0ue~9Nuu*_sw;k0VFENzu=OmRhtw4E-koIE|37=NT9Gi=_OWb~gHlblY+o&p!tmScUY6q{;J@xX{FAey_oX_Y@z zJw!D1D^qY~m2iZsGNH)p_HDeVFESU7Xi!Yd!NIYN{wqM{x&7df80@J7-EKyJS_=za z>(z}+QKFXApMVMtr8lYf;^Yy9Q8%W1Xno^8dO;)Oet&M=0@ye_RyNb1V_z^P?|pOe z?d8~IeaQ=EsQPO=G3)ut4}RG7i6re{Bp_)PupKy*No)F`{tyb=blqsWf3>HCgw-LNeq%Y)DTrb2}Tc%iHm8N4!VjuguAE+plbwqw6P6}8G&YN@To zHoq=!()dDPSRO-^m(srCkyxvHj{R2oV`yY`i@(lN=C&0f4_Qz{Qe{4YaDR+U08LFX zm}eOt5j*N`VuzK^Fwe}p>rK?(zdCxKvE-jFifL5uh)LSr&of5dt|MY?Nn`+NsSo{ zbr*OgMI-_KhTMh&k%FzycnK2BYz~rYc7o&DNjnCH!mO&sVmX)uK%5cupLSR=?@ipi zh_R#aw{yiFa!&d#unL@{g;goq!%IR)C+@cYx=bmKJ6w((t3-g3?ike&OgT)#)JYIa^LJ(itrAIrdYeBGY$kFKde0E!dGb)Py*RO-tx;&qd}a}*(v zx%-T%kbSw_VbEm1nSTjTET?ykWtxO;Gi;O-XO0yG47cemgc+#y)d z#+~WB_h#1g|6aG{-gD~I-uo+niaWykhF zwZ%L=6{cEdyj~oN%D`u{`1o!4(giu1{U}wKobD+@M}CNh56JRw3>%Y{C<-UY0QYJe zrUbkL6$7~kzWMUhB-V08Exre333TU==for-x6doqhQG2D5$9~e@Gv`G($nekqNzfR zXm71J4TAB~^09{s)fhNUnX0SEl-~z6Bh2RNR3j+dRiZ5<@Gd>p$>7@p;oLS)-04T>eqVRgMDbVyVOQSyJkB6Av<`U^|)2XubT`)|M`by{zJI zapNZPb^7>-(&3Ia|6L^i?aK}6ZBl$e0ns=gFN;>Me^TLDT4i<27}2l#cb)sp8u|(r z#Ds)l$`yn2F09;}TP2E@OpG|<+xZdPVTr#;@swd9CCO7|rcL*swD;0*Zd3&^o>$Fu z`aRYg^@W?4be(nwPe8KJPj&t$C9He|y&)W532ne|>HV=A6GVt<|D`y&{U?U%shG_$&fB(p_9S=$DpanGtu`Ewz>Si zBv3`1a+a5URN>5Z--8rJCD8Ah)O~(PC_Ipb)W_fKE1Q`^v?BjdPpJP+4_(L)Y|2$K z^>P1nMCW9ey|#NL3-iz!15S$&5a9^R$ja^_)6fC6O@7m<8XCnlT2B`iIpOu&a9rZ* z$d9tq{~cb{pjF#mgHoZ(6Lo#4GwM6ggIV5j)0vQCk&_PoY&VDCt4z=W|*Gd*$1@SJeBk ze?jXr0HlPlR@A*WYa10?_o@;3VtpW-gg>x)ZmOMj*UiNm_T2gN>~uk@bd`=wp%cW(Qj8$XXPy8ugKsm3>l zn;}_p;&%3STR}?lqnB?xFOLJFeyE+wspLLN#eStO#YoLMD-V2%bgTj~P64~5SF^48 zVO#i=izyPacl<)PN-?KsfkCXZ^+#SrLCnq>!!te*t;rINuIVOAAgsMhPI;NlBXI_1gA)ugV=>`;|;O{K{xrMr`NiNueBct#%~w3=*q0-4%DFwP9mYAFP9(0+wWUmpz27H0fpMji1X~5e~$Vs zR!6-)mmWBX(#3+-ZaAM5V$=K-sWsLs-uzcstJL;-Gf25l+_~G4y)Q#Yvz+9VE@yp& zD(|0+pQdL_(ZW<+Zc+T6W6{jiEkg$BMlrWv7<%p+Gcaaq%zl;vwx2*n$3K$I`Ezha zB=bX6CIg`os4q(D%&t!$;ZROD|-DsZ}o!NW~8u6Y04NsS-2P`y6z+ z8`--Se5-yzE&AIX!}#g%GWeE>%?P+A%L_bB+L_jaCYZkHw|?Ihr#lmm(qrA}ck+k3 z+uVnjz6@x^8uWq4_|;aIJZ-X!Bsv_L*b^l|7~9qfoBuIst-31w!>e5o9Ke~s83>pQ z#swWjk_NAxVc$DcAo#s;2F4E-6Sw6EcV)nAWC7Onspl?&hbu;hB?Vz1aOJ8CdO?sP zcdNApz7j0CDeiPvzXpv*kS=q@sQhs$JC*zDmzq>(Ra}}28V{j+o~BqOf4UzCAJ)kS z#Gv*@JH727tc1ASYUU4E_da?cE8v9hLktS_sO&kd_s2$AUu^jsa7UYlvO8N1gY%y! zDkcwE8_-k{&5M?N=UP7Z4l8%Ri@aa8YX>o=z1nMks=D41cRju~N}N7WCU!?SGsG$i zMBoNKalY=96W6T}Jvn~)w}GuEf~{<)EGPhGBT-lb@~F-JjW#}4a|&ghFTpKFYev2o zk@1(ZeOYOkj~Ch^v7^SDC@Os4y(ux0f!2B$vJGRM$xQ(e=k9^UI9V0`96r!X;a$q!g@yI@SMy}abNm_ zPF}#}Lx!F!B{ssoF5riXgJ?__Nw{qjlJWB%uFKB~{S{+fT?rjeyWJP?4rlD<=!yUV%e1kLGCu^zhnVVH>CT!P9NyZp@9CkfnaS={N+2Ay5V$- z=}7tLOz#7F-iizSyEn^4`%9Y(Z;Q#}lRtsamOVg{;jI4xH!yf6@NPX*bM?CB^!xDi zXkb*n=p6&m6HZ%njqU57BNa1y9|+%8;mAwTXMovP`Ad8FT9FsJ_rrycAmi6FwXUmi z�EZ9VUDWa<=q*vt4!UhR>#EAS4rLZpw_hR#X52inV}4-(B72Gucyxa6QAxLS{9 z6_}QY`AG%#sTd!Vn^H$4)d3{MGI#n)jvGHCFGu+Ig1Qmgo0JVemjztxsv zFLc^QB4R!(Yo!gRN@9jtq?x}4+gUL1$=~k-gllqrq{rB81rzXkbyUAE#-E(^<&jw+ zHD54tK8Aq~8MS}L$0At`kDEYB&ZK@R%MRteM%BmRcZVA@50*0{d+z3qK+k=3=`L;X zwzCg!&nuYe(43i{n#^_py}{YJlW2)Svumtv7+e^eLH6auHDJj!O)6-yAd)u|eKOI2 z5q@PHftMP<18}ZX0PhXCn9dcsK{tBXd`-TDBu{e>pq)^(eRmfq2@u!xg)aH4 ziCcA^F2Fg_|HD*B8IlEkhGMUI)<1P;ub4wF4Ho=?tEw$bdGU8Z(l*w20^&Z64=$7t zN6ogNd$6j@`Eg~b*_=2_I|Zxrd1uP_^;6>8Uli|@N;W#0s}+^NsO0pG7{<%4SE`f!c%IM7vwNGz-9BmB?j+#r-T`fUaU=aMokz|-B6j0%N2EHh-i z_xn~2i+QDlk)z=~7%U?43U21sRrhzR@MDgGw{N=fr zwim8UWTZ1_L-+UMGO(e62oTOg`Wz3gzo|0}evRyVAJkv&M9y4v34IN2rVBW@$(Q^# zgB%^ir&lq(zmc^7rjCRSsZ(d4R?68JiCJs2Y9itj*fOdbX~WH#u!1}9Y&;?%;L^De zSd1C}<=~hEkKDx@36dr4R6_Xr+5GVkjU;jl18{Hntm}7*6qqPE{9~ZX_{4-0^;|$~ zxwd~U#TuM?3euoeF05}S=A4JQ_2S;$JGsF-JC{_DrIn!>nN{^buuNMltE>b^ok+iQ z>7z|=EB5&x^c#~WO%`_V(TTi;!;vTdVR)jxqzHI_tKDC1O{7#F*Wurcl$2F2>M6vN zP5c2CCj^!A_!)>P z(k}IqRSuVW8+0Y=(JL6hS+yjm4U<3=tMH?tBK-}f0h2sn%6Q}yE;h_1H+waJNFX40 zz8=drF;_}kmU225$mR64fAS1D0`6IL;G)PH-aqx-zX|*>h0ixIG_`USv;Z-bjdkFC zISr_Ht}RC$)OReOub!S;1EQwCw-W{e;2|$wysyJscM*o`F2nP8L_a|JI~g-QL9JVU zD8|nlw4mj{7y7OibK2XB%6$&O*&vno^N;?M>;O|^cG>}u#;BUQfg&lp_3Xw*jDlth zYr3Ynk5O<|zh^FUdz8p`cxELfJVMN(;u-+10;8&icI^0?)}w@<1T?s_qJ+p-I+F+$ zYvlL!cT9fN`Em1e65=C9aYnOQ00bxH!Yp0d@g)g*x>WX$9O=s>_@Y7AbB3dHi<(xUrwid?n9FQ zJl|S?5jM<`(DlUC1L~Fqa_ZNA6zA_%ih3j0tT3eS8FhjFpnd`NPfm|J2ZwDmst8BZ<^{m|J`nZg2)68|X>a%G0%+Hb zzF|0>2VhP)Ft2p)qX<3Sf_+0aya7*@v}#-Pod=V1xk0|E&>N&==`Bd7ibevD0wV8O zwc?INbVTeGNd7ieLXkCjBDbFIyXCY238i^Hke3&tQIe4lV26wG zuwdsF@XgTs?I1%{dohgi_NBfwZx8{%|M+J+5Y?Yk4|rhN(3s7zfcWc(1~l)cvR5w~7{|NihbxPAHh8*jG^&4j zHt^1C)PKs_oxo`cmb-d`jNh(Zz{k3-yAd~U%NG$md;MCP@0iYkem{Z)TaQruo(NU? zQa)LjpFeJF`xD8=mc|CwiNxoWJRja|BcXi zq--tp;DE^t#5f2EOBj2_8~CPO_BS)gtPLjreTdds&&J=9l-Ba`j8-&yyvC)DXZKsj zOe403>SV&+0dC$XSSq16+G@cpogo?oyJ!@@zOx*BkaxYW5%PK5(=o)xUNz>6Lb5t`sRUtJ?T@D`|zIrQ>4i;6wljvSaoLrgF zV+5=7BsvOwtLsIJSE??n`a1Ab*tp`hgDxM7S`Z0s;9!nvEAYH~|3~k9$#_2iEY)9} z$3}ws^51!;n-4pLPL(eQ0>S6&LEhd6^RCWQW}%NW4J!Dp;HBL`MPufc%MB>TFYwA! zTqNHf86Pha0~2ubisTPYx5d=_S;OmKpQLC>p8po+lobwBH4-jo5Ig#DKFe9z2UC z%UhB-$_1ury~Jb@UBjvfoG zI8NGx9d%1iSb|FD```2iWn~hQ=ETZGf^mNjJ+C`SJH3d*PpqH~Gzd3(LA6PI-VB!# zI?;Q-TCBk*^heaVEv)%^vV`t8NRf|W*8SmSqd_l{XMsGQCkLG_el?(eX5WR^)<~Z4 z%iP>*Y(+A7nW}(aSZL()G(lrH)n{8Trj3a8RO}Of0Nwf-OE$-cb@zvFhr{ zc@$`)KSzDVnY~tG(0oeIUu4Q==?d+A`Lk`Ji7PQ{-XGj*JX}eI)7t$E*>iuux&!Wn z^qs|0Dv%QU8v6o_ALp0pri_PMd!M+4S{(wX1Bm*`@`p$OW^l*;bMs4~4M?TV*RRxa z7OuI10r0pJcHoRvkel^PQQIR|#rQ?DqKcnwRBKNKNgVR3*LD#V}yQ@cek~5E7lN~T!Z)>r~L}T&$gYrbI0Y{9F z)0Dj-+?iM-I3>vlrl1!oA@C~qsQ(!0^oq=)^2wzYL3ZmK6l>2lV%nSWUTppg^5&&c z+l`e*++X}Ne`~_6RbMPaL&GxqZn=Z_YbBxJeP2&tPxN?zm*Bzbw_Fwm8Cg5bg!Aph zm>AnsW1+-zr;A_)QH02U*sypoDP-vx2kmi(YVNul1M2--C_&&{(P*IU^4>O2rORi> zVOu6e;|i;&XTjOcg;?EaXh})R+QGV{cTa?nYdhQY6_eKh#9g2iPwb?T$>% z7RWDK{z&UBz0rpx7<*X;>$rqaT)a!MUY=bs#7@1jj^Fv5{&-<0*RyoJ99DXt9B9{l zTp>&{+0gb2Bn~rp8BDS(J!82E`!ncY_r7274C{d=!lM^BK?>7vZaFL;3frCGT zU%duwW(SE^I_zxYYbbeB#kgKLlCwfks=pjtm=SHf(QK`>KzW?MMIA~5B!3+NaPE26 z-S$g2Jdw_nYwL2;a_0E}2$VR9l*bPerE`Nv5B>H$NTi>%Qb@ESPfHY4tHLYl4*igH zI?Og!EY-iWtt4ufg>PFWa)ZRv;eWT1;?Kj7?=uJ}yaV7R?1I!W*(nrw+JiWKg(13CI=lCz1)wuECTrm&RyW zh#VqZZvjS0?fDe7iDzI~9wqLB>wuy1*tEJfSHl(LRZYleX&9_=>0J@PT#zcxetA{W z$GZvqSAarQ?%E`*jsp*0uCh*fT*sN`F$&F4vOb}?GL1%N4w!>8G4<&|znRb922I#$ zz21NQ)cdIz_n6-Ydr(8;*sgMD5G^25B;r~UUW?O)u`}v=TqaCoS@gx>4%>YuUZ;ek zQHE3*rP%svt&(;3j<@Ceu~S<`EN_moSgDp+$#1eWL+OYupiei#oHrx{E8`1>lo`9J zE_bLAT;zm;CLWMGE-qE1T%`|2tdeiZThaj^h# zCieI7k`4xC@Te8Af!#^Df((&j^px7m=cyqkV@lQ1kp$7&f8~J^ES1{JSm!cOwT#dX zBAz$u#;aA_;;&Bd4%czms2RKYNssqcMx3tsyZUhAriMaOR_^ zQhO3N{YI_ykW0qy)m$;IYB_9g;%}lep?WZ(7hmI8ZSFZy`2AQZx=#?I1@(yF)U~UE zsM?f1N1EXW5YEMLNGl`Uwb5NWzPB1Gnwv?DgvFRSc|~yy3*llQ$Y+URcu6c?%A7EP zT3>&Rn6-++wY7izkV80wk+J$KAJ^*X14u}gA5i1m;I>raCmw9DuChcBIl(-u><(Dv&}-ip zfj(i(n&PtDlga!xo<21`BXRfQ>L|X~yu0NDb~$V^X{nQ&0)hwgNzDhr!F4ASYN$|o z*!X_G__KfUthUy=11i`SlqdfvSih($^S+}_zt^IHb?Tk1T7ORPMFpYWZNN3h25Vb6 zP8%eWT|vO_F#X_Gh5w7@aRvvVQiIF~nE#sJ!gFe@s_Vh9d#%p+3-Rw-jr~7xP@j1j{7GErb625hY)gAc!OX*5-U}|Qh4QAE5b>nBm9aESa<-<$#|Ks0mApJW< zYqjtpa7PbDvNAn_zJC4GNkc>j&;>SkxS8+DwduzDFip-3o;j0e=1=zhqG5fMyTT4I zUJdYuAySayS@@4b=buTZ+qDvO4Q~HXMOS~#!ObUZ+*ug3@@v?L`tXp86)(nQ{A`u; zIdON($ldD!Nk;1E^RIepXPS}{pw{tDUA74aA=raF66Xz&4=2)SbQ`c=dYPixID~Xm zVyoOS;mKjrTCvySJL6wF;axxaAB15eRf`dvtZY{e!G*9#^r4$?=+S6mIxg*{Q2P*_G$Pz@okd8ydo%&-fiTP&dTiVr z!NEWyu4YeQClDc?J41DGEo_0B`q;)%%vYP1C3$uMuPUUv?GEz9=*S9^<%j&BV=F?M z$l&!~f~q;oC<>L(|7dM5!m6eRzuT|BiSv9R)4fVh+Y^&T}a zAI+96zYYJ3T=cuNexI^}QR+u--~RVsT74*4y6rX%1#PD2on_DNtyGaL$k29?kapSo z;c=haq;5FF<1ir zViBQ$oaPR8FfBy2jZ^g-exr$k7YlV!>JGz-ff3cdi)nkAyTE6BENKdyBIb7KfvXOs zB)NkDv$csVrYZqu929|}6nYB|gFm10s*Mu253yce~z?9tQoz*l{RTB{yg1$l{#?7*xtY_=vB?nCcoWSchwXdb)2&_XD?T=@BA7b zDWkEteMLC(b66wW;P*_j-~Y~(97Jdsuu^)VqPPh5@(s*QAxy5n26Z04w9jgZB6 zCWJ)`D(hQ*oJ7Q>E8ST9PT0;-lUY{x!HJ{dSpvlLLm22H9OXZbPdEGMPvBX73+O;m;o?MoK{x*5`753KLCV}bEO}l zkztb^Jv>ZHEmxM>W5@F#P((&C_3=d1nCFj6R54d88XRcCySV}UlH)ran|XZXvtam9 zr9+qUxY`P-`C_#;HF`o37F}-KtX)?4i2(O?fJU9!YXHA zrxamkTJO!<4Obb2xS!JT|#DwB_CX%w0Vw=su z52X~LFT5qjD~XpIgoW%e6hCqX*HQun1ck$+=@HDRYT{&=Es&@nm2i%ajTE(Tm*m7? zHmxQn{$yrN$5-EuCTsE->Lg8&rO~rjt-KdWZ8wdQ39!?N%8eM zGB6N*ab!Ak=GEcKy}|6MA~0vF@AsJyEG%q+L1zDCu2j_N<1t^VE%iL_T*&|M=teI3 z&_tA+)D3xxzrhg(84JjS=+^jz&3_D3e){?psw#;S?x;8fWCDPy&qCBsaA%rv6$=Mj zQ7#VHSxeYmhycdN0LzPEC?)-83F4{5u3!~CMMZy3jV zrac1Eh*OeWNN?|e)k-V_926Njy!iM;lk}m#1G$h^u`vD4@H7DH1+49pG4U8DQkg8g z)Jc;V=(8$!oIPE7WEo*t-_BW1wh(U)l$*ofE+n>WEv)Iop77PQ+O0E1j0GV}c`-!5w0qjQs?(Z3dJq-~T|K%Vu`FA-v>!5NU*ha9XPL3%AsA*3 z)Ip5aRL9%LNrWCtM0gKE)2hVxRMCNFJ-+EPYk{xMQ_esFc}v)UuyE!RWWfNFFuPR; z&#)ULyG8_v6DeefUL=_m1Z5|541tl6i+V>1(c#gty<;?TamW~t9IN914XnJeg7D1~ z3XDq}t6zM6Km%OoKBUNX);MMbRnv)@s_#iCgD38NWxV7>Q_MD`iD4!sb`5;(8!TZ1 z7^a1iZ0J}u`^CoV(laukD{(L?W}L!uaGW7(;Y(C~Xlx#!jxU*)*<^2Fu# z?|>Hq7BC%Y1v;3`uDL!FhJ18naMhtTM{DKWQ#{Sd@AZCe*LfrDbc5js7VA<~*BtwQ z=~XXznxpkw3~-ANS(EYAC%9nF~yucWjD3y#I6A!_Ea z1P?Hlo;NGlLo__Z-pW*Ug~N?paifl`jHlm(3t_*7i-23x6<L7EE~Q3-Knv z3^hBBlPS}bx49EI#^s(pai9I$gtbNSTTj>>Rv71JBiM8YkHMQ0H%pi~2B4OaiDaiu z>9?5|AESX>$#u`eiS^k(Sn7P30D}?!6LkSM{x|4s1T5aH&v6hNs zY?~Ij&8)QIYFZq*mX?4`4amfX%y`H4gF!aX{(rXAHDVKb0`Q29`VW_%eSKN~KjLH` z3Rv*>jC<_TasPJJG#?v@P5!EiJ!Jh%?A@^%hLDC?j}CTh5#AJGmI-Kt6^$nDtqiMk zwQ`#mbiy=aOY`~N;wh)50!urg3=OMozS@N>oD2<_2;N_8MPp{zs(F_}ozkwcTa6Guq?;GlRq9lv^jG+R4red*|C?{k*?MVQu z!UhBwN4#bqxl(I#Kr~ri3gTv7gfvWv4BVWknBxsc|8W(VD}2(0#S;l7f5PSC>%-13 z7|A||UQ%jRpq@;chEws4`jGYrTC$qpoWfn6|1b?}D-{oO4?oJvQ`UNTZy}$ z(wH=kL-t*sO;j*=F4{$o8fms1*OZIUw5dM)rWV(tRsR2y_4qDe?6<<@3r7#{O}6YK zS4;*|w_uAGgH3{_BrIDdUElp6df80LlJmKC(4fO~i|s=oa#Ya~8;Y}EpVIIkL&h+8 z`h%y8P{LgUkVeC{|A^utBCZFC_WD4z!=3OU#X4k(;?U&$K{pFneG+dWfHvHg4Y+Zf zoH<8#iu>QG(octsDNqjk18(@C!Quf?KRWWSXX}KtM}vOB`j7Q3#MLK7#*LY~Copw| zU2KmQ|CW-NVx9-%Hn=*_CvB7Wnlck|Ea$OpAXhihZfx3ApC)3-X&Z@G0BqyFbMYtr z-(9sI0Ea1VR54?ZGcjVtR71`g+nn~bN}v13@N1(bbr!^(K7`#P`|+J7t?$y}ll_GI z@Knm;32dlQoozpp+y;}uoaGt*?QZ86&)2rCZ`h>eZhNvGs6rI4o(6#iJ9ig^Ai*?G zB0L)Als3@Xx;`S`$iQDD7{@!4Lzjj=^(Y_HvB69&adiXLJ1ZbpgV~ALQKYcD7(TD7($3p@!H;Q z&i}C-L5lon!gajk$$wL?hxyI}Re6)S)A0S1Mep*mVf)+Z*uWGRw*~bwrG;b$>D>K- zZE)VYV?B~LkbkzY`yY};<8|c|GN>Fz=!$V~fnyDjPtmX)ceauub$FT8wcc#XCL-&n z8Iwr-Tl{1Set8p~mwE?Jmr)Byt?;OX?^>OYCJ65SlzZdBR^t#9tKbm~S$CNq-D?s}xb}<3kFqXLj zETG=PqWqQ-G{n>~8bf4cr8<6P+BD`#!AVb*AHs~{;EkD3=Lyy1f=^k5%n^-KrJ{is z`&Td}yujIqb& z*`JKkEy_;l7>%pGr51MBeyPKpKQg{`?KcvB-)jrru=)5x9dJI}rK3-Z zy3aU7dkD&i^icH%+lCmUT0gNbD~;>ztso*i?YGwFTpJx~K~5jlBcw3l6eGs9c$j&s zBd7UbAT_%23wjHn9O81#PLz_Vv6z4x$;l`9#~uQTQ#V4`D3Bd1alT(Z*uP~F-W8f9Vl-maQ(-{s<`k0tNQYcG;hM+G* z6a3IcB8(9=DWg$I#^aHY4p&(qV&3R=SmCf#;_P#(%TcLcvz882^iv4e$q#qc&35Zh zgh~m({V+@46Ar!yeWmm85nuT)22qp_zAYC%)<~MBqmb&?Bn=c3kD&Sq^rVb%$w{{; zr*Jfw4Xam;W7{0_mm2>TR+uXmQSJco*gaNt&V_psUke~2P;v9e6+c?gdaLg(?ewSI zWBpx+E+etsrWpz%8d>ZaprCfa&AQ2L~XFfV7!JJ84!#W~!M%>`^XrQP5Q%m&5qizbOsGU2)W=XG& z%YM9(s3)p7NYIH9#QJayI=2;kKda-RT`|(d#liGbVcw}t_`7Y4L}d5u?&E*l49B*M znj{A*&^GOB+KNGs#^;$<$}Hr%@9XIqVXIzh7>M2r7?Wznl(s@w|rUv!Dh~>~2PZL8wwfQTSuf zK6)?g3#=6V-0=xD7;*QBVgjr(vc{wY1o~tbwbG-iqyjQDKs%pP_C@=BbvWaMRbTQsgGk3Py8XQ$*P?elPE4zc7> z9~M`tsGXgHPO1W%_^6~Qsf8`S%<*m+1AokO4awxpXEvs6fF7iS3`~dYsG6=(#NM?) zoU$TP#P{I^%A`r@<4fHmPh>FUJ5}zsLE0WDUJrN}-F#Lbds2Z}%cx2%1Yl=>)8?sB@jsLnLYo7vB zsR5Lfl&Va&7%EiXH^lntJ95N1gkdqBuvHRvkHaZ`^JZ3c`10v*WN0Fn42!o>~c^n;GT_Ghyp$5j)!UZ-CC?IeVP3eh;c2=-tq*5|-@`L-S zWV7c>ihFQM6)Fm7AoxTCAagduVP*jD%P7zry&IK-TaK*CD$;BwF@;8$va9y+a57NG zzp0#U=z`AuNnY=B0N;aG;7 zHXx5^pT)#_-gwIKeJFw70SE6cb~a}P5sgJW6=5&#X<{bGG9c@d`MN~c>KVW@K3DYy zfm1WgL#Nw*&i^nyr+*Jy3Wz3Cq^!eE(W-SCe?II$y)!=sZ`nko9t{xb*tQXZj@N=Z z2_e#oB*uwVdvtYKyPegWWJ}J^9E1{nIyt)_2XZH-rCBmj57w!zRo7Hg;9SoQ7DeO^ z%-W#n80m_0?EtiL*fOgm)(8|)`!`MJ=5gmB6>(_IKv=_cNch6efGor@3*;WMVl^)1 zZx-SG_9eAc+`k1d(=!@w$>2|3gEP>t*i{On!ZSyyO4>wu(Qs;O)&zO z{*tAzQsj2I?EZ_(?6f_AE!B$1^*F6|V;hp1#*a`URAmQsN2{XPv#OJ%a6#97pA)z~Z{53Hh2WJVe8us~V{6TbPuZC_vw!e-WF zMc9IESkzE~I`iP|Z}jIE*?KnKQ2vTh^;OIMH5h%$rXaE(`-MKfjCD)AB`{0N+bkIx zvlNUIy2qMT(rPfQn{Ir2!wie%XLyy2O0X6B<*3s?)id2Jc^rd%b%O(+mnh!r#Rbi&EH+Z~3sj%}O54-sWAzV2EBU z>}Rge8v#P4S9>#&Oe>srA^8CE5sqcju!$0BYd0hUTYYi@f?+oLjsAY}{)n9E<1oL5 z$OP=7c3(W=FAjL5gp?j4A@m?*8XDQTt<{k6YYN4gX;WK2Xvx7Msvx<=6u_mugM`B{ zwfcxT9uYRMv=vSrfF~(Ah)0kUmLrurVJhaNEoyb7Nu?;HIu-lbQbnA*G;Hx_n70+c zU-A)oQ4Vv1;~`Nm%Oa zalGT@e+yFINDz2tYM6`j*hVI|sp#~*+hn|{0{p1PK>B^S`DEZl?m+uw_m1Z|HzMS; z!hnOYj$!lUh^_2f(&TjC*%jiQH4xPjg~uM5xAF)tydz3yWjpHhl>WYR$0&2Cu0!6@ zK9|=pgV_4+!lx=pu+j~`WR)u7ZEeE>ddc;EPoPK4!h9{yJO$JBm3!@@`DiTueBplC zs9-x}yKCL;bec6O{G|;mFhCXV=>;DOmt353Ssx^|NcG<2PGF4BQ>eBtmN_K{fp(UgiR?*Z8am9tV5m4B}AHMP=ru1*@k{9#!QPK2f< zEiUfVqV8f;=5DAmI~#EgOKR9r+Ru+^h0X7fdYyVMJuM{6izvr7_EM5F=mhHmJ0=U? znQc>z7)JYMkzYl4twuZ53^(I~BUlvUnhUymV433&j!*0*K7SP?V9_dw9ylk-l9GL+ zcK7500*eSK)I`hOctQ{56}FneZO?9Pwz;NU*8kM-L_}Tyh1IG$t@bgSphYtuG_I6S zRP#-d+0su#)CD5H z_pnbYPnp+sViIqjNVY^}(c|lK6&$p2n(# zU4)&6siAjOr%jOhe{&};NS2b6i^J+oC*=o5EJhJWk$P*BJU%-fPPf1uCKwV2r2eXz zp~2rk%v3eS0c5`M@w~rxb5cc#<7`!vHFiZvI}xNDQVq5ICf@%^4HM5AdNv;K+YbJ% z>%9bGYl<>48fV0iimR7~9MPl5=o-e++T01NQpES`(VDio9yWRk zGUO5iO;*Gfx*jSKq){X$gHVTBlvBO`?_xV8(77gX)2)vA z0fDNX+nKXwoLX6A;L$hDSkQV#xz!(UM&69z(MLHL*-?!X%Y+?<`i2;=7F#TJ5V>c1 z;B~RO-Y_c?E&N@lWPZ5?Q+DJfC>-s5MWvbO#W806v#61(yIN>UOSbS)gSY{cDM+viRiFUMNPvE|uK$dolGx!wV#f+EN z#i*k%&4Gbg^5z81Q%;l8)9jcC8P-3NF)^0S_SvfOrh#%zmI{uF}de!DYpYAtOSiAfm;P#7`m%WJ%OUM^tmQ zX5@m`syRn}^oO9z@=cuvvLRU}4aZyV+}<`_&DKK>40Px_XM@M1Xd|#HMQ%b?E>J3J zSU1MKx+hj0q@rL=W${4xc~Tx)BJv4~PpTvo7;_<~Y*G&Kry!exhgK~h`2f}-r09iL z8dxC`(P9};DC*fV9mK7Gf>?-1W@AV0W~N3F^}FP8N=k#fD2U6ZY&lb4D}T5F3ogm? zLpG0{-2|I0HXb4FAgS5HncKIWhc=)_y{`*}6vZIj4=`y=l0tHTQSKmOTrtF`VUo@w z?zK^Ob8-XqC8;y~UcP)3EM7Z&7KZgbDgPcS6~{$>nQM3*tuz!R^omUCfami! ztc0*~O28bn%m~;>mmE5$eE_mjdf# z2JU;)bS2ua+mSHiIntq7*DQ)J0dj{{rUlMfZ1U785&<$4^{-#VmtEm!PA4ZPUl>w& zsN((+2h)kHTtVNGL7*R8@dCB9+BYjlN%1Q`|{CHmKK zVxsB#^m;SPD56H!*?{1&aVK7E=-|^_A>^C&yk#4XG{BdVzU&1{yRlf^qh&TOt;P`C7f~h6FJ$W8FN=pqhAa5G`$_4(&(4q(Gg^!HFPGM zuqI@A%C;^{W=b=*IN8H~O-WkTtMWJcW#{HfnVT1>Vl;Z4Yf&601RK4Z<|CyP4dUfz zhif%PMMr-=u4buQktx!|q5l|g4>a;Ira4)aAC}bIwc9Q12^87)TWWr?fz?TRjMXedW#$NV`k-*ACp~Kv42YoR0AWA zzX7xoe{I8I>Yo|bET6J2FI?gp^ld^qY4x!$keKg%j#EDn;#i6Od#w&0cU4$l1UFc; zf9zN$W9-BlaZF7K%8ptVXen#M-KDb33xnOvBNL7CoQA02|YiujX~n6A1?O8WuJ3e3;r;)(*!eGPkaq_dWyW2^;F z`)p1{^*BC18QAF~a{$lmy6BsQFV3=nJ-5GiRp5<=Bz4zR)70ci-pTCyb4vvqIpX@g zC?j{%5tkv*Y9gT+vyy8|VPf>JE5ZB;MpKi!gb;Ul!jepr*Ii+EJro7tFGCtKcy!LV z3en)NpUCz0h=cB%YZdayx2+NqkPSucNar4R;Hiz03U){W>)CTUhQX-gFC7s)P29f= zx~pN$lVN@~w&PMWx@~T5hJ3QbX7DZNP;;X-tD9v?Hiw5s&9PKkGRcIjBuU?l!9A2pqh>dw0a{IRz+zZslf0?Wn2yJN45 ze?~RZEDz&DsLw_Z0M>Vh8;RZF5uC}&YK!U#b{>b)(0Z?QE35gSp`aj;LQHlDV)nK| zok5v{6$CePvq{DH!j^Ij;ZT2@Qop~B6*3NP#IPs)gg>p@s&0h{{^rbWNqt*dqtW!U zx+4M$@y;Lv_72$5@=1+@t=X``aR65nm${5k1ZWrHdK(PGWlY~&%`{0bRcxyhvLwa# z;!@Gh01}ZF9;rmnsrh*Ntj%q%MnQ~cBy5=)(9!pYd1Dp%JCyzO`tmdk=s1G-t>$xV z@Azoo+4P%Noy6Td{kl4FzV!N4nycwS;__bIGD0a_Y&n$3mnC{y_2`eJnUyn^O? zxsb}FnY-C1C}HAb;#>;xRL;_&aSmUn6L$e|^!hIU-b-dte=7Ip=45BhqLjS)h6aJ# z=n;&fTaT<}&5`HX_4V-V63?ck-{y6d3Xef&=NG`lbhW1D+quqmq#wdiHf3L>h&Nk@ zG0_=JmttnN>X|Ne@GUNJ(lbb<>^8t-6FF~R;}g`{b1;f33JKDhl~nPoG(V_L_RWcY z82S%L_1jhmMjTVx_}OP(cVjX)bK{Ya3_^Ej=ygaR+h0c5)J1O1aUY)(QbVNJxtQO{ zu`X)-AGY2qtgSX$7scJ(-Jw`<*WfP2-QC^YAyA5Yad#*V#fy7!cXvPeyVl<4;+$N} zi_9eR$$Y+i8Sfac{PCd26ltXl+(7&x#^v^?Ml3dEpzDhGm%vuVuSNQ)E@hPZ==ikY zutC&|v{ktal&LCDnrpE9-2`d2{-Y0_gS(|L&5OX&gleB(5g;DCc)*j_NFrmH!Ie$8%~f%WrsXFEB1fy6|psP)5hC@+Z zl|3Xt=*T>Y;zFA4sERnL9mNk<-k={2*ifyw7lKD1zMF+UBfD<~)^A;3-;TO2LO5^ve!0Tb39gG{ z>KTp1gce1P1@(fK5^!WUmK1S&9>60HJ7sC@CYeN6&Yg)Jx$|FnmPC@fdsLAYE0N!} z;aU=frS-^`O1Rt0z+Jrj$OJ)&iE~Kx@|OJKA~`Mm!lN^5tklK6{o)w)qLSJjE>H$d zN?lHGr@a4jWu!lELwKS#be{worfU`S-eNsWnmPIxDh}ps!9>Kvsr-s^WO2cPbj+~Y%P9@BCwG_3zVerW; zbIe9c$XP@4y-N2!JgAwkCyd3&#w8|AU)YHU3d7f*=wz?hcUikU6o-swkZeRbU*CWEmO8`4=%pp@=F4EG;b^<;G#Z z8huHV&rj`+ft3kr@|-V<`E5BE&cLBsytJ_-lL|nb)aQxJ93qHgt@pU0nlxaDq{RyL zSD|RSSX^qIL-fVtq%xSwVU#K@%M<#Qsq#%f!bdi;;upZ}KH;D?lQE?ViT&Ec^TrJs zFo?8IFGwk<9^K5H%-R$7Ba>bB(m{Rh{qdfwpzVl81N^EuU zL3!cJEK{|W;!E)jY5I#Ok0&g~Am?o*MLk>&tr<7o(j3uVHt=(l?|1cIhB(HDw*&MFEkCA%#p%r5-K7X| zeyYyT@L$SXGd7Ha)Ug&b%6>n7o6!pHy58j?^^y@sO3w#3{I!@@2TGq=kTTo_i%)%Y zi?=5}X9ta^dTQdK+KV{SFMB7yGQg5EMf+cn*p?1EnK?9{by@r zT~i!1Vdif(C3b7c(2xwzW|o z>gv7fk*X^zLn9_T2vKz?2!d8|Mfvat`?JHkVGfN-aIPP~i zGSuate9YHXJu0=2YJj8IQ6(;>^Vyn$2e^B8?vt7^S`uV<7{AQV6VVYW_s2JJVlr5l{cz+Nni%-Hn@ zN&Pz0UJ=SKVC*X{lX~>TxS5tZ9o?kL*tj_q-Q`L$3s)sLdrX#Warm$dHheLBqmx6k zc7f&yeeHx3-`RJ|Sf_UFZ+1HkVCLRhBf2fQq`u19#euZ9Tv;+AeHM=6sZq3;A;s=3 zC$P57895;R-Fa{tRFr5dTn_L?hkRgUgf4{YPbXHO@t>-3WXSczNu!Y1*{JqLcxj)m zgnoGnS#O-5wPqGrYhpWpq=xNrAbnO>kIa|Dq~FG#_&qM;&hYK5t^1yyp6rhUjH1E? z)K{VlmMRL8KqZSXM8^O$=6Y84tggaTihOzg;g6Mu2C!Eu&hvJ%c|>+wjp5!k}ysb;hKMR$#bO zZL#-TN6&(W&x;Oc<)=(Dx!`ld+!qrMiAsb-Z#SMbLFMXh1 zI>OV95+X$G%hv#s`V6bKo7yH2BCC7iRY?~&Mn!h^>+Ey+W$XWBcbs9UD|uOfDbR@O){zPSw9#1Ye~V zV20mJo)opW^I{ZE^uzvn1;=%2?FGexl430*MsT_|{@H6IIFtNNb?wwsf?Ro}ZQghD z6beT8=|L>L%mN+`j5P zHpEcEPI}dQXWKjW06Qc27|_eGgX$ObsSn}n+2AsEnz|agsVva?H5)k;7^9fMzQ#cr*o%dTspor#@hrq9b2 z(48Ehz=$;gO=EQ#r<-MCj{7*W4DO=HG)}|IWYGt+5&x&wM^KS2eZBncZ^}4UjV3+j*|v5ZO`G7y z_;G!9OuzgEO&0RUUQFFZ)u>fi%3Ia23k`IvA|n&5dpm``KF*nhWFa|ThQ_Dzq@ohv zLAY44q)iTTd!-0=!{&LIrfq)YNero`$}k3-ne=aVuNAocJghE@jW35Sz+Z42kfkF;ypALD&zz&4AKWWZc`<}>3z6kZ>%g<-)V&=555Tn4-UY?)rV7Vq)V(Lz-Ysn0s1Kh`~h?0&~ey=s?3&<9YXuY(*FybWS zPqNXJMlCl54vLzf89<;bOkMzml9(G0x$dw19!sb)8CdJ8+_i7u)C+;`!=%H|?Siu-pAfromVJxys5?0}a6^vK}g9R=%&GN2Bjn zuKyp(pVGxQ#Ta5S(;ZUdSQkqyctp#GnJc`S9Y6$*aCN>|sMYiP4s>&0ViNA1dbn&& zT84O(h#VNzYcL`MVIoaf6h%egm>JsD-|grjG*4J`)o6$Yc*M}LC8rl6z5qG-m#?%NTNyy7znkv^cJqNf=3g`%ql zU?zMKvMYlV0<e87J0uh^jb_0>|gaBCQ@X=QDQ#!fdr5CsD0I6w;VrjHm@co z;n$dH#rDD_7)Dz%fTis9{KV2~GhxIIZQ8Vsz2G_Pl9VqT-_O04`<`dWDMpdrP#E<- zz&agJ*Bl5H-AlC`1K=ZsS(2gqA=C%!h!@x=K2*AD;0pltP_0ua&`8w2o0cC+ZobIAl(F~e1pwSveETfJp z|BKOGUz3-ESP``q#K|lJ?VQ zs7~soqs3Xm*|EDl*xQv(f%-@F2|n&YG<{kH%0ZFrN3*NwaKF&@yfK)Ba1_bp0v_7e z@FrS<(pl!IXQV zy+)zVkz>EDg2%4}cR041ebBq5;|%-=%F}U!%@V*S6~J)A`%EI1iU(qGKYKT#4ffOD zRt*Dt$J2y+hi`?h9((X)LR|B7Bhy$6wk9Uo-X6r4A%xD(x_^%^1%@vWi^P*S($hw7 zo%76UUnO$0ICnn6MAklTB~q)%1JF=?;Y%={E-r<)3_m}JcQTq{C^qnwrsZ*f2sG2y zOGyQN3&a;&uYvClP6kPEnT{F?lpL`w(jesIOPPZ@Z4407y58 zx#xOW_&boTN%}nu)Uz**ng}_7413&^BSS^zu1;%`KF%|qYBZ}QpcbZdI6SA-*Xwq- zm35j-w;FxvSF_RCexm&*$9dZ&b%bjlZ=Lz0p*s=MT%q&b}*3wRJtO zFut2zeU+puKX5m9MvMmcm?2)$N@ntr=Z@i#z0v_&*xj_B8Azq9S_%kTdK+ET{ugcv zyo$5+Jc2@D`^zCYfzKrT!@jJ#@m}?>nQxVcUYW)%r$&u=m7OJ`eB^*w;)x5iN@wgE zzm%XaiJ>`=V~2*$0P$TH9pfLJHC(ic)@C4Dyn+8CDiLXRvSHj+I0b@002f6W{j7Fe ziENamTHUe2^f~@Wmb2X=rWP?yDqs{8eaiX^Pa(-wZR3R)O5cK@0`u+a{gH>SZue~u zZu4_jmyh_EwkR|}c1i0Yrf%5UuUz~A<>6`|i}+_sfLEDP&-1n;509`UE3l}$u8fI% z>IWAjUn2URubNrKo@6Vr;@9WzE}6w@gb1?*6N^sIh>FLq1^D(g`kpYMijm43!F~l% zF2!XH0ba*QasgNQOOX_P--=d5lD7mekSIuy2k;Xp@e~Wc;A1yEN&%**dAO z;GsIdTV@1D_fOeo?F$fRFw0)!nanTsdBFt+I!j0mN2wMi1ayn}2gWEfD9}zJtY6bV zxY3N^+-abK}f^xc7l4J(Nfrzk0gc?Bj39*PtBwQ6z5UwwvCEdlf=%Xzd)kjx8yIL2;yIQ z4s;(qo=6XCb0d7~(FIhplsE3cp?{}79yDu&DjUTzsmGd%?!9pDo7%aDDiev+s&rG} zAc5+#e$Y;OSGH}LacG@?Y4G+8Q!EOdu!tWtsoBU3^Rf@~-$5A!mTpmbZ*p{18;u~N zif)UP{64_k`5OvX8*pSG!2KJEsD;=J9d3eI2+Cl8V3eLJ@LVK_?I zmX*bb^dfj;hYC5S&VVNVeNv49J2dtUAL&qqS%ZGSdhZws3DzHrE=w`;n}XDa-4N8B zfdq!kd=@7kh5^+*jkJ0Db{0ry zwoO?ku(D93m3n+-o7&Gr0I$*`v68@5vq*@w_r;8^N;QglB+tMx9i~Bcm;=F(OhkOq zJJWGXt8#oFF7-m>i=<3_H+Beq#`%csOR-%xAD#RWXyRkz=eTHKOcQ^yx196~p1 zN4|G1*<&h;ezKHTb3{IJ5E-%KjONWF-A?c-eFlMWYE%739szmyYU8;t>%*SHP*he}>GURJX+ve}_Kl9L8 zTXyPwKRP?tuClRvHp^U@z0W;NgR01r&*xFQMs)RVJ&zGb%Y9@LZL%)aUmTt%2X?|w zcyExjml_XlNfX9nde6H&eZCn!ybccP_G06}#Cyvs*sfQIZ^1 z8Wzc--YsT**-VfZAIG`M{61R(;)VFG3Xug)lw$6K!Hw!DxyN6j1Y)))`F_F9(|3Lw zeN?@8zHOY1pXDW7tk<_KP_dmeUcULb-`8Y5Y~*$S(<07A*% zl&iInH=ev?DQeVfyBOZ{G3a40QGULhKcl7d)lCIzH}xZDT{-C8KbkadSK<`!;V3u6 zy$qkWZbBMlb;%CLE-98wEQ=j$Yb045?dz(n^;Kx;uDzy9QO`&77M7Ad9|E5ZKX6kS zHHIGl&l&*B1`t@^-2=gXMcS(8Qu=?%Qs$UFvi)hs9{qWj_kjuGXM=V<%O8f2PP4&< zTg`>o)qXjWW^Wt2AIq0h1p<#Rw)?^s-ove=R~PTsN;}7!E*H3TVgy0HKX2$AxAr(I zv;X;(g5K zH=E(|GqJ8;oBA^5Jvt*78RrR-EAb2+jA;UvT)D>Y5|sJlDDtBiD%CCXC@op1avThj z9GT+gy=ImM&8mRrjb4-Y?#&ItR>G<@SEe6w%`hS!=j)H79-h<5@9!Yu-0zEIebI(h zX|Wh-IGkt34j9r4h_3E#lRQVt?afQFWVW`=1xEhh!(HlA#;s)cwpI71@!u_V4wcly z*N_99T3_aCXbYahOxw1;n#Dsy%eM5^@^~~*I!risb^lWDKws*#VE;H~-YXSrIQ{04 z=iqt1LHcH$70zt#$*}r*YnTfwld?fC9q?QijT?(Stj3P3SGI0TF^4KMq~+zvrJEER zD0`E2CZuup2<(1cb5roA;BPmNTvs|3*O$z|0Q!1n2XcSUS+RRaA#QB2y&QE6GFo4# z(O%TOYdSKR8L+`+*nj=uBYIAP+w~^0Bp~(6xI-du^eH+Q_#lnmj@`w`ch1{-DQG{e ze%CSWLHp^k)HCw)EGbR@y`jc_(D{c)>>uU@6rYFaGr)d(!<_nv5-yTI3!RS= z+*k?M;N!ROlV!ro*eQ7cNMW(Djf$ox(&%HWRmA2&xt-R$P55OGsgR#g#36=)XGpNWu zd!aE$LVetelrE8DAqA{RgIyJBBKfUd>zA0KfGhsa{kVxuiQ&Tp~JV+sD zI*fE$?%Feq2F^=%sfv0|4@;}wt7oOlQ~65bIUC+sZtb@x;XPOsDRx&D=-L;h)0KNU zP@LM|SPNx_kK2W>?*=Wn0PydMRzdUO3H6w)!M5P9vBWr8h|ex+#S8RHC+SM1>By^P z*J~afp%#sjA7pvzwkO@8GjBC8dC^vWC!<8e&Lgv8MS6g8<)NUhy8{Y|mSqS+4bK|1+`8zyunMuZ2f zbt1&AB*;Z5TAC?>Z+Q9q=j3x(*tSwCP8Xj*Fc^q`!#)ECvKPqa;x_(&68s=|EhLZ9!S}g0-lCQ&N93v&Yvky zNrW_Q@EeE(v+erI+NEUJPS7vYkussldiIERb;EaJUb_kXjVuIEEs<3PN~4sd&Iz`GMR`JCW=NJOr~qXToCbozJ!6ZX6P z_I4VJ%kz~F9T}iPhdpzF29q(J8l16<7(BpXS_T1T1Y>P2nVVNp1>SFf~a>UgM`H}ueX4|kZpE*a8)gvD5uYw zqyK=T&+i1loFU4b(|vMK_ z;_NXQ;PcM?me>;*DpBnJ*u)~YD+*ic>j?kL6JF7chl}5-s<}_4)%BK zZCd2jD#X;H2H+0=*SMKr_0Z~&8zj(Z&x#LZFVq3{Oi-8UKnJ++tXvu&T5bU z@GFt(0lbfJDWr#gbSF!gTR}9D`9ul#&Q_%O6BXuwP1szc_!$XNpOHHyR8?G{5qm=}nPz%|qB_kiv#q7~<{hCz$l#6wR7=RXXUj1ti)o zvQdkq@jVTLxf!ec4ONd0|DPtJXFXI_N!b;Al*w3a$|I3R0tw{dZQrNFJpJHO`VwW^ zL*NC=kG+Bru$S$of0AVa8NRcXq%GPmqTTTsJHMdAqY=Rh)-?(xQ!Sges+7IMz04l9 z{7P4ZVfY#mdC2isLA?xVHI!Tv7ZrOGIamRbgd6(Dz3X(+aA7iZVYt@_YFa}6*_v!Y zA{v&(F*!|A+6!za+$>c z@tzBmf<=l?2T5!=+QF?*c7ng&FUi^;hj|o15vzq%LCm-}=Pgw}or92kTVJ=NJX2zzAX$ z62bV}4bvw~D#3|N@bC(XG|zN)T;R_RV#QlP1MPB+1j3;16ZWK#; zXnR3rDp=0*a~0F-yS*_sWuX5JmuHsqj;Ux#i{<@plZ;N6ki;TQoDJZ?qL@-UoP&uv zhl7ULvkvK;QU78-`a5*lx4E=|P1-@DXEk0-NP+iW1qXvJ)%JT9L?JjSQPYHC8m7BR zkZ36&$q&GvFU~}=)2?!p9@|?R_Pn!XaPh`x4R!$>qlIi+)#a38cD=5!(`?f+6j`h< zw}U#xX9%y7?Qj*wX0RQ$Szxe`%W&-JJ-890zObLy#Y?1N5PeWz9EkU^YJL?SoqML1 zk+kX2GF`SV(yKO=Eb?m4Ko{YJJEOv01jz#C_79T5qWqpLRaht1Crz5mQG$Xdk~N4mTaK(SL?OWh&)#H zvCX^1Svpn-(a!E?&Qa%o75g-Yfp;+%oQ`vXRCvQS1upq0w5ES>8Upr=X*Vlc{hM{f ztBp^aboZjcxo{g$%!3U&5`2o{kKLkIVcD0CIc83jzT!;wJVnbXiqRMG24X~ZhR~(^A9X;|vwd-Rq^r$j45U(Cb9ZFM_UN&Sp zm06nJ5I(oa<=S$c;>F?IwWRH(fCKg+!XviQ&`kUmN$mwlhZK!4q^Yq0jl9~874qYn?@z?o{|JBWrxyR zL@tHJ{FrXwy@G4=!SPD+k?_r4*b76-C>`tH^OkZo7`(Y{Y{ABW$@30M?M3#ZW(@)f z?PS(c2b@>!y+?$5Re@ZJOHK8MXs#a1Bc4Zq_+42gOcygkJJHma0=*IPDb)(k6&Bt0 zG)~vp6^Y|xb%t=9bBVOP*LmpJ=OmB9k&kR;N2LXfjQiB8(-ON_zj3~Y~=x1rR{sAO90aTDU;nqbHKeKM6n}DEC4wK-v93+dcn;TpED>ANEQG z!MmLqIobeOpsTRJr|Hrrsqg3NRIM*YxVw)Q%kx{Kj}XtpWy`kO)N8(<*TsOZo$%*f zcf;z^a%7MH*sA&w#t^DfNpyf5XJQ_lK=zrS8DJ+ccX2$1jif0pC7ro66X{m2<0do^tj} z?O(lp12qHAvtb`Uj^8hYKKGtpr%-F38)MfD{|78U_xh(3i2q-dX|=z}_-Lf?U*Xk6 zul~O%bM~nI--|iGN4y< zb#wumv%jfKSWJ9P#=S)y5Uv7 z@&36(&*7v08^hTR22&o!-^|;O{dE^T?-NO9lJ?4by>8hqCgbLq2h`qk$>4}dYV|%a^!@3_NZ# zFf(gPUu)mX!XH~G$RZy2%VRo>|(!xS%BQEWLC^`7n&(8=y6 z@SXcK{ zg}q(TD=yS#J~(pMrTcMXDC0u{pXQ>Fo6WG%mR`+D@<)AyRK}gQ{P)WO&MSGaJWzlL zwNQs~PFtJNppB|+g$ZyKE_MZ5geRZIU^n8|{EGVV1&<+R=lHq<%)>22;fq z%Q^sZUk@Z!&f^MdVbAUL@{WG?3PZZLPiQI7W1;}Y0RtJEP_?mcslT)1|9pORX-2M| zEmTaHu0a9#yLsgcFt12v zFP55J0k6g=qzBUoOV#OF|4OH7d4+dqG6TPKn4f_L27d8Mk*Cq>*RI?FxQZtLu&%4 z{edx0@0STs0^(MAy}w{TC{4{@9+#n_gb0&*Gn2%s(9ofFMAofNNLw&^az4rb_BaqQ z#;WxHZcE*=06!NUjslIm;}ezAD4tDV@8l~!GHtA*fGe%zH_||?l7~og^VpZQwCr0M z`te2t>-e~JHqf9S=A-|G<& z<3DB^DI%M_<3ae}E*<8L)xgG@-98Gx5uSVB4;_t61ka$(#5W5U~%}8evV0spW8_AdB=R)^G2q-7w ziL22P%L>GbgxF5oZ-0UShl%{#{~C+sV2Tpu$y0q^Zef^3*a0%0I|$QtnDWcnaJ-)A z3dQjA4N)|6P&ATz?8Z+f);!rLVHE1QcRV3Ns1J&9P<&EOS@%vlNIXqmMuiX;g6Lqh zylewAWFgyRnfC~w zJa!B?Lw(z9qT*2DCI;r(XqRIq^?d;~!>ymUQorYTsq;0*dAr{~42_*Kx8Z2fqM_)f zu`D9vx14Z=RrA%FNxGWw6j2O!JHGj{uIQD0AE)~k!y&DRz$>^UFKOOi$6tkI@*sHn zx{mrumOfs%bW|WrWF(Zf<|)RFheY6no^*arVsv<)$V$lM)S(Jh=7Z;9xO0x$!Ag+r zgn8BJca3uhLzo(dS`U_o8|(C^5e_5lG!X^vZqnJpbyv@_@A`w}%>h$Yi7Iu`YB_Z2 zBHtxy*XolxKp>Ta4Js!Y5M!hsf*XiTC93@Oy8?(VmKaU8?+DS0V%&m%WpapZaG5z` z%e<^-kOMkC>C~y@$S?J)`iAAx1LxYzA;?=;$1+-)N5KQFs}v<;-FECP$xlUV&gdKuX6-p0LQj zHGJ&2<)GpA?$B7n4vz%y5(dB8{39k=@OUXHDjba>A9#i^dtEvB9Wt$ut&9xghBD<# zp=zo%x6kW63_?cs7(~+KA&~w@t~``;w3#sFNQT_^hXBM;uWbK$YAuGsjSGzVRG{%X zznLF4ZAarLAW_{4Nj7V$~n->teA+vLyh^%aRI5wlhwk^iSn#7Xi5GO3qP+dd=sj zn^8K|QKFM(6r9F$j+KQ22+4$Rxd>d6kOXm5Prj1WVl_+8Rbs&NvI3nk@>Ch)Ct&$1 zizvG}jaqE%3S5R8*0Bk6h91E^&1!?iq6lTyFnNY>^m9OPpg8);w|ed-Ldn13%B=E& zKL7$40498?`oEfrNBJ6}92m5Qp3~=^BfIoXy2xWzDB6FMX1sp>XhmA->Eg0?q=_Fj zQSfI2R5P&atK;kb3MD7#j5K>_?|j;Iss0Zr1Rl`9$PAE|bCZCa-teKcQyR5uG-?1D z2k032RJN?ON9~4JPij=&MfC=?3nnuYg1z7G#XN^(gMuaMd)gquD!zc25 zn-%WT$rW;{7WP6d2N6?1EPWFs>aNtfUq2_413EtSRnuksfA1zYJ0q@GkrO{BJ)L=; z9)vx;pU9fr+CegH%YPU6zXi&K^=S@X?6{9FVEsj>{-9cwAX*~ zTfC)Dp4WZS_tJoFGB^Buh$o#2A8FmAWW(#vdYt&~p7{vhCk17`dwjOeBga?r%AMTb zLuz5&RxnU+ya}JkoF;cObr1_48=qWi%g2I=^a^F;Y2T({>Qj9;=|8~?ABIy^JI(3s zk>z5?|3R@znmSA?)(~-dBl^-+`$NLgg{a%W+fS*`@LPkX#@YBfTY>IP^~hO-$5sU2 zYX}!$QBLkf*!e;7!)*OHWSDAU(S&Wlt^V)W*Yhz=%khY!c$ew0-wF0h7HR|+(E2N- zdADz-c5&1HK`~*>-hbfae-H{4a<8E3Gbb1=FD=~S_kk=L#TqF1O-AS#j1Ftwm0n@g z8oK~pQY2(?TZ);l+V78rNdGfMazUuz-fxU=av}RetFZgAqioRzPXX8N5ZS@OTVDM^ka(;eGmKleu?^w0o$-psI*fZB1V zPYy}R9R1}?pE`v@BWh%|5Y3zZkhxHn(VAmrn{Wg1`@su@Lc*X~L-ha)X6=4@i;jK5 zipOE{*#|}e5RJhG_v{?`<($0a9skw5$U_X7I$I*}_aW*G&8MB`!bZh<`8rn~e@^+j z(t2N%{o7;sy(=)zx>Q5FR(J?|SoCk1M;?OkMzijVX``O;8otn|mrmvRgVtc)&yCBcl+Rk0rLv_{hU`E4sd^pzu+J(UJ);gh z_>REP*G-As{aZ_FA;*DVQGR0%Cf1k!IYEp}i;T@`dLCJ0(8r$ zE(+_khn;yB-ZoV3d8&&r^PH|Hp$;9@9&;W##3%TRhN?#smTkX)OhhT3D$jY8`pS_H z<=j-S!%=)5Jh@k|VEQM7EA_m1Nc9_UZr|=2ss0Aff}^u>_`B)>u$B>3+%eEfNcxC~FPZY`Ug6bg>gC+9(Z3kNf!<7%0H=Z_V9tJ1xQa z5IJ?ckNmu4&6sj}d%#=q!XA}?E1A1AYFgQLT1Fqm(Xc5AsDx`A1W#LyG!uZzT8*WE zrQJfVTvi89RD)&|;Qt#boT(vyk5#r=zJ26}%fCt7dk%+g)q?Jx+eaLWk^iHBpI-$Z zNpVU^L;b~sIZ~$!sb>?paT_a=U$~brrt(hUb_I`X7oSNJR_p^!wH^(r)I!T1oT^9^ zPeIBleD|ytk%`VP;VY$I4eLz?Pxb|v7&B_ZqmuE#=3Eix??!X?P1e^1vz7v7`re=X z5$jGcp%YM*!cpq12;(bk*}-%G*A;^g=V0`p95`4bR(|F3Z|JDu>PRJ80`YD%!K%y& zaI0sYQs^A~^{+RiUcL?yp}S`-t3X-W=ao3Sg18`-FtPRsuW978Db&V+7}FeMM4mh_ zg(3f=L=PkObYLNSbV{Tt5YAdb}!qx=8Wjw|ca%Gax6@AeT^-K?@|o z)qS`jGz7_+d`JqBFD5?&l0BfQx(rbaI*p~oD7Q`|J5 zB`^vT65DtLId22zv;dqB0v^QQ{>d{PYCsI)Nsi?qq1}_|RFO*?r6>*=bDh>bK0trG zOfc_^LQsIi{-Jd=YD$Oqa>1L*i?HM*aNBmmcWS5%eI9{m9SkeVadcuTkGkVKBfW48 zCBtY7U!etB!PQ%V)f#+)wN8nPhzuMelM%?6%5N!GYHB3y;%){EJoNM*mm||!axGT_ zc&bZzxK~$5wL$LZogb@+ZDmcesRDgKY$1ppaRPkspqE|B<#iIXuh7dYmj;Q*uP~Gz zs7l+ML}J4}xyyP^=?YL3!#wrN^k?u*yps@R`_;<_v}|1tR&BQG9|lAuB-^i`c~;*J z8&U)q6A|P13}NRBpm1ST1190~_VbP9sg=|Ngo=Q%zkp+ha60;49f3hTAGe#JtXUNX z8g*aL#k4%LVlFvd0Fzx?wBl!oEfl9%>4AauE^@srkLO29{wN(Ij{;WBar? zZv9?W4D;vtORFWwzI)!|7fHJD2A3lfNxIqD8_UgibWDZEDBP+WVm&D&ig9Dr00lE z072idK$&k~T{+;{=s`9%k|hedIKJ2<1EInWI$l0{4(tItG0yf3T2Y*Td2av)Dp?i82_Ty&@-njV=Qk%IfNd2#M4zgd``NOtsfdw)`nD3{nI z&;QEf5xQdH@4EX`q60VOo*aD}h4W1bI-n?aG626>6~!YG+R}$IXS_4U`Z?R0ji}#v zT4gD->{ZQ;L>I61_UfSGC}H?&*5K~1`yM;*U8Er2KKk!7@RN@)*<$Q?^XUW51rzvi zKlt$lu8)(7Rq-|aem_1bu518T4q@%mQ9_IfTKB-F3PB$L%2G*th;1X~MW9k^h z2$~@X?70&~ns8)zcm3z6`3uJtVBJLqhz^OQ*XoM<2S}0I*yEOn069YFZBeGo(670w8#DUD_Vlh$2nb1L;04Q}e zB!-7DuzLyRMdX1xa|a4Sr%k{~i$KGZ0eO$$S2?Lpz7eY$3QuVBe(UPIV+w40oU|%YOpiGbM9n z9Xc$xZuYfMH0Q(a*d|!9R#ch!D*<^M5ejvy%#A^U(SY1Wm2#TkqexHeN{B}#IrN^TP$!CDA33`x zWah)K^DgFga7Q|+IKhsX>ze4#Zt^SV%2Ws}-d*Y?Z?g_wYXN%*-gxjQ6vrWB4jAbC zCPlX_yc38}u`_TOAjOWOf^|x>9Dc z^@?U)jB@=&rz&PMg)tCmmMb@o%^b+7$$l8v<8VPg-IBw-%#?Yvnrp_|kIpt`aCQY#I;hv~v+3h97yKc#R&+ z;l8eu&K^9>oO7rX@Mw?I_>pyz3ow&?+w*ADHj(B<^Tu7RQ*if=hd*~}To~F3K2LS8 zxyed0!~K=yzWV0Zlko7E{NHfr?Z>|f)X{0tX6+9UfsrykAP2;#l->vJkvOB9=YQuw z%*dMsY@qXX-6pZ`)AP46rJC0e^Vf*2-5xMli4g?&=Kud7AWysyAkeI@0$@mAUao0B@sItv`aeT7 z;$C~oPD8_SW|n{rJ9V>z>VlqjL>+z&V57NIJjF*#x}B%&7)s&F&ATEe{Qtw$IYu|4 zKx@0kOl_pL?M`jmwx+giyHmGQyPewY)V6Kg`f|>>_gnXGva<3cSu5H5eV=D5wP?^f zxVV%RL`tUymI%#~ujDtpgm6oOte353dz87>jv&ad95icGUrsJ3-Yt@3|QUS2u8wX zRL1Olxz)cYx229lCJSo{leEwIik(xes8Y8V@{3{0o5_$R^|4iW-OZ#M@LO}e88zq_ zuqJM}BTo7ufKRkVeI~;}5ZBO*cATpv<7KSj&1rAY^014h@f{)ICMpWwXO{Aes5s@j zqBr=w)3hIx@r-|5z8=ZdOMB+qlpcT4n97p{r%bCcOsS+Mj8(9`1shLnk)b9oa*-TEPL}JypBCYZ6xvbrV_+iYS%+@%5Ht{zjqyK#jzwA~SvQ3V8 zW7*}g`ln<7#1AAvQzXR_CeWw%*mi)-RupdbAy$S86)<+iq>y0!bc*><1}yXUWe~Sgj9|0wiPRCRPCo#ZBnp{ zCO*nDytfHxMxYddWwdM9D}#Tei?&7CjuzXzUW7LG07vq zj~a22uf@4i0aJ1W6Q1ZlU@cj2YI9d1c2M^VVNHZI%d3wh)m6HFj6UQo4V1EoR4E*3 zEK<7p+*bYdrYSwg|CB(oO~bwsNk4kB1i{eIn+}(0-`C_=-z2Od`C>h#zFaiwBGe$r z)_{3%=S*7d89y`SMUc%64VZj7fB5j3isK|Kt|91SQ_T zQ4n94`KfAgpEz9m(WQV?*v{%Zm7vzoP8>lRIe`$!hv{O7mvn+Pg0^;5*JD&?AI-n( z&dbuaGLDS+YH&wtFIlT52|P8F+k?tLtyhI6J^a@g<^>$!6k&NRPLx)HfMCm#uVA}Z zM=Q9ph)s3GA|dj<6r?bvBD4bKVnR%q>iHy}i!NJ|z%)UA7cPlxrrvot zs&9pjW2cr_W4dU;^55TE1=%IOSRW3)|0axEw@~!Q4m1uMv)uQpF?&Y=2#oIe}wMCdPoEIO_kBP7=;TF6%2d*Ix&v>3~ z1g1D|g{}fitW*c0=ktbg~+WC0#@1E04&H%=bDFukkLe#6kIzmFX& zVS-1&zHXRbFZ>@h&)r|Q;2nGn1&2$VZpeQd@VxBw=L`m6h|g5;={bLTW}V{+nj;#t zeZH(EFbMYh;tsXj2wOwq5rtq&JFoPA=b={!aC4`*AR5I2;JZ20`pa6W9SG zC~+@}=Qj?&A#Lgn#sI;dpCLI=1G|qTIPk_-z}lpbC>PTSa&ea5qKdnE+OQPTtRv=& z624p^_E9@`a37V88aN;uU~sh$V0S}e8a+##R2sz*s?ri%HVug|_#ANi>d8zq=j7u4 z8)erWHi7O1tUQtqn$h)kA@%{C&O=K)&#|vW$PPpj*jqo`A%D1(amtXNmXr6sITf90 zLeIE^K-D0IQBX|dLjJ)n_1Z#lUN&IEPGD%>oVw*z)`It{%>p#UV5p2Fl~E3*#0evubBw@H|1?y z5eXmxVE!tMl~5Kcs{B&@Ln9hE1cO3Epx5CIX;&Q=^?=saK!OGDDFWu2bquiAhUetr zDA@dXUVGm9Z&CYC-ZN9Ky2FfP;OH4X-9S0x<&v#!@Dv=6;IvJ)%k!fbcpmE)>0f$s zSVxpvl#zZN*uI{E z4&9h~-xS){1l#At{Ds=SJPGi{zpo*7pvGu)$Zx|_SeVJRuCYME4g2un z&YPqJsG%O1Al5nGj1#%Sg{9M@C(L#7a#I+K8CvvJ62J`d>Fb) zW8>v%`;|XK-7lWEdo!!a_$!Z}pLpvsfr86*hSPE2a4OZCm*ZDl$@MBNV9crIorrbK z=a03EyCp-PbLiQ7mh2#MLM711W_wypm@O;Wo-$#Id-W=Zu@KOxEz@i!%0p zG1yRO&=c-tQE@4)?My^2P)qnd;zFH+Ben;MV^bodETwW?BCw=xo${w^(ZZ-nr@WC& z_EtBHuuWL6l8tA74m5Iw_BDwA(!rN1@xcykR#eZ9p@#ANQMIiS|D{H&0%=(qDw(S7 zgZ{OU$n+H~MMkPqHFcbzd5MO48Z9!VZFF(^r_(!y)A%w+J)aXdMNOjo>HhZ_+!%Hj zn5(VJhp*&DX5dnkK8^BF*+Me1TLH`#?6!A99&TQLS3JhA?5I?3`Lx z@=({VBAU!+)Ut4)&;C`V1mDiVM{=WGqpnMsO|&a(B6;xo+n|1%{1C&R_5PRIrg+p|ywe$hEpBIkY4grzoDWPXcx@^9TruMk{X-www82QDn z4f}x|Hd^^P@UFybvN25_eHux4&GaWyI2p^lsxaAEVx)th7c=&>V##Ip-FSaRJXHdoN&Ut(9@gw?G=GX*Zs&`@zh$gd`MF! zj&BAA1bE`nweHos2|!fMuXU?w?pD8Ezj;azdA%}?z)SghuI)of`!~E_XuhY-YnA8G zSwT(BL7!7SwzxzLo$15JQ|{V`*Bgm05rdRTe=ozF>(cY%9y|Kl2Il6`9rxnD@xL{Q zT>7!{*ajp&&u2sZkGr`^AEN^zpZljcfbx*v&O72*Ne&RZbDLWCeIBvP)tT3IZ$)!C zziZxGiY(ufkM;Q-%g=N4l9t>2R&tPo@9X#U_Bi%-MUd?Ex@?zQwEp8QhwuHP-B{aec0TN(e}P?7SeJ>|7C~zHMEd^iSm$!u(r^ECJyZ zJge{2_&9z2MAUy3NcEnV8j>lzb+uLM^&KYRc*nXTu)UYZ0wO6nAMs&7pq8kDf@kaN`bFIPyL@ zys>SxsJ`~t*#!fbX<7YX$*A2(d2f1smtXuwP3W?eGd2NsV1qt)f|KM6jqC?ecq0MH zRNee$1+8B*_IU-r@UoPKJ1=DlM~>?fXB{|9{zjV?QMgHIT<_WQd>h?vn^b4nY+Z_A zrg1-1ifIjzk&D!R^a!;fhBqQ2R>aj_(+<)+;$1$wIQ%5m7@}7d^->x(;~c3}9d1+o zdyu)m&c=0B!o0!4)yra0s+5(RI;q!(pBHkq5_6c;sFbbUCii}$sVXtCc<$$CxsnGx zskNNSx10r(Gi*~QPyXungfCfca5mouIq(pnNM2s0?yb24t3Z3!NCVP{m0t$3y6qny zubx3CM)^ut>oq?;p5M&LVwe7K^q4gDxbq%7Z(1&@K#e)76rPuE{-Tfwg zx?@8fMEtYJWNpMmnYvxBHC}m7A6S2x!c>JJ%y-TAcV~_{7=TopW2%wOTe&Qd+brdP zYB_XjpZG?7fN|JQbi2Z9Rv}$kw!~7$sg&_&RDe~#TBYTeXW>W5Z~D1^ch&z>f2{W5_6hYaWU~ zZ2%t{f(}QzUy{^c^Ag zh;6c-ZA{|<46ob?!hrop@0K8Y#^1a0E@DpOujt3#h9bs_oacHu4ROZV0R}bUM&w}p zy~64BIIv-cEXNMc?n1t`B-u4v|KyMls=b)Pb+h@Esz|P02AoXD`zptru_~^~P8Ht~ z!Z5jT1}3~Cf(L>ucmp(gN@lmR&o8#^<;C&M3GlM}@Fcc2-YpY?)8aMa%qpOP6l01sG3vUR&6@9~rLFr>HNMuo7-$&q=zx7FQ$X4f^OjkBy=ku=rRYqcIQ z;0Pv8SPW4=>eY(p>D}HC)ZOhF)xQKRG(Iqf?sEDx2!~V$#ew19mMGAwF%}TUg@MDZ zRMU7GT%AA_8YcO#iW;sAOr8-KuxoJYNpe<+X~enKeHqCY&DNj6KaX|$1Z@c82|?tK z#DnLn0AO(vJ=^6#(h2Rug{HXIDqYVnItSPKN$$hsNxJvlrvo0|0SOktVwZG!S((cv zVEgCxo;EEVpHI6~KL`?K;1V@=vhwCVje0-z^>(+DbMY`b_?COm@JPnVp#iom>$H4n z*$9!C+)41+pGcXOc$-4t3tF+UgUFvZ6Z|UWyd0qI115hHHX@u#5La}d>_{J0BS2ko zfH#4qz~8ayE-%nWZzv1Oz+!#`P`@m?TM%K%8g*v$9=IU?&F;aRC`A()yFv4?`*z`r zNfd_;HHNL%=^b*X%pmis-0{2v4bhiDkrA%2pu`JlUfdUIchA?SzN)a*c2LoIAfMT$)*5Nl5m&C;HeRfSJX?oTqAUZ z21KJ3IMwHc60}<;8^pQf_@U1@1>Uob;j(473lyqUhhHwpq-&)(t+xNvP63N^q;Mg6 znNfht$DUID|3HGINEbTHuxNLbGkX_sZCH)%rTe2MeHc(x03is{L}IDUSBc*z12*9b zlrnocAya1p(LMBNuzh=og<55^(;_FLgF8P4P;dDjDdTRtTD$3vau`gcJiOz!EFf z`SitVcti`8gvPIwB;&q^P?PslVMKkmQIj@Fgng7wH2^ZcgnjlpiTgoPc$zpdLao6w7Qsf$P`MQTFOD&p6Cz~&v7}1Jk36hchK&#fa;-H> z)}^eO)Y0dTla&IutSrT*CkjEf7=O>D`k0T4srRv`$ zNSEpLHHxU(hzT%^nYd+%R4i+mBVb&Vvm7-`-ceu_F;zV_m48n}B9NIf$sCcO!1nLl z8gt?pbz$YN;wk8pE+mF(wU+w#_$;O#i7_iP9?v6RL(d#bga)(|bO|LkMSf)8uTd%^ zWLB{Y@nIU3C68L6#;?$>CT;rfNq0RU<)v|US=K=(^JgqX-nmboiN<>;)HGQ(SI=0Y zSsM2r|1mB90UI_EYE==nU?hk;J>X6)omYI!3T>e#4HF`KEPJTYAk$`S8b+RISduQ> zs@5OO{xt>jTJg{KwA&7~e~46i)}s>r*+Zfa3FYJcHgV9;DgRUNx`y^L&4r3tV69tT zK}%D-tXpI#)pf&8BA&Zq@0}j%?p14X>U#O%aozf*Vlvrslm;DCd$K*=+FgcE+DVjg z|5q64lgd+Po63}8LaRr;4vE2e&is$dMe^bKAkRTv-6DR1YVGAsV{JYFPpjB$EsSp2 z*=0`tD!K8~oy42t*W1yE#^^)l15_G{>iZ?v()+u4Wwtw9+flo8Y}p^#*C(p_tz4mf zX>5uCh9_exW12l@j_O3U@;TfxDlsA`&VXH}z z9S~8yJbKVT9vc=t5XOCEO=`Kf@G5k0vJtxng&SK0=>DyzJ9*--uS2CxqKR3JCU57m z6q4mt_P?J&#D5!<`roMr ze4k!cW*hAM#c)2DJR^x~A)|rQ*PmP9^aUlL&`s#_PiUsEk4*NmZmP3-UAOm-r=-i~ zKPFBd+9{>`-VU@8fRI^m)mB4O@a-1%M)uC21@VC z{G;_fK}eI`-hZjz_y1u;IdSd=yvto1hbRA>m_+Xw{B{-7)2&j~As(5XwsEQLYG1l| zV1w%Tvg!Kk%-bs+a0zaLCi9N@uLp`HH|;g zR7Na0b!3-`wZ?}KrT>Ft%#A@Gw{16rneqMd(H+peqksEm!07F#pXm8H)RsDw)<8An z2g80x@n`#4XMNz|S8TDy1Ta~-K%jsfV#1oL&6;F9eyG!+RW*xwag4yu?be`O?n3s+ z4_P?03`S01!h`1utvnNMGr~<9`$_s)6Yv}FseRg(tCWMFb_UYaffdWX65~7$pFNXq zYkh8FLF^=0t^Lhb{K%`VZEW(!!S%KBuar*ZqSaE)`QTfbVhj0Kb<^v9R{^gdJAg7L zYjP`Wc7;}5-nIGuM+6JitE+tpL1^+7r0Gv$&+u0R&SOKNPS)J0%k&>FkMCa2E_Fi9 zb6zD=U22JJB_y}T6$^u*-oUCd;P%aex!+6{yNEBvFu7;Fz?fpbT&uUdf{oL(1a4`DLCw|$G2Y3Ibo01^1 z5!9w1TSXGdiXlUPY;@);@-`RKj$bejNM6Qbm4-vz}55tDa#2xcOyAQFP zx7*cm^AAcZ2^VKRj(de^qlF1IvTyk04nr&wf@%XYLD?6*JM|>mm3ca&{boF2lV(Hl z{^pJ8`D)b#b9l8=x0GmiFfTsT3WaNie=C~JkC6dXj667fzE+|9+d-T5p+H35h$&2` zEZVFyS|~plJLT7J5heodc&U^+EElAQhATN4AhciV+D6U!d%;S$nL|Nn*=k{aLm=4MS|x@?7+BvYL;(WB{ZKn+v)8tZ*LFigbuZ)4 zB6!?NC~7ujolV5UH{y)Q!uZ&o?R~VE-up{K{Zz9g{Alx`@FGV_vj$34YCu16Vg$^& z+}c#%7O#3+0br@Zw23axvkT~jiIL%p(W;7-Dhq}fnzd!@+pq00;Z(Z8#(jW7f5B>a zfIKYZmivit`vN#zJ~)egl4>a6;Q5QCqLGHvR=J)Dcya0Vr1#O87o5MZ;ClT z!o^UB>tYUY4)!k}OoA#Sj*5yva)v%rQt8BCG&$YAj-YcgEsQLzI`XzKUTblZha@; z71Q4AeI0|1iXvSLA<`D4@Q}iWEQL6ehF)(mVw4i6h6%^KT08WdkMEa<)l)pBf9yT| zw*g9}ns*O}YxW9PF2pm7gM2gwrwud9!kwti`b0;jPH}Ajlcy}0b^E=i2f<8sesR%j z$w9QoVeoVf2Ms2`DN*zX_vH~wH85W#-|;D#K|aV9)eLy}P9L!2e3UhwW~9wKt-Zm? z%^5UlAzHN|#Ec=tYf*g5YIt-F!l37k801S(fj0jdQ*kvtp!|t9zE3}@1MfLx#{~xUFp5!)x=G~CdXax64)WjCsU0R zEuNvhf`fM~vOHe6xj*b8k#{0sJB|EIIJ zbqLXqH>P>ZC#>*;1R{wGt(@yo-G8tvM1odM;gi*Wrgkgz@>&71lh^$YuWN&UaO4JG z?!g=)mtvVW!ShoQ1q2iE&EByEdMpB+=Szss^8s%X{^uw5uiF|338IIlow9_#E7tSW;e$%YjhPapvsT50 z@p1hFk4LD28l2>wV7Yri9F#}~{Nk%N?DLtH5I;Oug8+m24&+b~Q_Ixmuqq7}s#3!! zybD&Ue}zD?WR5tw*@%%N3X&NL<_ZfhA4v@C9nSl&CGzeiP#TpWO;6n&bTFJ1f)AZ* z1Jwxd7P%6g7kBdk7uB#gD#@Nau@a0y&ZOab&G}ha-?Llq@JN*YnC=LnSM30Z9=|qc zV9$M5DfgIcJi#9~bMj_hKB!jzcMmBua?is$icjIa19PiF86yKq1eQ#Q9_3$W&naPw zE!sFE5cgy=2lE_g_zaE=5%Es41JeCwP#iX0ss@uxTK0(4X@<9VPy;?ZCCYrUWP^@e zFzucth<2wLOv2}WQWjN*8dsuaT~4*P&=I3UBzqtaZq7m^u(y31rfB^*W4VtUMWH|{ zaMv!w$faZN(FX%%WPxH3L70+>2Rxqq8)kg+$t9dz39TLk44)$=A<0LYOt#RHt!1Y2 zVWvR*u)zOyLy**>bmEW&%Z1(ZC#VQ4Yqr|=0A;YG6#!nW-QO#+((?RGqlEC+l%EAJ zbQ?zNc0GHK*L>_PD^2dS5lVI9SB!AYHvsmapof^kbQ;ClQWI*n6b~Z6EfFB9SDs<| z!lmDkolv_ppXL09%Oe^ZoHcW!{m9$n*97@6>iS|iL?r@v^u5>z=q+upEj7Ad8r*AZ zl7A_b2aPzHM)c7(kzM$>Xd&qFPqFk1!@qmjf9H_F-Z@QGKm;Jj8^DdJKh8`M9|h78 zG@?6z=euo`Vg(ZGabsp-NE7WL3x{vg=WK-;$M1$|>QrtwlHZQ81MM|gF*{o6p8tDL(3tBDS zkruD=1#6kwr?bpZo$Nr#!{`EaAE?KfEHrP58u!+bYyRdXAzobn6?|U&Br(PT)?6`n zHs5{&M7wXdC&|*~h+{FXj$8?4$u|wuX*MaBTe0sK)Sv`FvinH&?B}1=KTl`Kj<-#d z2V%5XN>5aa?ddX5Fz&jHnbFr0#ktOKd?V$kBc%{e-D&@RZJR+jk!!z?H06y#rDaO% zNbEGGVM?cz)GS)m%{5yo=zWZF*Dbt)?I8!Ox>qmGxBxpuE7qQ=xRnQ<5wX?P?l`0} zP9CkjCe!MYFQz{H4T;YX#lYe4_rC!5%R{<> ztdDojBr11M~CtE82&{G?PO=qEW$m8^1Cj5sjN!FY&v2qM7_~Q079U!A}`qQiJw3q0V^W zd<7zqJ(s1l(o|^+msfxznD=diPJZRQ zTRkub=;==o4|_`1l^FGtO2>k+?#?Jpv@N5P+UXR}oSQ zyFETB$7c?A(e9o3DY^g6!gxJTME;${%oWSOGR9i}?C^b+0eg`)-#i}Ep4ITaL~?vb zI~e|*wsN7in<8reF;V_cH_f ze|_w{GqYw&h=r_dG=I61w#Q!f3)w8zx8Ki+KfeAl_IyJVS1qiFl5V_H@#*SNur}ut zBf$NMJ;#p{^FcMOtatn&d4G zQ|LW;Jfhv&;=JdOt?LW)S+!D27$sGKE2;?~jUKaL zRiR2tEyRYZLVgkJ^OrD-hvY7TG72CxDuZ~L24Y7wO8FZ)`n$J>7-yOU?9G^R%>>y* zSG~T8Xgp~UwrLeyP}DK&Dn-g`5*m0w-$=S~b)m;bZI|S5NIkU zMA4G;s0>cyB+Q3iuIB;H5=8Zjf(9h*#yveEg=+%j~Bvi2kEJ$ zUhg}ZbM4T#d7n% zyH}(z8ypZL+yOy1>;sDg{}qKzK*Sjc_g#AJZ3Fx9f@g|@Y>&`Dt<$4-{7;Sh05yY(DL>VuG>zxyHg$~$Dk>Q9kW);=`RgElG zD*LUZC^_#rqK9Mx>*3AGGrMzdLICWZrAbxyXgIP%85i$&tffJ#G`+L1F>V2{Dd#%%N0nJ7Ypc4LogS@#} zeb^iofXaa$ipj(89hDTMj3tZT^1~J4oEva1kqV6%{RaK)_jU9Y{B?B2u>H`UaL1H-uBkE9=f1Utm%%%KZ0 znOSLMxCtoqWy%KA(Ynj|aKHDxD|gYHI0}?-sBFeCV*A&?@M#G^her(NR(IfxeXK>j zyL!-+h>dy9qB=p0NyIAIpDO_B;L z;o(1c?h-9q=xV?AmRy$_JoIYhm{?oqA*Gz(sNGx&0FEpKc#AXV6DLo`|8}nVXG|kWZCGd5< zXqL5j&k!=4x)nlalkoK6+ruA%npio?Aq)WiWuc0ta#pJS>i9gQ9BDs37OmbY*$x#8 zPBuS2mexOJCqDEZNrfpbCd9E3rpa+vh&d(`UO^4SDMM#>qz3@85LxahDe{zwLfN9i zxaiKe!DDoCrb_VyQjKe<{%LGH&UJo~X=^b?H2;Z{pcz|nyI0m?TJt+Dr4taraCr9Y zput`d;|IEcS^CE(1Vh8O7<2RIof?MxW(}1{@~BTZ!*5Y*sDX34B4s)%k_Tj?-MNGG zNC>sTNTvju7T2`qZ`7(06i9;935o&SRfEFbcm4dec8-MT4t)o8y(omkPHWeWPw-C>u_oJl(hTaiyXcxnBH_qp{JMVq{g4K!w&E!$^x)B*Wig3X) z$#rZoAD63>3VrmB#HMpgFl_=}44}pBYo7y4vmNLLDC(qh|b|Ic?JH8qJhvRAG$X8&;+!>Z3b? zCAD`_Z#W*cA_pE^?%e2Sy`Xrlo1BMykrL;s*Z0f?NCrF}f|ziKr%xLZ@a5sb9e7b> zsf43wwX7>_N<_;=;|PJ_F$cb&s9Tb4C$@kuwS;aWg1?^-lwkV6LF!HtiyO3?ymSqg^Ul&`sx5v_n5RsFI zO7_4-qZE2&7ec~2rKEG16;+g4dw>#Aly{c|50Wr@Qs~rG$cjb&_=;lrf@*PSX|5wq zVn!Sx;QhS#PN^^^VI^LrI()?l*QQf#WQK@Km>F3#XG!vM&a5QNv&{d}LQZdF`+Xn8 z?;}AjdnR~K8832zJT#jdfokgQ?F~lJ)h5{?NKsx-+K~6-f7}bXaNEQ7XA9r@eKCU! z36fUOqHf^&FG2cmAnqKXPeg*H7z>#(B!=wNoY=4ulb<|UNRlR)wpqTnqIh;TNkJ-E zN+q9sTixKR_M^(%F)yZB^l8m1&`dPh^oU+r9P#&AxR{nMCseOC6bqXE*>r-fzMvwO zq-WQtW>Q9o3{R3UY3M?v2}`eV#Fk=(m*S{NhR(20S|o|;l9O4O)|lWTxukA&+B9c* zttU%1{qYHsB82=PmXt>qBve&|!lz$pR(@smfN^^8&2s}k^nSb{ggUgJD6&%CjZw{d zM(qyLGX|=SmoL-rSQ6OgzM_|9s2=l5j)ZiXdhwR+nG=r~Wlf^W+rYP{<=96a$#Dp= zstY%2l%00!%r?u8Q`lx%V+8=ibI8Rq;Qc5RjmTvUdd`D)sbJ? zc(F7?4xKODl_8au+O!x}QrAYUV(nt!M0;9v4V}r&o^g3TrMHAlp1PGwG|7n$)E8K( zxTheVy9p9l*tZ8+w_5c3$)H$?Ph>&E_RMP7pwvawFKIp!pOw?`^Q+lYU6(gTKa{yk zr1YX*`f9UyX0T;as&SOM=PC71RMe_WJIS`#ms9O|i&m#8F)5Wz4@}t3`o4RxdiJ;T z@YA)e(=KEti%?5?$e?D4G3Cfm`bpmdcY33cr{NecE!E6B;p_bJZAEw|B>hZh@ZFye zL#VME-qVFPvorXyDz+D_L-q2yS(0WJ;NP&652aS%`erx-Jdz$uqOFReElA66^(c%L zxhWmE$>~-TtWWRQM~i-GF)LN1ZkODt{&a=yD{d)>$xzal4n?U`r&}#TbNLEx^Jz?{ z;+g%~Jah3!Wij;9;_um^)YaF2GBAE8)F9f(t`2QNA9*ktUm=z1Cn~OL_iB*Dl5%@e zx)FBWMK2U^D$AbDxhkt50r?28Lf`H-Qu}t5ps~q{PhbO$jXDX8g;=xKhsRHPm6XbR6Yk3-P7~7hSZ%VV3FEgr zn#=#m^A|hWH?8~0C8aIu5_lx%h=C2k5C7-Ga)aF<#Vow3vXT>wfvy1xo)l*RR`eU9rnsC%Uj@{{RPP49x&yNkXwO=Tt-!-pt->tz)W>^aNTLd)s zAY)ixosN@4Z<>eCNo)k3S^h)6(0fJ@N@i-qPHaNQqToF@5O5wa7AvID>3=U-=4n+F zD3lv?t%`wlx3&p1=!n`e?y@{rekxp)X2_9SG?iPhTOU6_W4XR{JcTihb^&y4)rNng zz(56+HgdOg7~w8ivs%eIL!-(J`ZSpXGvxrY=8`7UW?b25a^rhXyl8W`go>KQW7k!z zTd$f8rJr~)uch;A=T|i2&mO$`Kc~oawB*7p8k=`i+l*m#nZ-I4#9LKN{9LxODR{m} ze@nOPsVg3v!nJ=O4;F&H{fU^^Xaiq~p!oQRA_g*7PC}iN*7WqSS_khJlVs@Rp%+P2 zN7-hGg_AI2FK7(|C>v_p1HW+Kp)FW(t<2Z0xI{B~iFQbF-f4Jnc_!%T>2pJSyW7_D zRBH?wf7!Y@*TtDYFGct}vfCp<>*Vau3VEYcj`J_&Y*iB*J6uuM|d7vq=Bn!$cOmC&Zz9Ox>F&&8Y32SbnkJ+MiX2rEO@_5FFfwuJF>4~A4C{DQ;FzLTM(z-|pVoHZLU&j_5?}@|@$V1H zw#pJ_Hg^x!@ctGs1$W44WDB-bnYC0x0Zv>v*)*2%apfLLVBFU^S9pXeF@!k{glTh? z4YAqx=+}-zfBf>FIqW$(p*nv>JwL})9i?f$q2rAR1RI#U0r7p~a-9Ss9lXMffRHqw z6ZY4gdMpDs$Yh1sx1SK5dg%5`&W@qR+3-h4+*okz%)Vf*QLqPcaZ(16-qc|2vc!&l zyx9vE6J#g=%%GWAoqT`)wGey8Kn2bScjnQvei$e)dmf?dE93bbk43LGiZ;$Wv9E-UZoZ}p~U!zYn&TfdsszCkFChj1IX|pJ2%Vr z#XK)o%uL|`OebtoBS5zW245lWW*&4I>l)s-K4W+RKj+~7JCZCwH_=v>eI+x*Cp=u~ zv3U@4EM8(n|Mwb(Z(;qQB}?+P;zjyWByu36b%nEKtZxY&C%}Y z9+*oqooH!6rFQ(?6%A!>!eW+k%n?V%=|!RlYH@S7cZ zH;pR}ib&5X4x*lAy$gzl*Z4IK^i zeu8#=jCF5YTw#fk^fsLU20PQ9Z)zCwcpCb>9V5TqzCOQp2pFD_5uoFNu8&D`OC(*+ z0;8L?Nf;$MMvcJXPz%;GQ&KQXXI%NciBpT|0MQchWbc-*L+$tM3tp~GGb%>ZWV@~c z6|Iq40*WxNT7dTTV{Z4rQ%(0!>kiyj=Q}=s2X~mDd1$YvT#z4B(oS;Z8bZ*DnCOqc zj!Ho_^MdW#13N(R)e!#&>L&g<>aeB(dzSH*)lkAfgavEh)#t07`^_G1V3BbPn4!)L z2oUn=5~2c1)^tV6<9C;F?4Ngo<>cWqAJEirV+dnH2JnDLt&-r-_f1l$k7`Hu*r}(R ziLKAje&O~}fm=JE+a!4eCWqK8zIkZD3i(6^KU*z(kSlD*VAvQNVpR7}sonY|$j~eZ z9=uB#&~JY0F=N&sNSp}_WAZ;~4eLL-HzWO`O(LY4^@JKV#S629bDEUFjLlILHEhg| zW7L9AO4FoF?}r;;`8_s}MM7iiI1v$3bPnW{kx+Mv?g-opy)JU9%n~jUiTAf zO}M!|;2Q?uDria_U7D>S1NkzgmRzL#)hyW<@fxY1y@0B9LDKVl_&mAk?A}Yb0{*sK zve%FQ)~&oDqkeNcARYy`XrSVgM%n%u731VCe9ERK#-u!bj$b8R5a(p`D@$JPvhRtP{dm&-(I)Cs99q5u|i~c z=kz5gC7c=0Q10@kN{A$b(xg#iJy;*dE`QPhC2~(E&8o2@N<>wOh$Sdg5IzX#svAdj z#5pzP0RJFYa9yH&_gy-IZy7md(?Mu4uh_rKHL+V>2B$K?1@zu#0qRszg}@ z#3T7u<#-21D+qhYsj%3n@P-v91!HxB-Kz4<`Gaxh0Uiph1za$&9&5Lb@>>Wq_XR99 zgt;MRKnCf#Jo>bC1HUIKBp7NP46%)P0-@rjiR5C0#j?2Zs4uKEMkK3Q15>X})X|s2 z&KHXWO7$4pK;D`N;c*~GhM-Il#b~~O@23_s)3CE;Zme+4oM2QrC!xBnCzZBC1xg{--%Kb$>dt2MMzb1;#?^OwfpW+9Kd?U20U3^cou#6W`7rLbTLLa^fm+wPh$;IyRdGUk`I2o;PRnWXMs` zCAEv`$bO8}%p448RiSqr{;(^Gx@R4p$|k`J}P6b;?yVX$^T>PErZ(Z z*Qj5h6e~_C?oKIM+}+*X-Q5XN+@0d?6fZ78iWA(mxCD1Sd7i!Bv)?&$zT6+~WF|A2 zUNZn4hjI-B-%EMCJpNj6= z^C3zYtigxWG?gn{!=&kS^4g|PCRu4V{^wHG0@^2EZFL-L7o*bmzXp_k!|ci*c*_YW zKIO|OQML^cti$UG|Icny?tjoj{MRr4#?B#R`zz{Wfx-p|BQdqM#_sy7%;Up3sK^h+ zergoZd3AmXrn$a>gsnbC&B^{p4SnpDrm^{7XW2^{`M(ds|3BZ~|5u7Z!bx%^4vY)* z$L*)uiTaA4mUE~>oPBFpv4?+2BX0SUOzU~1O-h%J>!0lT29;MWGg=X?$u`sfcav!*jRdwd4s82vtDJyeFLu>God{j^F_(B*IYkFldKGx7=3zB+hqgn=Tz`OH8X@Url-C*!K)heZOBnkK~OS)EqtfLU5J8^EK@ekSb!1EQvgo2WgVG3Bhb+&$^21trd9 zW~>rKm7IR=;q{VC-$hyW_m=;u&uDqv8BY01$;%0!vXh79-kXP>`U)aX#GYnvNPZ~0 zaZ+3-s;AJn#)AtX+uH>`3i4haB_0;B@5y>R8K^iil&;EQ&W^;in{`xaxeeJ2Zc9yS)5Zt3S1Xv~F;j>-Q(~ zKz>M6uCx*CoXfyr+_>$k2K%AyK|`DiJ%{N|$NZYqP#QKe{P*sExG#QB1g&2w3!y2K z@KQ$yPn>(*9K?%Qg_@H>K_19i{U1B}BmHUyg>fzxLdW)lR|&+1&%^To_8t^&Pi)0l z0;ewzUnD|^QZ=#;Hu?7vr_82;HoSi9wD3^w;LVNUWw<-29ix1&6xXUzfaN1@^@C1v z#S;r5+m$g-O{!cUrog=_s0k)9puqFk(Q*u)AP)-Ix!{g*@(FhG?mYd9^91WGLY|;N z^URnWIAJBxttUZ;Ey}7PLWVb3u@SLg6}RmL)iD<4#sP9J@3WgC>*HC7(&nN-A;(U%B+RBcOr~c1x0+Ig20EH$0;1S< zGr<<}Ao>N|)_tpbokjX=c!F$vNFy7i3%8cMFBdN}IiVcJEr26M9?JFDV2qpl8qL9Sk^;qmO-tz zf^G977RY7u`;#c9(NE16L~0Ylo!N$fd4$|h0b4lurPF{HVjN@1;G1w_>Iro~_|*`J z?q=zeidvKKjg&aPZ|{x*8z<*fqG%l$NTt9}P}mjuAhK(V^Y}YqQw(-^{L|oP>2>+uvPEJqU9J=A~xx2CBD&cP(~s@fIpm?JW47@5K9CcasjEr37gUjIY<^YnU~NwBkbxeYbkw@k_mtNdX0 z^9nhN9rjy3S`A047IREdqbQd>kJ*^`4+>=%Gm<1>cvR#sejUEZ$!CNWa$!haVjsYN zJej)1o0ZFES~u~U{2Qsczu3+bLKl4U34vznc_vUmReW6j6y6WpvW?KeWZKpwt+R1AgGe~p~! z#;v2;DPT>4i4W}qJ`Q|T>v=f)Xs714-{lGm4m$X>b;v?*fqQNI@t0r7q!b1`ujE5Z&kMoE={W`Z zO}}U^m%F#I%WPuw(8d0<QHMjm!VLK_qP24qihX?X4=2atpRZ6|tb-Gs;Fc%hv88`sO>BfG2+%5-<|B z;G&l2Nd!h9iM{Nc5cxenQ3b`K3FqO}dKmUuu@p!tflD@OK)GMDT32T|xMi_3w zH~+>6m1>mECel$z!%v$wlIq&5cd`3)Q#!V1g;MTO$9dEQ%a!KO%tyw$tCsQhu>>>0 zk3KfYM5bOmZF9CJ7;QcrI*CK9aM#>7{u(Lzmscy-?E}Par+Ht+>Kki}UO^ z`(X+PKf~p4XN?2`o-g5B359v?q0Nq7s=t^*NGRpcw-I4_DI~l^2K?YmY91MdUNx5c^N$3S*%vEv2uOQun zrP34n0hSPh#N>v!+6U{U9=AQYY=>j?vub_DkFniAaYs}CF6N|yobR}hl};F>AU#b) zGGVV7Z~OO3K4-28$Vxm>sA6`!Xqv!;apZ`gtH{=(ohJ)% z9Qrn!!P!~ATHSfdAZrv$TC8F5^)I+Y z#OiBb2xK5nf-o*J>{R{wMjQH7l;TKo_?$EY8Auc}<2r8F#pg3x!W#b*!Ag;Vb}?5$CU4mc zs!;*HNFo>Q9f1 z>UBo|sHb^E+hU56!8?a&9T;&>hY4nM9b}N08FHAa9wSd3oM}YaUqVM7yPZ$yVrb-wM=Sh zC=@8E>qNzD$%8(>g%+?Rvco99peVti*o^a^ap`${QczGpM6XnITXU@Y`5V0m$f$Wl z%3I^)g4{=j7Q{YuXqN}I9`*&L>oD)^?;{MC9%$MsZGH@D_L1N)+u+7mes`5ftz5D1 zjTE}WY_*m5{b!P#=|YwH$_7VNC_@z0Z|+_3;1@jkfo%u_<;YKyKpv(E_Qfr2wuvGU z0++fAGE+!I=3{NdmM=xTl1O=l*!@arC1wv%R-`U@T4v*98mnfQM;p>DzI}oxI)f1G zoa!Cd-E>wvH8y_Z-B?a3OG?m@1S!Fy^4vwbVKj!OjlYegDH?njB0s36EPR$(psaSP zUnwWd8oSLjI7e=lNtEb#Q%D@k_9-&Zw8amDNc3+yZwpzFqG>xdw?mD_NMh*m^`v?l z;lA(b>9#S?`U}mmp>xT(@_Dy}cPmy{a{79D+e!XY=ieW@h6GOY=fPF(MmT%{Jqn^5 z9wYY_MK!F%H@@GH7NL@r^N445*L6Qd)_v2)f^d0?tPD!ZRihv@Vy@99RgjtQzg3 zAA{XbrXv)cMr_S%40~pUqM=-6c06B=Vzc>rM7L;dN9WF~J#%(Cm!xv2wgb?beXvdp zwLI^sq`c~-6J18+-5Yl;CWf zcr5+t&g4ir65FmI^EP445>|0kXQiW@<-S^CcW`7>V*H}y=w9EwR(`ZMox%!orF!ZS zdm=%FKlEsKgXMZlYN%S=^QRHiRlHwv^Y2oY#eb@nomvsiRJ(8BwuIZi^Q(_&$qN& zd4glLkviux`dpfIm3zB|D3DmXyoIazR}MEhxGsU?xuUOe2a7_o#}FGz%dAaR4Cj1O z@tlqQt#!$-n}=-hIc5sZa0_I-uV@xqqDNmKqpSNh{jeA3vy|$U@5Gz#l!YEcYVPEW z@CoYBYI9-=B%vENXcAVh1CY!SBBDJ(G5^+7-I09jVe)mL6r}lee(~OR<^8`13B`gp zp2(yZc0y{nec~oQNtN54=a*+I-{!RgQ1PZOFS~^&&X{2;&z|ShdDofi4CwjgXz>x0 z560c}e?%C8D-L%A?Y{V`@Lgh@A9pjE%e+OG0z0aPN&>Iqi?5%KG8|2H0%CrH{ho#o z7XMt?me$sTAr!)Lr}sx9EfZd<`7|5mXqo=jSMfw1&D(H2*T_#WYk4P}iJ<%XrEbdq z!?`eyu|Jyy^w9n?eY{w@yS{5d13{Y1lIhWoJq$r;C(mck@I!(O_dV-*07C)3^SA7H zq8=ua4h+MJcHkkIPCv0Cud8Q&J*7N#a9W$#J*mW=X7XCrakW}7*9)=;o^s; zLjYTEsryYqKFP13#6 zSFRqn&pvA(GIWp$B2zg{oHz8oK1uwI?~>e&^3vNMrn&*vq8uMkYcF-B5M>c8hxWG{ z0y^VXLz^3vZgkvZvwib`LQ*Rp@A%q>`%jo-o*hD)$?c%^gS=S}j1$qM&{|E;4!*s| zD>=m67c7&|fEvTSHkBc?JpU1&jrhgzPxJGQ=U;{d?6SynsfS7gb5#c1tjol(-|-7u z-!W98^UnXA23+1KMqWw%Otm@{q)42PCwdp5Y!`jS0zShg-5Kb09-JJAv0A7&;`KZ` zuO7?aDvxAm7n!;H9%|2|3AWglr4YA0`_{hiUYEt)tCoSi>{qGm+evo7THTAPCRr^z zK9*nS-F1C$oHA7oyK7Sn%BnZ+=N3@y<9k}DR!jK86F^#}fNM0dL6p&lKfn0a{82MKi8EPG3K zq38G$CeTM_cltWDc^E;4RXP$3nQDohRNsS&EfWvos41{DL`CA%u27ny+;4Q%n|%Bs zOxWKokhEW<9AnW;Z#fH9;CZs3OdF=mJfF!?=gP|4XDfb^KF}rdkSqOeFp_$mo+~nZ zIj7Be$|9s(YchF6ti(_^?f^HrEUl_UCZ};9_txgyu8MUErI!^?ltN3zOf#L*q(G}y z9BscbY@c(?FxFRtuNB_Eju@ntvJ-EJKHL`z;oJuR+ln#X0qFN<)NGXR$5$7dJve~)D zR%}%Hevz+gqZV{S+zjU;RWX#iQop5$n8jEzCA!%1Q4I?-6v(nh$Ve1Pf!9oj`JSun z*i0%7=Vq9@B@&jt@wo#;sZLZxDGymcFzNPPas4Q>KxO~JYyTNy5Wwnj;NE=k@-se^ zqu~m04@{tdZW%&cf9vVpMx$rmkEK$7X_6s>%VI)mnGN+@f&$P-n=!;B?}!#RSVM%2 z@p~_XX7X!h02xwR9dV~?etO>Z=cJ{hZkdRSXDuA$95;JSp|viY8gO`Xip$XtjT)z5 z?Cj;_H30JEy?C~B^6Hl=`C7i0gb==7*VgZJEiiOI!^O80^frgw@ijki)95>-1tR_q zb?bL%zMw$R*iMLnXN+kGhH?ByxDdoRv(P}(xbnp)*PJ-0inxePl(M71SMR8GS4ee$ zVU-<1jRIPT4Psb`|7l(pvyOwnvGDqu9yt*j(9D_s!vA;Ar$!)5)dYOcW@vdhh-V&X zaR(grcw2lwe-C?B>>ZMc&! ze~LblHz;oQ)&G?6OzCGgDX3ed_gs`CUEKD2f3ackB#9^=anQ(a@8lT)VG?}9Pviy` z!8JF0zaZv5AZbh)P3IdfYF21i`3u{dk6K~(sCVCRIxnq;%!O+AB-(96S#+x&8eMz` z7l)2Cad7Trf>IJC7X6(}4;dV_Ra5Q<7_z;qg711m>SrmA&{JGM3XV zefWi)@rga9N*a(QDWslWo3y$2pk)3~A|jAPC;<*ZiMx%c8^rlqj^&mw#Q%A9cCb6@nX~ASwf9 z;{{=7nZOG{M~@hvEx0B*M<0S$5Mz}c%oO9>qG0=jjzDEpJk`14U()+)CngwIzAC?a z&;>)G3a=J1X42DI3IPTU@vp&aYY0&=S@=Zxu`!C}p?~^Tea;qmL!cAL#a}~NC|oAf zc)LFwrMiws4o!eb7*5#5)Y6Y+*&AY25XRDVqXDS?`?0G`H%9Usj0>lS$6ehRhqj!? z0t-s|#CZKW@GaUu1DUaPT;t{9RW=*5H@pv;a%qwpC4g_c#1prVfaT`7`Z-$v^gItZ z7!dW`e|VQC6ELEy#`aO`4(-zA;M+K{AR!?ZFR*;*T;0*S8?L>(T`Wu?#cbZ`kdW(T z)s}E(xsGSp6yEXD0tA~iFCS8MW`69YP`9+!^qS6XN@jJ{x&v-0dIdm3RKkR^w8;9q3-WLbT+WY47+v0wT<~RVPK_u3-fKRw4xZ#I|$xztNj^>s1_0P8dbFk%svc^*vK7m-#!+yTbY^ zrywGCba4cy+wcWHC|QsKaPsHBVp8j(->rmyvXYUjm1ZncAf(5fipf5@+mlfKrWv^`l~mKp!T2 z58>4~J)a^}iy=~{Q66rxviP(@j4<|Y_7dM5NtJwFw&_^7B@&kZvovl_K|a;d_NNdk zRl4u^RK={;YBnfymF_p~{-0eDeO^B5MTK~E6*NSu9DPX~vrxw;IXZzrzN{FcCatod z{P>P%KgdF;(U@F+)Ms8?>ZO?1gy@os!&3%~+H&yeFW>6DkP?+5476Y;EI#~Xz%~#r z6$z2DbV*2|=fi7uK^>7x^IzT4;!JRKQ!l=|cMAz9i-Y~xrBhLu0IIT#3v;Cpr&qxk z@usUi%esNXQOj&;ZR-?@bC=n-`JSSQi@ai`7KI>g^8HDD4vEU_Xk4CXOt`e$Je#wTs&W|qDr&Z0-x<0;jZ9jXB{6}=u3T{GyB*zBN{>r{_QJf=7Rr;^2 zIevx;9@U1S%C7#^a$fR6G#L>U(^a+Z(q8!4aEy*+`9@)LmihwQ#HJ}y#;DGk3q2x< zdFh5jq105mloAL2w^4i)J;pM^>@w+=Rvr0iV);WQ52b?H#j;8Hh+pOG)5Qgf<|?BI z2d-2Mf|yee%Tu?RccyYevt{~H6o%#GAm{NUG}~PkXsV>0>z_S7!a1i~%e!ZXzpMWvB%)dD**9^` zvG`(y>}crn8G9;4w)0<t~*xQ}Gpd#8Gd3BNgia;3-_K2QE4Q?22k5Jd=&UEUl); z$LunuGOToUs-iz9a@?Ykj$%Al?jLaeC=jJsKSJ4?WmJ6bfh`xw#Qz*q&s+UI}E$7 zH~7Kyx;DID`!a$>y?o;-UDuWUEuciO!P<^Pf2wR0uHkF*@9SUu*hHxyu@k`-Z_iV4pXmZorTgdFTu|cX&m(63YASeq2nwtNYL)vnGg(f zeD1r_+2cA6KIemb(|X=`e_gU9dGiP4+&-hlKVG!n=XJfm@OQnRzTTeA?02HYKi|4< zUhhAn)q1|))^1k4Z{+m%ki3LV)oyOS)(B<^+O39d0N(0dbICWsvzg~J=l(t1fY+y2 z&#XmHZL4d|!$q){)mxWGwV?0&>r*3&|HJz04lxyAN}=Ex{C?39Z?F@25&qiteE)h9 zpL1XQpl`_0^cXXKetvh$Z!ggEysY2u8tXaqvT%7Hzx?uQ|7Im95b_T~Qs{*aiUzB$ zjjgEu558^nKbMy_2FQvR{x1mH>4eYnzc(STDhmRhv)#tK&+i_Z3CsVk(Go~ z)-B4l?DaYZTQ2OX+F4_Jg`?7J`qirHdWHu1X-xUE1XrAyRvsLWk-w%-hVORiiB0by zzFh36(9ThJbw*7{e4H6qeom`dN8e57RJLm3@~}Xy+Nl2N;f!b`j7i$P4C}3?*7FGh zhiQ7e7tl8}EF3hYQWrhqF#hWzAljzZYsIR1K2!t^*Y9r7+#Lfb3Z2f6x9AAJv;*GD z%Q-gI8R|1mmupU)C~|oo7sXGZ{85R_SLs(NA@){OeY^W8oIRD#)+_eQwJkrpF6U)k zrzpg@Cq$z?+m?$JT*1Ixx`vB&D=zXYwzLV%T> z>?lA2676+`8pqFq^`nX`I95<>dokd6X5W+Ri#q!d%2OioLEFfE&e_HKdOn7Gr*@UecYS3E4XgQ4KFQs(ARYgl-?j=Q>U3#`o{*DQ;sq@G#_@`Hdl3Im zxg$D2Ah1KEcPDU&KuKcCZhG76;B%W7c7+(i{%kt)3fQSbKf(-&{>ZQ+H+-I2`?V_~ z^pzgbp(aH#vzInc7P#F+o;gDC8A+g$P_E14qpvT7H8DZ(1A-h_Qi$h72oZ)a8UgnB zWH4BydV=RyDNd0JS)=WIa(d)tRMZibVih=tT2Xswpl}|o?n7nXvOv_^O+HiP z-6ARS#n&c%}&ftMOpY9@5OwD*KHJHH7wLd-qotfsa{V1NF$^!kHq- zg~ONkL~^5e^W-b?sj_p<>ednKu}Mm@PCgBU2taI+wDmQ@@mc;+{PM}M1033m6=s1gc zmx7Ph4Lg0nDfa8}k zXN_p=5s*axldPJZowt4CMPQMP+GeM~J@V!zoNoY(oR`+VB_~u+&U?(fsyr2E4=+x+ zG)_oUD8neS<05hxFf~@QSzrC)M`a=y4TK$?XRLHn`Dyhz;8?V6gW8Fx&xj|S4Of+$ z=A7vw%QkoEIjbrto&}rp$1*8aqAA<%BUuSgh^AV_>!H%Wb(&nNg7(t zJg36HDATlM$;#Q<_8AyX=CgAZa+qHxH~sj8!n!H(5P=S?Kv@XP*3RZvhzCy692gf| zHAG|~)C_mBEC#Efn-V}4tv3GQ6WEnD^XcY?@ZXSo-9KOc;G=wj7l+Z4q4cE7A@=4_Jw zGenl-O0v%veGd2e313~S`M8#SQEP|7G6ECiK2ikBdvZmn0FY_04G2}66C^Wsx_UZd zU5ljWC37(6M%JS`;(vTh;XMARMdU%hK%D!2!AXCWII7^tnhk7vhhqZxg(g$5P2SyI z0A9}D;oq)Kv7y^OIp>K_zN(czWbtp zw%I$pwKM#;Hxc-e2BlaY@WXPGzyIen>T4F(1H%T*r!7ij`?>S|HAi3_Add5W2QOgR zCz1{3x1mAL08_1klb=(R={odHJAXDY7&r(uDAo20^Kkr0e2EPionG6nXXB6I+n(Wt z2LK0kv^8>ZX~%iU0-ijj*)ZS%)zQE~v`jE)jD)=ODaumr!A8F{{hu;&t-!O$cwHx#Kdc#mqqLuwm)0k$d8PFaP+k}nakrwG&U?S#s$ z`W)&SwK}yFlD;`(yNQvK2od&&Od7O5M3(~n?4(4S1)Hi0VIj&BcsaJ zBfbd}MSl7~X##QSAXoYb(+x>|MHh)gB8)~aXTc}9k%SG^Ze{R+*&z+86HT4fQD~>V zl86yo6Nm39wtE0v> zD)y3-JB}z-p%;=Jz;r|A@IqYcBO4VZe>+QjUi=3DW3HabD8}uETf?=+BTBEU93RvG z>#l(FJSjwL$Y3n4KmHJWq2#DKr%Mt-nmiImd%z>6YsTujfoB9sb)Li**;Z2%6<5k* zBg-67RODhBb%>v@5%Zp&R)Hk9M2Qu0o$Bw$=pvG^hX_N?E-mZ<4qFKoqzcdg!%@H04m6^@v>@6eA~4ii`ih1yD(6Fe_uHto4F*p+Kpjqyw>0C%yY#T6R1*X{dwD0m=FJ0Dw0%Gg8 zI@e1st$u8KNhnbQX!vr&0MU*RdJqeFIu``3Ueu^E%oXJqeBnLZ<9GHHcRx6?v{q|+`Wo9 zX87EbxCv$j(3Y5v%GQ)pD#<8T$^+8h!gy9}Tc!$f<;z1%pK$1W7xyjy;tY6d(5oX` zMT;wn$D8xFS6kYCmw?uB;%wJ+bs!1&eweV@at)V?X!|0UFPt06kg9E|Zl1gFwJ%FP7j ze*z8dpSp9>H%us+5W09Z&f3}yFr3c0QmTGdL)PUTx_E=Cy2qgY^-{;D67#O8Y^KHJ zo^y|10x(IxZ`*SW&0o5^+lBH>n_H6$4Om}l%{*zIe;>`R>j&N+>3GCk;Vysk8DZ&J zb;J{8S0HS>b(kSY?bY-!Ti36y9Q8}Yxu&Xh?hsY~<;~k|lRH;6!S#L@SBQ3S$v=_q z+FYgHmHTbZVF$%Nz*g1al(FU+@J#f0Ii&+vV&5Zq^%}MFw95AIU|m#1GSj@0%AGmB zIg)*9M0_WywLS^<6Yy8_d7yjp65LESyG^geYIczavtnaDX3H<~UYyN7`7{ta^`C%9 zK8)(X#d6&4b{1Bgw`E(W2aNP(}E>L&&t9c)^B>ZdX}9 zYPJP|Ul1(}as24Wcf#pNWO%C-nFueK^6yp5Kiwk^u37|d4rZ;U!bWVA&71xdv81UO zR0xWdq=c+nC{fi?riK;MMwFRIi3MLYIv&a4D?m_-Vj4m7pMpuHg~`45B#OwwLQu&K za0nd)Kk~%PhESy7^Otxvh#NF)SgIhV){c`X7OdO#nlzH*x)hFI>P#ESE;o1$gX-P- zcaX{PMlh@<6XG7XP$gM1Vzzc1rP>(V9LR`!e*#}G*OV61E0aPd_JuvU27dVCqevd! za+ke;g?r?~1$R3w6F-$a=o*O4Xy47F#jl3r0zekdg)4`30IXCMa{TK?H0NRp)Gsr`?USN_nK0PRsvy6mqt!|mQc0U zkl&0%k$P#I=akLd^f79A*4z#>C{c~5C^v~jdX=TvfyrSujgNA@PH@i+Hdjk0^**^0 zw%&};p$g?E;i?W(`M@aRibX~KG(k5L_T8M-N)3<%nM~D|3=fqI7om@)yB|l@dzP?i ztmN)N8eS{P;g^zJ*p~bk^#-r>^+=ug?)t^BRh)3mt0wo8i^mV;sG1q5aD?&9Fb0=I z&R#D`t1Q7{%z;j{!FGI+37o|b~5P7majuol4r6k900qVIOj?JQZKDcXa_ zpPv%NkSvlBD^A-nrMprJ81~dfd@6ph6dGQ*qE=3%J-z*l$3X|Y5kXd+2+Rs-?#w#t zTrJ1>o7`b1Yabftk^6y$+tJj@-z>L_jRuqG%>D{^VR4^2&k%B8VKNd01YBZnzFy#O z8=+d4!Pko+toqg(e-f+nqSRToPIGc=iq!<=ZI|V38Xepc_}wq&Ik|WQ@9f~fI-~x0 zfw1MXxdb@Lh)Z3#?CV{lq2U zd6sO5HB5zWj;5k1I8ABQ`pTO zzjw}42k_3#ICRy-aNGJ&mf?mFz~(^jeCz$S=LPh@1OTAMgQ7DYzfJ1F;A1WM+!4LK zrT6q7DUxfB^d4~Zdpis)6cF3P6b%W57+{6#))w$?lyv6q{7`rma|~MD3l7hJDI?*k zbzo9300ZrP+EZ~UooJa6nDgvR?@zN|*|#4z1A51Bn4HQRxAo3hL{P6oQPfZKzEl+fXBG}){Bb<5lg{pD&w1vM)yw_FB6Ogc3o8Y z&SZxzf49tVzI1%tR)dBciZmmy|$-MFaPi-w@4J(V|BJyK?-W z((u7cU_`|!|7%6OgTJ(HN8TJfr(6#ZW0xk3)Kde|2RPRwU0pj4* z?XU^_z~mq|dVCdgWZ9oEeimpSE}AzC7-$flXi08HZha8<82mp7XQvCuSaL}gWT=-A z=iH1P@DSbI|2`B{X)RWidcb=?KWsZnmb+mW$bvKt-YZvf&NsjR10VQsna(GYTE5}q zgWNS3r^FLi%>;Xrh)NAl)P4^eB!!#km2${0YosDfMi4qi5(cyiN`@laV%^?)$mkRP zZfI8^wUwAJgg>chrH7TlKpd{2uXGA+Wm3!{*tMr@}yPyMVO zwZ}Uy;rBjfOWA<8`^j8=_H1hlN)SUyJErVncDc0iquZ)}G2Ty|2|~|gqAy(p#tcZLevW zasIUZ4KX}=LPuqL5yjm$)SDL6n^*!X=?Q9kD46_ytcMw>rQ!Ty2^QHHj$oh@P$@#mBgBb7zK*3Xr32{?C(j{j@pxJ^ zlt8E&*XSh+xsIJlGp-UR1tCFv^CFQ zTb)~|cn`8+X#^ipn=~LwwF?7Cy84%O2RtdOE;9x$>oUJsIzn*-`35)P7b+DJnbzT_ z5J1CXI|RFB8Iwpn<$Q?q&h$_So-UK;%$~)3`N>yU&-HSXtfKPOu+oH?cv@i4nVY0Q zYqS@yOt3@{f^$X|B8TO&ZY2zeiw*%0NsVz&5GTFizKVwDhcD)$CYF#8%i+KRSiEu= z&Az&S*JW?jQwT^m%U6YThlZ`^hc7!t3Gu{l^kJ$r>sX*H4X414@@N#Rc8NQr?*~$REhq2s^g{M%v$kg4 z?vjiL__93y$S!Uy%QiK%a}YAXz=Ihjw5UX0VCR{j4^m0riU!M+Dj)DsBV?OKB7=Sw zu3A@|K8onm+a=}KtrFyab>&Yuar}Gc zKDg=vR;M71I=k!0?;=sDCz4HE9--3M$Zxr^3RNi!b7&46Px=4_lNp)53{TPS%VyKy zJr811#mVXubEZXCj%(LS;>Af!J2*m}%~B-NRQw`Sr=gDiG!AE)Qts#t2jM3YtKjsb zvgPvo25J2Y6t0a|qYt$ys#q9q#;d`hts)=_Xc`DG7`Hs0?op%udG9+c{VH{=M3?iI zZ*gwtojWIgEfp7QPED5k*e=wRxnNR8P!>0K7vq}n)j*Zs<%>1A`2<-E>(K4FJXI#; z9@AyclrGbeYklyfMG`sgxKeM~>4`n?4CNQ&zS|$ymE$kR&G=vDwh3>4Pe57MCq!YP zd@e>dED4J)i?K%-FCmx7dQHI$)t%Vc=&Rd>B?hb81*4}*8K48)uhdER%%q=xoSebig)zEAAU0mM*NotVd z_}q#|-E*!z7N&5UGzm8PQ4fx4^g0EqR*ctR7{~f6!X53V{PFOhO=%ieY`JEvMfwxF ziEfx(I)nVf&_~%1PG|#$F7W>nWS+j8psN>QX$fFDy_!V`r^1Rg-{rUj;alHGq7O>T z;9@rVOTD~Ea8$ia{%P%?G{+_>vV-(T2R%Tv7x@!t{}!?5O>d{RcV!8XDJYuTqqd(% z+EWzoS9Y2C2&xrO&D)$A>Yjaw-vcP_bQZ+>d!_^2$Dcyb1fLP!k0Ica|Lny+2PQ+S zMQ^e%Xqm?Td+7=M&xVaVUP&;l@_+XM@&Deht_k{IVlwI<#R!pe@w0<2L1Q32uBT>c z%$ql2eTH-`#`m^IwV&ON*Mk+~>+!C%-=9R1PEX!xBN3!h(f@(p6fyk+HADw+1a`EE zRB4NsE%uuTNH*(eKNyWt(sjlID#x7*fd5 zV5yC&kMGOERDDI}wNF9XLmRapsWNDcv!adT7;0CcE1Y&9Cy*yi|5l4eu0KvwuEF)C z29@5c7A@ST^|!lnFsn(GzQjx%LC_L)|B9e2S_T_8GkV%BBabxRm34h^vsLRy(q5O^RYs z?L8`l^iSNa0M;Qq6sgy;D$!C%sUndc+Z>@&s>Op|ftXhtfv>>7HFeGT&Zs%FNqY$Ez0+y1umOj~Fc-pCkG~Pl1V$k(Yd$ z>r~>CU%@UI?e%fa;d8xb-G|pB#AjPk>a6~wO94Lvn!lH{Q6)%y0e5WK!h!iho&iy< zn<(L{u}-9LwS%$rMCP@dk|{d{ylj0A_2qU85J;+|C48MvvCkm1g2H&Y>WI%eV-yS1 z9qMN9A!489G|=Ujs`f5_B4uAB?kO?nN|(S4qu?Z(;x^)tF~7jzc7*|SXWbBL?KN^Z zO~E>~3{#EJWq`6Qcb zeSPTck{I>QaC_GZKG6wx&;$cKoswT3h&385xD`Hs3`BH?wA2B*e& z%{oS4UzfQ%iE&sTSL{D^V@eC^3-8Lp7VnXZIG|M@pu*fB<>=?R`Utf_Mg@B;gZPky zT;GAms0F%k%cla`+dC_ga9$o<6lz@egC^mhlG-BjH%*C%TjTPtCW3|z%3+GAkR&Vy zlFznVrct9VhMWbr<`a#6r15lZ@4gF}o*nrim+SYGLeY=tE-wcR-pX-+L0=`S+juIMK{rkJM`=D*?Q}yYr0MO?&e$NHmTfMuj;Xc#2M9yctZzTi2n+`D+BA z`?|(16v5XRSm&P+pDfbRfKsqCwm1;=I@^xhAB$`TjSlqSRv$=tY;hg_STy;X~#ZJH_W`J=iP-#|kH{xYRy zbg~OX3Dx*NUZ`;VtvNg|FSGG>JB&9pk`H^2Xk6SIVI$j`BmO&=u)>P?@G360C)^5X z2HSX{vyj9#u5^(~4NDS(vEws)z{^`3eMoBLv$M@_6HiAHi)h496MP4rWT)TN4Nh6{ z8-F3m>fWG8R2HkyL8m~lDVE$9c#(SM1{e6o4Y4UPaX#LV$UfEkR#yI8lR)z3A*Q&<(73md z_!s~feQx;oW&mk+gzjw*@IsI?gpt#Mquc@w58v_d__%5024^&rBT~ydu-YPMYG^6; z!_>5KIv@QrA8NZWSt9Up)&AvmIeygW*yA3-z@1rZd=oXWgOV2Q5!Z>Z*TwG7Y7bw3 zbWJ+fj-P<_~@)4{>KOQhQ7WyaRyapO16dEU&dX+W!cE|X3%LD*! zOk>!kx#HfGEs`TDsJ`k`NXROd4_9E)!c zdPYZ|7UQ2vy%mnzX`|~3pQNNIE^q|olq20@{k!Fs?(_KJ?!G$ZQQz;rr3ZK%#U}#= zUokNCwNGJ)Sf0ABrALx~O*jdv7d*AS%+!QuNpm4S3%kBggR)hJPx@1yRHd3C3%O6o zd(}Mu`DtR)`IlfnumE*BL(Rl1o9*_|Ekv95lP`Jvh8wi+RJ_LjL)Tjd#kH>8+CT`w z-D%u4Sa6p{g1b8e65QQgg9U;FclY2HJh)5a4vl*wU$3>_{k^B^)cHGGYX0b&{oMB$ z;~Jf%&+@G)^qX>dTHh!J1N-H2>5z7qiL4nD<0wfs)%at<4rh@k)BC!NEi`J?FkP(CY0{Clr1!8j54<( zMeIlrN(k7-7$@T6ZBF9KyY58g|J^4Wz|gmN3>8pD!^1C2kliYw_yN(wED*e?uH8R{ znFJ!xVoJ4$_Iz#X^PB=wV2TOoOVOoDFvqtM{}Lu zlMEMQN8)&DewLQ%7ojNxMd7MBw~X#fRqIGmrqP&OmDlr#0Hf!D-5r47;3& zL))cVW3okN!@JIio}C?9*pI#$i^`_#`eq}C6)B$?!(!=Y5W}crlj@IaHqO7ySr(fz zmkHVwSfM1UAUef=D@#8h985HUoGOts?ZFN1ko_QF)cl*Q}n+lPR>eD)i{ANk^JUv({i->c0SSr(Yc%o>v%_xFb6= zMlJo1&_&xJ6=|%x2==fQ_Jwn`L>(L{JgGQkNboSSo50X!kG+Svgp6}1pl|EPj#)Xh zaLMuGY@&t+!ae8JJn{kWz{%cx*5~C8Te>iAyWqf~8o60j6p8kynx)2YL|&CS2~t}~;e7YBh1;gbwz0iBibr1T*mQw@l|2W<1PvmiV3CYC zrliv}A^8|gsS(P1+#y7J!f9l3o0G?5IrIn@h7(YR;Rvo*st6Vmcj9Co%bGz9?=R&Y zZM^k@Yh}N>84%AQ&^?|Ag<;E7x_Y`9D+7$CCh6s?Q{)kO-k^z}Oeb!lD~68f2Ojd@qFhowsYRCj&P;ydz>tbVDRvitiOw}zzL*o5PYS94FPk`+vxob}W zHvw1(b^anEo>>KVZ~7`Tj&XKNj@BMNs8tm}p16t7G-_w8rZiN)u`S|w(ZZtY%EQ?y z#M~4u8ZRQHev)<>ZG(ZGCy$RiT-zyflSimai_w=6zCf&9Bt|dKUu-|CPWt;Qg4yn3ZSdKU3 z)53$k<$s1K^uSd@&;JZ?(2;Ft@;{fq{j25uiyAG6_}9erHzz_?V~^X(*Gz($;UQS7&s&ezd)tOu=i&je%MUN;oy!){SO;n=0)Tjtr7Tys zc6HmOb5nMJXoj;zJ&C%zoHE^sp?0^lc2+y%5aeF*?@rNphUWA~#@0bm@+n`T0Z(o% z{?)+(k%O216rB9Aq@d1Ol8#l%7D|rd`q?MdzYME%axotn@73fa$|X8Vz8QeNwF5*m zW2cYYIokED&R$`JC6co1U5-;ub&Q>!>FWzFuCS?(!M=6BPKtb$+9`BlemQGmEl-Q& zb*5xrZ(jqYT<;OKVfM5B?3@g$8J#6R7n&Z!<1ox-Oo zz}3(CxV2a4xhE?h#aIwD4Tn906j~3@1xWhPjE$#^6*QYtrmb_`Ypx^}QZas(Ba;L{4J_|Z(BR*y$!c#Ngf3DR-<6B+K`))&( z8P!)FfD$qQ*RUKcl~);Rwp7+@QCn_%clch z6ylSeI0UQq3Y&C;(j+hK)IKN1lx}6rpEi#ied@7BUQ&JRWX}O@^@Ayy4VG`spP7r@ zXI6N^1E>}&;*((i#GXkB7`a_IzvHl7RI%k&VN07M{DJbGM%^Ygrgpj*u+h9#ftl^i zPo;a>UaC>SP^cCeYF6s;1iwYC1GakD(fwmC*Vv9qLnswK&XYb&xl;SJDp-dCCSoK= zg`s@(G4&*SHAa-J4GI9}#|x#!)bygHJ*po&2?kk62_;Ifkp>Oz0J&2`2DWp_s@02x zq%%Cq%U7h@Ry6sg)ooUEThM?jc|jQ^7Ja?0(7PMaKneJLMHcv`%Qrq#M-S==35Nd;^c5=@Ihb!m`QpeJ|Q8AJPoN9 zP*B7xZ}NDb6<5#kb%AWVibCjC;}X_>>rli{soQRN4{iQd;OOPgc!VwVgQ?P8>yNCZ zEpJ|4|3179-u)(#g3G!9NdibpRoJ*HBfNFc*vSJDta+djNP!nhO(jM$y3Mg4 zhkwDcQvFjT6V}#;6x3>WJB0eH-4vQO*q&0V=fY$~r_-uLir$1rP|M#Q0U#Spl{Jy~ z!--N##d7|98d$#H}1fzu<n@A=^C9X{#@pzX_v^26i2GM}(${}}Jb%d2@tC}qb{;lka$ zEvDe5r4}btpDM)!Q*1%4H7UE)8ep|AG^eW1JU|0VQVi%CH{Q% zvT^aej50cgCDi+{*!fLPCHe9pag_HvW1*>t;LzoXx~H%z%fY*>qlCK704ZS<3b79i zsf19#jkjyGDzD|;Gok3~%lVSOPkjFi>GR9Sw{Vx_1k+>lLS_X$-SlOQkBGFA8oe?vl8LqM3`q1F~u|KIQSUij>uZGSnlykM?=ws)7=Ao z;!lJ)?)M3*yKc}%Oz^YFZTJv8fNxsYL_~Ce-_K7Swj&_^-xFagjM5plT%WRNTqkHp zvOZm!_E&HkR;3`JG>=vIq)f!&eV$l~C~@3$r5dau8Szy5DDj!2AQ4y%lL*%5=piBD z9&_wR)Xho4ar0Z&v^OO|*qCWgqIiM|Rp^;Tv^aGTZf_FEIi9OPH+9}wkd-?he~A!_ zR-IM@TROP9SiU%YjLxJ4+mj!Gry?xcGVo{(xqAq;VK!uT2gkEhRe{c2b8CCo5#xXd z5C9_dhRq_@Kb`Ztjl z+mUtTJnb0%ANCf%1}c3qF@|F&KfYh<#}CBL#GJj4EGaG@KukL?W^ zw+Q9M1V$!y5iGapv3@<3KKA`Pxq;55M};0Gnfl3gec0fMVqUg~Hf&UC!iL;|QTb z6>VAqE722IDT*}?nMECy zE{bQfISB8|GT)&mWahR8j@;y=(f=pdMat(z_EC52BioN-ujhf|VBc1wnEH$YBer~r zi+bI2+HWIz9bFbr4!kFX3IsX|^wupa-#-DEjlMN?P>7Pre55hC4OTLl`c?osG8=Ip zH6N*{Nc9Ho{l0}r-hGRF&8=C$a&061JFiozd-!BF@rpAXOLurz^!r7n%FtTPG<=7H z7?3&MCe}pf*raBuLIe42v18A3tnn8cO>eLHsu!=#cG84HgT5nJ%ex~`W$`PLrfjsjX2sJN#+@SMUUO8mQlVszg5 z?SzZ!6rH}@K;2Nj_oA%|7&8>5P>bMdn&jRocc+OS}=ka9C-L_~a##RuU}ZF!*lxKu$~wW|FjcU#Wy zOx%r4**tbu5ao)eOPN`;mz}F^dCh*Cxs1mC#=M)z?sCCU0TQJ|<^ z#7!!PI!HTpD6-~v`mFZFZIZKpQ&yf_yHIMA-Sb(Jh!|5+BLnm7I@4YulNxy8k^pOy+KU+DzbT_M3AR{N+KqQv*yS zf98t6erUk#(27jKfB%YSb3T} zoYpQ-ZoHJc*&;7?Xm#jT?#|He>W2L6cA@RD!WK1RaJCd9|PvGvS+x4rq`1+f133i^`JPM))mu^P}~9DVM4KlgZ+RsME% zcl`=UsBJ@kyBdFb0dL%IfJnO&Vrd`kea=?T0^BS2^!`^t?9j)T{2%=gI+Ut+z<&F8 z#*ifcKWMI?e<#)ddjL&?;cKOB^D1Vov7|o=x8VKjT-RgUyvfl*p2W6~()3#gUp_!3 zF7Vv4WZRr}`F&d%6@^_|<#Oi2n9m3@o1n1eN%Qf>*COXCKXkd~ZzB}ldTd@*7+lI_ z`jhpN_Y+FYx)BtD8od2XL&NB^B(GhkV(N^E_SMVrw@p%q=L$hzOZ4b3vD)^VEIgQ$ z9|PyW=c_IjC71Kr$hh?qNlU*3IShZ`g6F#@p#v!hWiNzIbalXD!J?9y1`m? zB2GYa-OFg2E&2mJ6pf4VCkJKI9%|SdE>dCA<{(D>9x1bRA3AlSFm(jd%h~HnESTYpFAz?m4rMa(e zg)!2h=9CW|=#4AFxXAp4$)@lHrn}2E5>!xQMU~peKlzNYNH^Z6liT=zS@(S>FO#a4 zL&V9OvH~%LVZ1rY6o9Dw#Y_`+KrX0~ib(E4Ab)PLG-c)@ zLUI@%84=jWpgkrl%|9`~#P$QHa69R*iyaIbTd~HkNG3nG91EqfRu;Idh%L`(tW{wE z>imxv_m(*E?gD?&OqTpCmfS3;zpadtD2|$VELW|D;zw**lJ$!{Mw2rVtOMqNJW9V2 z#?HviUD~U!-rqq)h_I{`%BlWmyP@;Dr$c8Y{&`f*6$++D(CWT$>>%n z0-`G|zIXVY1GtG7@0kJ*wohD$=MA zr$rB!B+C|FH;&VW=GP@0Kh5Tnr2bwbN6c4YD*LmiWQOK%!;|SY z$4qNcVfPm(T$m(x^BVYP>i=I)T*xlG^mFNe$+EJ@w>JmS*AU2Ac({~W-aeeZ!l*^D z17L$cA?vac1rCtVnbc8|@P%>VZc72Tnu#_q-ka3^c5<$*80~kJNf=sgA$boVv+Xr& zGCx@g>~HYPB7K94U=DogHz!P3rx1hr#*0(?i$77GK;S$e0g1bp31oj!kJ2qgFD}q=$z|^GRKI16q4;tSqNu z&yS#?Q%bSQQch#oG+4-xkEfq!^dbbp{;PBQvc}2&j`G-JbNdUNY5zs)v9AAL9dqhqtG~+^n&Coku-NW`EG^tocL<)`!*hrF_&g za97Xz9kb^eo79feTpM+)fY%|M(;o(c5}5;NpX7UY#%tAMXrwKapD+ljr6D6YD(Heh zD-i>>QhbSi^xDQ@Y#+ZD##$oVtz@tm%w;zS3%fCe%y&e9LP$?@e)UV}<0)HmkSk&e zd(4W^Vma!V6!w}{U#q1~qpVdB;`=oQOJ@e`LdakIr33{guZCpU z#z_Jxo>U;6{7?1>4&tiw>Q6CP9nY7vLK74rPwZqpj`tC% zCV_)Dv_Zis4dv`f{A;U&t5tRYJBKas9goBjHu6ty-=Na+FZ8-ineYz$$Pc}}B1WfY zy;e<^x3I1IijMrt1TnA&u4nok zKg7=iSIvepdE4QAcz||fcmtmz)CJr*xHazBgIYb%D8N6=vu5~QKNQHki$>@~?{H5` zQcSy~Wyyy*{&L9mdA4Ky(zpI?|yqq|ES%3J)kx`dgTo6gO~OWdH$KVgUWDlp2Qh zuIDgxi6OBeG1AM5-5ldM>m}wgLLoIIDk9CIMs(xsp7R*P>&061l#5OX-S3Q(ZzQpl6ZGZ=>N*rr`I zA}uKOBcW8DibTd$R`k$j!AD1xoHaHs=; zQas@y+hhtYCayO~spM=9%|2)Und?8N+<;J~$?X!{HsbdsQLmnXHUWWJRZ%~LfJfR` zU$`+N|8V@Qa@hJT?#6L5zD`JRjTOF=SHAIsb~{afx6BnE?N%gaYxi=EEDiN0`3N)4 z8LQV38|+WsAg6EH9Z$Iy#jr+`Fl-Mo#mf(t&}Qatb%dk3PU?l zF;}cOlTPrNRZ}|8fVlvuoBGK#EHvd1N!?2OcWXKoCL+b47p@;Gfy>-EEEK8$wFC+H z=>o+9({?^p;Ndc9YLwC!eO0s^f6HhzKqZoTRNZ_IGlV5nsw(ve|4P;lCcb5tfh3Ey zC?B|cMMc9aZ4nZK@tNk*6p912+C!LDKaOGPy$tEWzanVIM0xufmb@skt5i=7Mv|t= zSh}sG3fTb@o2k;6%`blwe+A4O0HgA2&e+=lEP-r zkM<4QEqf0PlLksNCFci&$B)f^)#(Z`?NG-g@{$njzBo)AxvO|K!Y;d{S1qmnT zp`2Iqh~Q&qzRPmQkJ49j5`qP2A{KTh&i9Ro=A=Iq*og%UF(v^0xO0$oy$ey~^>Ec+ zpag+ZZqsedeG11tHsq-x>_yJFa@p7VJM83*!RMyXj{0e$zt zgYoUno}G!dJEGMb#-qjI7zakSS3us4lf&^9ZBQ3PFXW#@-uC1>$MZ#{7cz&#*DoF$ z4kD{lkbCHG%HTO$zj{xy(&6v1_F)6mMNxKcZ@jUX>~XO6>y6T(>*;|5`r>QVj{iW* z(E1)4DBz{;p4|VnZgRo({sm-CM&cmbNfU6IUNU(iVsCx@__8QL?$ez&?h)-E3i*EK z`-Z3cas@)@gq*z`cqHJdor_-SS-YI>>_PD|Nl&MDx8eSN6SG@rc19JG^A#nanuJTk zHpuI%$NkY+%gHxT*A{Q)w}4acZjrmY)Td`tPsx7|khp>Bs-RB=R8g_qP(joozWe>l zf^Etmv8c#;;HQ5#PsBY)Nk0tO{|{Eo*h#zNzaRd8(PHW~H}r9zif;Vh_c+Y%?Llmh z6QV4pPfBnV3j)6UiPYQOcG=bYM_{%7&rR6E$n1c?+|YH4qgS0&gR1u9B>pw+j~I@O zTV&_fO8EwkE=6kRft~0hZoO=gj8A07c6pNSf%{Vf8D*u660T8cex@fV_>e z0?^qSNaa4>zFG^alrfEu4ILqbD4{$WY-xKv6kjtI`o^fVPY-+tx9UyQ>Qt#5Wa06; z{QPLvv)h?iSuvg-u!y(M-tmIGmL;Yb z>dPKw$KdT*gv~$q|AJBo<`{hpNA(Jf{+M0n#Tu&)&d%w|`L}myJIiBNDS3fqU^n@q zxJJ7*0@D?WzjlrbwzcM-#V^0E-qS3PEHb5GCeW5*v}p2{ayL*Ww1Xb+t)q6~9Br+blWSl-AA z6xV-t%M|&YAVC+wVV64W%_c*lOg{B>K_xdJ2~^tePdcE6BxyvStz^n=bn+PcD)l_z z%Tv@@ywTmI!B`z$01dmmQp^22aR+=jLl#LxbC39N>4^-SMT&2Z{~nEtg# zhs_y^GvSP>-i@rVGTFN<5qJl%qBa;*UlI~pI1N@Rk?gSveSF4sSU=uGqh&W1j<vZH@0%83<3zYX|4%&$p*I2TS z7~7H7xLO;ao?BKwj7P221=s$pM3i!FAqX(w&YyJ?WO39}C`EG!>2>%{laRaHz&+b6 ztxoh;)T*%y&y3wz$^b!sB;uxz{d4FLZxXH=F9}s{xQ~q2`xr7 z!Hh2Ey1;yw38SL>-)EgKjEAHnCYAN-AZ&K)z(F8nF7g_T12~DR%@&rV$&{(m3KhhZ zV3(r6a_`MyGVyRoK%a?>^dlE2AwUm6tugMDpxX}xc?N6iTcsb0Wo8d0J~VBd_n7jl z?%5RHl?^yXcX#_nkvAu7!U6#!@6lQe{%+GHI&B(whp? z{Jw0f^YM(o-ob(6VjgWG>sx@i8sIZHqu|ug%2|xjp8U0SGZ*7u@_wi_ZS-qUoEWdX z`t7`X z6JqSXS<(=z*D`0|-H+6xg0vzgXyCML53Ptd+ zvba-EoZ26f+oz~?NT0nU|Ew-I>u+my%Ts_{?iW7pz#~H2CDg3nV5zr z4xRmERM#Sivqk-w^SWCru5_X>eIn;1-05A0Q{BVV+Otl zg=t9h2U24eup*ZWCJ=o=1si2fOp0am4^E1{gmxODD52k9p0<;3I!Z%vg>PCdKUTp|CK?L5as(Oam5X|e@eBgO6ntD z%!mzgdCj4Sdv+@E*=Q8~iLmfY8}hMFz?jw{HU)N4Msf1-lLi0ssT`8^Ejp`hJhp`U#4HipBQYJwWR7>?jTuLedDEUKd%#YqL()`n@f!@U zhJ-sRoig?*1tm^U=@gv&@Y^ zBsKfqO_VUSh33d+{><#rFvIvjOI4`wP=zkw28`((a{6E|LdxWLa>bXJItm*{*Kz6* zYKQ6#sFnZ88lMx_D=U!LEqrp6NaJPSl3}e{v${to;hr*RR2ijG+Hk+Vw7?a zk-Tl)wGVaf#6+JrPc6IMwM;?4WQynD(T6 zrapA(10JL)>@&U-LEwOw*&8f?KZABZPk$%qGQn+-xk}lllyzt2sqo?hqc=(Itm8a8 z#A`L6tD!db*U=y(^Rw*>A8R8_OCc9LzPDQ-e6fhKz4ji}lxLU(z zdc=h@Yf;yILSNw=buQ2aLj9A^5#OU!G1iO_zT9x_u-P?``{xh@StEx@;A1`2xpqY_ z-fa&mlyPW6EklE-i`&#h&;JsIk~9r}mK-lFMe3jH^n!tn*ayw4Mzf76D;hDVPjcn(y^rSbWOoNcqk zstoKl)hrTsxQTD(+Z0=)ha-j)hC>cRYyVcw7>=g=tuqL?q_3n-=Fg6g&{0FLK#h!E zE{3GTMUel(mB!SI%BLRVV89f6k|E%p8kGEjRfOxeD2&L-4;4qwvI^$^OQ{!wDK&&jWv_QSv4s~yT@V^k z?A41_zbV_Fg9*`$3FO1zm;2oS9bR%Ilz#~-*DzUxLrs^n|IO!pdIjJ|0}CEgSk^JZV&yO%?2xEH^V3R};XMKU9JIV;m z*crZ;=+9V9INcHWPLVx?*=d2$xZ^9-J%Cr-`DQI&bD7u zk)J}a*tAe83$tgVR*o25TQ?z>I$*sNkbT24yvv=-!0QNlr{bH%!OlLQES6n&lr1;r zwpyzR0#>r}Sx%*Cf1P9N4ueZL0lD7q1KpV~dFSjWA7h6`m6pcY=H3tPU=4niIW3WM z|Da4iYi#M6=01XMnzw8*;V(zBkgMeH!hBkzepxCTjAP5)T?KYm{?W zR9Zf3rxE=9x?FFQ5N6?DSkvOL`-XAoT(_I0Xus#xv2Y+r)5a1d714j`)9NdeBKYg= zWbzHrw%swpCb0bSObKFGelY>^W5z6}+}T79WM?lq$3e_*9wM95yhX?Y+U0zCT@_dP z$P`oTAkA|7uJQbqs(;Rt?tIt;+Z-UQ%fvMOy}|xglJzd$l)A7|9%cRCTD!Fbs|Ipd z(r$V?iifWUqIoi|*oLA-mkuLO=?LDa5;)SH(H`wCVKG{-jZUWpGo{)fPv+3w+sDmG z1V`SqfAEs40S!hGt9BumbHRG8Az%5?62OG`nP~VGXsz;wNGqkQf&Hg}(8|IdaQNz; z1RtRqe~J7&aoadTJ}mi-0QFUBGj{QiSb;yvL7Vz1DOtWsB}EQm&t5|Bd0j6Ka=wuR z#ZFwGWfL^67OFwjCvvnITa0z@X~M%l{S))lh{aS`G<1A#;Ja9JI&yE0L%zlY)!{uA z@lBtthnZ|q`|g9XH=3s*&u?FGqyBKFfRdCbimb?jdHVuYhcfU+r#q=u11woU;0}?> zJT{fchZ}?sGp$0lR-~2Hwes&T+j%khOOA91ttMnD79}&Ur@vl#WUy*{wRF|{)F`O< zC)kFj6YC+H?svb_!6Lv zBjG^E5=xME5g0685Pc+vtx&8liNT6dRWiV_Jyfjj&zdMi6XeP&H!{hE+Fuu|m1Ij_Nym0rn`rFKlBl2>-m83wk5hb5JNy52*C{)A^n}Z8dU%?Ka52`to$xl4rmT{;5ytlebC2-}t@Td4vIUELjK5#sY$r!gM2*-)Y`eG~Gbh|2>$Pm@2ku=$ z5HCvM=^BXk8`Mt$hp9=C>WELaQ$(?@0Q{w!A-+b4Q>AGC)&d3}-^$SX2>&)b-n=uG ze;RsCvw!bv>$@+I8dL6Hn>Vf~4jA_rr$aflFIE_j&ZKpo*lqo+r(G|wZDIhrX33UY zfPT$=X{n}^gh-*9E?gPhlR40|qNokU`%Niq&2Hq&4*M#AJptP>81rPTF9-OiLl)OcYsMF;eJNTv-y)W&zJD)`i2B>2rB^4F?hFXTpEJ^8_{g63U&|##}Y*~TEqfv zP`XG9cqI3nkkxUWx8vGeItntvcJKjtKJH*V97P=P@rwis6229hzDgcl!P%sxNK{a& z5BE4151oC4*nUAB^UAqyi{tf)nEH8&7;0X=Z_|e@l^V!>%DE#I5K0aWs&#lf#R{*K zoWFt{8o#~Dn1`IHRjh`AEQ>;Tsb{^jD6SJITB&j6Xc3i^Fh7^DKNQcd8x|PH_h8C% z4VRW?EHz2M7bCv?U}o68F5TyH)HR!{xFs6bKoB2lOVJX*l3>6OTeOzp*&pf}k@#t4 z;_e)7Z4k_5r0+1W6+=p+exqLpc=v=9(t-mxjC1sSX8(2CXWwYz0YOZ)`tm}JA!dxc zY0#Qpd|v4J#9+-9LS_|Qt0NKzhgP8eB@{#=#blA2XMm#lqbIL# zxI;s>ZwI6Is|%;RBgJM@#giS>GJk;Zj-Dw(J}>u}wfL%N)%fvRj;vuX=Dns1HxA0C zV;aTRlh|ox%q|s7f$VqdE`rWSG@O746`By+Hkj`Izlg)A*~?+BYR8G_(>9A+6jS`X zI+$oaCb_fxg8YLcy(BvC{|X$2ZWFmJ{;}sDIP2wk-lD-drf~dH&`jLcDv1NKM%Xq%+Yt;Y-h@FW zOI3Af?tsfDHKvhs6e_G5ibJ{Ed8*-I*3G=x`wyFRguF!K zzURSY(Y`2*h_WsFqy2LShv9VtG2j{bn*#I5Z|l>tv6O za@aoj^^AC)QfsD!ElP}Ev^+b}0f+HUu7eC4B;xGb(tO8~9BJZA*nvt85;dZIdyPoU zy*eyJVKD+ezMjM8UP5k*VE6t$e%`ic*%Gd)9J2m_#h}0suhxXj!R0kT-bHKtSw}BF zM7sQ1)oxcG1gWD^HntzA6w4mLu8g;IcoO(?5x7ItzvQR^W}AoXo4ZmUT9_xq{sx;L zTX5=orNG#8pH@7gz`q<%ytc@zA+Y5r_nPuj_KUeb^4YJ8VuDQgOR2;*@e2*lZz6PJ zZFq4~CaopjuNU~IQz5^{I#WS2}A=IlL2Q4cIo_#L0#KDj@hTF728n)mR59KM* ztAhS8)t{kOU<9pSCCY=;O$&BBIcALC@_;99(lNT^kFIcKwyzV{cX-jUG~oqEdalRw zcQ7GFANEGuTxIx;rK;2p&RZ_iu^nnEq=r{GM;tr*Y&j(oOe(clu`qAhPgR`|MT(U9 zg9F*9cadR@D|n%HeTgtXy^kN-fsARAA=BfbFjQ$H`NHYtx552eFn(~A&PRS#Q)BZ0 zD7Bh2UbOCM`G=yyYAa`9x#gN6XO+H^i1FnBwe_S&-RTnP3-e$M)#OdM9x&f!Bkh^miJOczia;bGvKsC$ zliK;xnbr%y=%T{cqlqu_XJf9lq@#YVbXVGvA>Nlw5$Dm~-zWb}A2uhV4j>M89CUDr>gGAlzJoI7#v?4xK1!UF4-fTW6)1i3x4+<<#ZUJ=(S-kZTY z2|@VDl*l(IA=BFaG;j1%pWelh`Q@bW8BD>h8?YUrWR}kOBYUQn9E|JFG9 zl-8(U1q>5+huiaxac_?>%M&9P%s(&72a>SO`>cQkf(){|ycATj4j!2es;p2?hejh> z1mEpp02?7Es|iQH$^b^E`Rr%5H|fIMBi`1qkYz>ffD%xGJPwK$Y0LN zYQMhWoQDj)89i37jh;Z9pBwj{*gRJQ8#eOMtlP(+X9Ut$08Gn7Da%0R|KdhO6VBgp zqV>E4JwGO>?6o%jm-AnFd2s2cQVjcB^n24M$NwF8{=uSthr)fGk}AOjxW7K;k>J_M z&WUetvj{3KF~?f9!bO3Mq%K3bwImKiqwD&t7^J$F-OSz$;|P+@JAN7P2MO? zzGO$PWT|>cHu2(3-y=Z#`}`-DN!S|mzF0*PSWREib-Sw5P-OpLr?Y4=sXvAb#BpLD z;U3fkS|4>`~`+i;)8Bfk-hUA7lThY}5a#efjCcSAiiGi z&rC{*0b_y`RVc6l2uc&%1CGysU5NOI8MsJ3=-AftNi?ld44crvn1wwnmXTbI&3tY z7lt1szw@id`ITD8 z8ib@LU5oq&Hn>;kFJ_sXhQn#ri-NL1n`;u*zjS^p zn=sBP&{Th%HD{4pNaS1OpjoM=JR-ugwd;qDJ~SYR4!J10Tuv_+oHM;Z;7rswcaQOp zOeppW&EhRy2vo9X>2KbK<#Cbi9F9{;Oz^FdeYk-HM1TlX;A=6_`5~4h9Q{ZtK2}J<(9<|3x$RX-A_4r2-T}oN6HNsY{CAvA!OhBfm^3 z>$)=T`MA$2Za{pQi}LD7NG5mYV;{H3(}gU`s<0-(i~|CDSp44ecQNy{44v z`4G56No#Og%mv6=)u?WRA`0!_$q4E*1zECKhl2J(M~*|MzYc7z8iwZ2*Pw`zMHWuj zGm(XZzDi7Cg*rjtKhXO){$5LA7Iq!tnYb2d#_*`?zQ_L1Uc*=;QplytjbI+zE`3-Q zb18*N7eeZ=(KUEBjnq8}#q0MG#r2a!QUH**vRqhG1uOA!uzz0t!yBo~(bfJQ*dZyV z6}oX|;uDM7h>V)y%_p?pA2p4TIUD0z9XsF|UOL@R!71J9-Vb)!3iMlD6$v?0hn ziDJ1O1B~ZwoKcKz3VjxKm!}P1H7%X-cshmEyn|{BGy4&k|1$X;%^DMU#uPgS-%<2j8hxtXIdmo zg(U$YdO`tlZfsx@#n28~9`9?t%nuCd|F5dI3~F=#zIcnfQ{3I%-MzRKC~n2w-6`(w zP^@^-;4a0A6WrZB$jv$DH}`+WG0h|JbQoFUZ0h0&b!sxR|*`N1_GVt=ylI| z7{c=--f{P5z`<@?kv-jmtfC?VE7#;qB&6|Eu``#Q5p&1@Pero(m-!63ZzCFRs zJyqGhTJ`QG5%h)b*(P&=Rt+}BYgdQB5J)TdxIuQ@Alf=JD6e9a3NfTo$Hzk%@p`zO zhW2IGLSoI2+Il+rL=s6%AMcy^>5t7!pE9jI#qt{U*3DCHY$IZ9tzPV^UPTLNT&}y^ zmLLJq4waDjo@b-mul7^!B!LCUoo_QBx~8BNe&<*HG0M|6=y2H#=r6)5(c*tZ>=xEX z_iD%r5rUVt5in8f)a8>*zn+dvAsJ2?iD;&{S?8?_bVu-}v+E+vRPb5U4t5CPurNWjaW zi@i_NfiL*^Vwed7kp6Oc4sfWgC`pM}`;Pd%HR(~*yU5V@a{ITLesk464s4ePCSV%J z_d%PIaD-4=eWsdZ8^xhK!)o!bUrgF{7557@rT>zGZz0mT!G1*sGK1R^LVE+z(l#c* zZT9TM$;j=(U;44Axeml+m?-3#EM{D1J5HC(hI8fkUirYP0eb)2%8g(LBLLJR)xS6B zI3G7XN-{bfM(alaUQ0*C{)EDlPmNGN1R9DBw4`@fQ?lK=a2S{ms2`Z!%bYb?k~obX zR;pUJkVG}ZxQ7HyC%-rDE)X<=;rz|O&}_z$A_bWePZ8a?(NQzgg+EfRR|P#gLKM#g z)HFJXHG1HJNCyM2_oE#fGdB0HX6Cb9bj)*D9ahDn4IS>BoQ3*m_3eNVZGtA#4}uZ3 zVOxo26hT4tci*;%Z4i-UsF+9>v=~%>QR~};tc4-H`pdBmH(zlvop#ehZy!2RX$#!lf(7S zpK5ENL~90%5qpQ9recM(_G{S5TPTX^FEpw>)zi23Ma_g8EfbJsC`a!8y^9UKRBq$1 z3moi;lZL&e(&x6A!p%4?_i0C0Nl$Pl;OXwmLAI;Dx(_bm2)@*)dempcc@s~vFukUD zJB}Ytx_6DiLhjn*^JxSLl*?@@>Jxkg@#G3tf!EBU68oL^KzC?<*?aAeoSBi$l8GTX z;S&`qPCQl?r)HueRVF$R|F>@@(m7g;+G=&J>_!Hr+*u~0L2Zd&diQVW3Rdj3&`~0f zQf%i3_>zAE-b^AnnBPMKTGY$XP>Tdp$K|205q|?42g3sZ%0aqR@TrKRjZ8a5|JW!- z3qIiQ^93+w{GSjgf2=@r3OoU*LdZwP@`BTTrI81zQv1rO-^d2&EY6MUWsgWf>JB+o z@!ZsXBE_g(Fs)pKW`54H({1bS*t4a_4lG*K9201!{(SlEJ0<~jyE`-0NR^R2Uu@B* zmc<-p%@-ei#X!|^ux*OI;N&H>Ml^KZlJcQUHgVDZu|eLH)s?}8zubO>%fDIASc$eR zNn;jYq2Vt|((VXDodl#Gp5^r0p+C7o13djGbI^SI=RA-8kRaH%Ep zyzE~o8iS&yO+yFMX+0SF)4P>(>K*E5t&rlab>XRK>2u$ac-*8#U6yt?T#*9l{_Wat zA#!EFBt_=G>yzyN4hez(t1&f;Oh&=KfbaXuqWO2&(Bk)v!$ivbN^WJ zzzPouL&I8dLppQnF=Ops-`SO}iF4En%>09sc?EiR8sGd{w0T;he`&&zUqcM}{GPuk zno_$`U`if&?N+-{m*W)*CfuD{5{F((og?O;!s)8^9_-Q&cVU2hC(Y9F9+q1t+jVe{ zJXdWzYtLGUZ#FANG?2ZxOVst09D$7TYV8y9k&gVt

    Jo@&kJ;)5y@U ziodhHl)bZ!JN>Wtjax5&%Co_rnR6bk=D10rv7V*WB~n2-yatpwmBEpScUhxz=qYhg=wqkmQPP;>N1 zL-Kzk@uOKcFcTmso+IwgiE&J0(Ls8ltc1Mf`->(_HEGRRwi>N;>>^U~jaZdu>CJHJ z@UBu)i6+NJz*e6bprWNvs;mPRmd9A$YRwrkm5-3DK||@R2Rpbg<1Nu5iV@J{4cj}B zgJ{z~HO5n(+}jTZ;#&WiJw*w7*A4nFTl&tgtBF))cIi^jL1qyqdT@d%XnMO=rh_xHalBY<~81M5d=3X%idPxP%tKXqM5C**secTy_nQwNFaxZIDWReIjmLQ0~+6ZUxer&hwa+#yYu0__cR;;2l! zt{8cSH1{`|`Onf6#Ig;#5;S=-%fu1ePtddxoZx`6UQ5oZOP?;5h+Ar?B#wtT96V;8 zFte{x{Mt!g$;yS2{w(DBHPySW$<=IWU`1b6BuA!e7GU3}Ljl<&K^9@!9Ey3*$;git znjBLfQ@x-{&EgTB5+$8tt!||aZBO16-eE1?i>tXn7~;VDM*!)yDnto0T;WzNq>UcR zsx^;iZ!KtX4+z84NZ6tIhfWwpaS9;2gGLhOP@9<0;dG%=si}TUx4&c-&aFp=o+0 z|5FiK@;6H5Cp(81?iZ)ZLUraeVH>Tco z9(?YDI7@z7JRF+E$SawRmI9v}jiQl`7<(RmMnwqfgy#2oLwJ9gQ;GV_I7<6%R1*NL zjPI4J-RW}=3Blmdt{psaInvbg_L;T7^;fLSSpnYmqwI17Mcf+W>&;6ufos7;^jx0N z)uWXiE3mQE7cpl*fec3y47AV10On3To4NW12D>v<({-9!%VyyYUQFc>~iY#vq(?i_SAF5w41t3v*mzW0d zK6q~QJ6ZPvdtReRjb5X6o3LJAZ>)p@y+bs{4;$Xm1=dO8(L9Y?ox9oxNKL};9Gp!0L^0+4DrXB~{kR z7=3!)ytA!gEPhc9xu6WCoJarDL|DT;bg#13|KAlf+W}MA>(W2O^43D z-+95*>5{<^{z=`&Gk^MME}Qr@ZQb2YK0loyyd2!~-Q7?Rc4EvQx8ANmL+v9&BL7m% z!i&e(JVkMUw)Rb-7d22uI9uoQX^-&}L2xV%x;BTOc!ofox`TE$e5seroSJfWGZq5? zb$YJR|FMniO~W|dSQi6rI6^#oC7sf1u+>x!(SHNB6WD#ev~S(|Zrwb?i=0%|yX9a2 z2Be`*kOmH~$;2cHqGgWRgzAr#;9-PfDM~GK!Z9rIcDKvL_m&EWY{K=ZCwTzyz3}~h zBzVlwg)7JqDp2btq!5tmJwT{HHpIGFL{Z8@RiPhJLXa^75Urv=OajBSL&ai8yy4IK zJC&DrgBDCe^GC3Ah_yZ!avN4wFk+$Xp538aHqm9m$+zDgxRYl`kz-yD7`qp#+ne&7 zP#ke!z51X>k8B?mhvW{$(YweEf%Fnn0D` zrA3%E*UHRUf@9$6bQu_7F2NG%Q}!um{Zoo4a$s+`7*`12q1|=dT5t+8=-vjuOada! z4PwKU7IK@cSRp{EUUj;77MlVAR<{xyoE||0a^wMOnLJH+!&$Z_xR9!*i4pM-a)eVP zlao%zkSEIZZlf`*xN$lq0$i`X@JvV;$149JS!~kv9yd~E#`ak>?z*WYXtsn+R3nZ1 zhKQFClbo2upBsI#lJkWc_ZV6>?3so@vJkVNqh1&u6}Cp)^iapri_jywF%8qCQL1kyoTg z!FhhCHgS*?6~0w$G^t}lhc)V58Tn54@wexx(_ucF8g|7bgpZUW)jMM%PQ4`ZxIz+S zXXzAxiuHuG=mwiyiY=4}HvZu{YQnN zp7JG*wTnv!&R7C7edfUvLy&J9s=^$p1c8k|E!oaY*?feO%7V1UG`q6nXB|A*h>&N0 z-Y~JSXf1lOa}5|0zHRGj5hZfN-adC=YxnSq)d96^F|nP0`E(B3c#CgwQzT}pCA}Oy zfKIM|t}O<%`kkjAq(F?9VG4AKh%ckpyeA^^NYpL)TFuM&t<#F7Zj#g!bMWSQKyfyw zhm3dVPM7oDJ^OXAgt`MzcUa=!{C^`*S$s1qxSic~l*e)Vs!!g0D-iqVpmk|=Ch-uN zRtaI+fid_iJVL%H0$286NT_0v_(8_n`3s`F>L-V{%JC30f zLT^J#TY!`Yeg6-0<}c;a_(h%32FjL-2I@;--{DVn?(h!%v7bp38A}O3M;81}?Adhg zJfXmu5~V2DqBFTlCX>qf8T-e1y-A-?2$X$GH^9N|>EF+xgNVaT>^~}niux-qTc22T^3n+;~D&`Peh6;-wTJ^t-1FX`vstiFIdh&pwksFii7?$-*bfM)e^ z5z68Hq3`ygYXTN0Py@#(HNoxw5s;Go=JH`yNX_Tud6n;kV+!MMKMFg5`qB@vY;XXH(4G8|ZPQYN@qgb04j{$N$ah z3gqFp90}TF>|R;~)rl@nj|`ID?GqjZf)l2%{M+B=LHAadBgd`7r)KZR(_5e*B@qzw z%kuUAL>SLNvHw$GdQ!oC1zh6;yw*PxjvV;n1K)u*4t{5Fjj&t)Jp!h-F$;L;Cz?~|={|+ys`V_^*v*=u_$wgI(f&(glk3=RIRn;1 z_-Zuc7~|$F_sCQ7?%?Uz)OsA-g!_KBP0_=`k2>BlAxDRVZ;WAQHhR~OxG`yN+r;Zv zucw>3`~Cx`6P;sIoq$rDmd${c#P0R19K{xkzRlEA77N;4Vs*h(Uc~W-(b{!cao#1O zOMdNELCnAe7K>L0BT@O}F4c zbJQTgEY$?j+ousJ)6jz$N6LlCOHBKS<+_P4V_A-wQfQl6y%@l*aSxUxM@})#zIwrME~~Rn$}b{<*{79NTLw(-DXHhMZ98yM5jEjbY`Of+QyBf5Xwl z-ob18(MlXY?7E{!63`+$o%GhMd8wDaBA685v$PU=L?Z25%H}m@B5%33VZ>8mAV8zT z4{F-PDg(lO_~FXe!w-zZ6xd@bM5EO%UB^X*h2lWWnKd}zY~kiIfFV6t2kt$8q})Ox z$3*Bo|4p96Or9~_kEI9>z$7bRr6jg68bJ8v(6?FmO*X^dA^mR@HN~hUC)+9$JoJE5 z)-SpinG?QZ*gaE`Qbes%j_+YR?D2UB0R^P{1_U@cXy@dguYJPo`b#*{6uldrxMG#s ze|#?wk)nu~Xn>ELi<~mf3#`$%0HSE8_3w+UqucGLAhZdKBM+OUT}ZtEZCceF7iZ47 zW-eNilJ}C6kkw~D6=w-i^udP&CypCldc3Gra%(DNk|aFx*T^-Yl{i3M8-JSIu>W{B z&sLGO%gH*AFIu+&`<#ltR#)T(KrZIgnt1mm|U}y!XqYleC6&V13O{*PmjiZOcmlvI%~x2XtCH#ZtkDm#hruibo!~ zR?{Byc35*|GjKtwklHwA zQkUbBE8F@teA8BzFH3@oASCC#c;!1qMtt>aNtSu8i5 z3b@%q(gpp3xBoS3fnh!<1p^VgZ&-LWEV)_APOmgKg}V)>aet6D?S`(8<^u-suK^ulT$rfD`5)zB9|rI|sLHqZNc#*k<~@5m}(u z+YN4KfNzv02TH;OA}hq$`!&ADhRDFw17U8ay%P|H%?n|;f=`{ATt4xzemRj|Tb0>j z>()C_$-xf zUb()oQcX+( zzjM3Rp86^)`a-BSxBQ*3?+^6qh=t#wX5^(>_B zGWa5`ZPu?s@NG<9w>C)1j_46JlwL~tw5LL)izZx0;TL=G9(hoa(;GYI@A{c^DsYjY zWg!2^_5+CrTC20y)sIV~zGJsuQp6G&Hm(aC;~xi!lhn>_o*`D#0fUS0Bo-WUTULGi z;)z4&l6*w{8>c#{+xB>sz#^{$?W%6fZ?%aoUP;U?NsQ`KaWuK-jl|nj+P5tCZW%9y zp=o_eT>1U6TTBi&m6&D_<1J$jgVkU_;^YJt5i!Zu{jHI)a~P?`%`z%P)8zM}IUaIg z08w-UX^1ujpc2|3-R%8~N!v>m=6%|6HiX=#4l#mBnb1Bb#Gz8s2-Wmp3#b*Ph(32@ zRE@nn!v!-0FMH%)c!g!A;!>FG(BDUrO?V$-Epw0T>gPmn1Dz1gy z^<2WhxT@u)oULm(r+`kVgvsFbRuEeDpx(d7wn$rhsK2COa0K=_Av4g41BY=#o)bR} zY|G61h8d^!#*K<9Z!=1o&5$%Fk=av@)kDsQ&EW)t7Pg5pn z?1%wG?(e0>P827luE757EQEa<;sphmxnp#aas=fVwX_rgUj6NsEMtWF0%)fqWBAHM zLXnUV^{zM>{;~_XhynJaM?=$(JLF>tX|3OM7A1TFoc-qr8YZXEw#uE}x5CI5pCq7z zH^k8I1xnNaIfc8}+5-rt$3z`*OcaJt$|%~>l;>pm!N*R~;Kyi+x(L{~njp%`TcI<-m9gj^?{ zg@OVR+pnK$3kl<$umws8SxPW)*2xWf0u;p#g8~jS&2Zj3jQ7x}ygQTA#-Wu3Aw5Xr z3mkWKJ&|M1iRwHy&||YI9ZC4`l-h;0!|+q3pbT@5{j^!!Rc|v zMSfAaz+aZR0=axVoIB-b=VQ4AIS5geSg9)uOMac>#-+nN;5PYb*Cf*&_N+%JL{#jP zCwt`dWk0+4ua#}t%;0@LF7a`E37Q=787nJ5LWLs`y#MNPlzRJ-{lEyK3-%4137wDx z;TPYg1FkmdzG0@8mxaKF?kF|HKJ)rFUBgzJz!U5J{KHCevYH-m~7s5+Mb%?Cm?za4N?p#e|GX-vRyeI%seA{QERf zQbpjMI4~^{3cR@4Ke`)gNH{fphio9h0C6Sxk4ycZmZTHR9Jf86~$c{W5g(0S@W*inr z+wQj&D%;yqAMu`bV*ml3idCla0rJaXMH&)b9Ib9``iYtodxmVos_OmODp-eo?N)dE zMcg;}`D7onN-Lf{!QQ3QHxvVGTmHE#5(kb^azzJ2k*v|{wf5CiMO4Bsu3H)C(oQO{ zwk%w~#(L)m)dn>6KT^Bt5o6yRh0gco+X^0^sz$k##&t_7)>C?5@?=!x18I;IMLFRFS5BVN!d;9EnZR%k%Zi)z{1SkokD^ZW0PG+3!T@j2_iL)kweFy;c23cXSd&!nMweocC82-ykvP7j) z&gQO{C0iOIQ%v;DbDR%xvv!6Ld+}t6FrLb0O^iSMf8vFx#2eSQYl25bm$f`53!kUy z$r_ARrpAC#nA8uV^$O>9dzugRN(bCLha){6)2mNkeW|G4K6;05a?yAg*2tY1NGVr- z7rq5#&h!^mY9-xNhZHO6Jf03ZxI?6I+9v1Bsj zW<=iZvVeQkDC@oJP9y1PiTKJ*lF*c^+$AUe3MQuK5Rk ztWA18ihgjvJ+PAs8u@#GUPRVK-``IK9Y5R0_xP?I&aB_Q8+6+z&YWBI$o7bQ&|iZd z0%I>whKThF07am~j}7i{p3Okv?ze4Us!e~n(_P-X)62~{kgX`o#thgwl>Wrxe+F`l zaTH{@n|&lDOaStJd>X6F+1!{p$j+H24f*$6nEuma1H=N@J=8;-F1SSsdZoW^oq+=z zka)b`QmqESlONQ-s#uiX{|DgbC)x)7I*^VA?h)|)Z}|^)R56Jwqqsl9$bI59C?!+P8Z%Lv=$h zv%SgO@IgrYmR9Rc4trC>)G}jXa{%CGV%hB#{H8|d^COZH9 zKg8`FQ_k?Hjt{7-Q^1tB3Gu6qT5$`0wk!Q>YyS6p8ka_65z;pn+)-K$>)!(46uHqf zn@bw&x5tnr+ak?c<7YYbDEOM?3ooXiAl~@>WHASBNtz@nU$(vz(_o*j2$|*xKb{1S zo=BJWFqxFMQC!uU)|tfL&}E1?Rj>0f3PZW$Va#8fV!|Oi-dGwda}{)E!7u=Ok0nth zy~zl=&m0w+NO(pDCVdUeu6B`gWvk7rCt&VF-5l{K9%3t@yLlrFQ#vCPoEg^-Ev@?^ zPCWnqm5stBJEx5s2I**q5tj){d8`rzJ9&mwnvQ0cgI$Q>CVYk=j+=b}fqMZ^(vTfB zAc5D_C%jUVi!NRBC1OM(`7cd|a59*ZQC_f1tOoxKp5N@WSeQ=<{Q zM;xE*P6nv8#@JK_=~+qn7w0Q9r`RCe4-fOM6>i!TtChcz-dRulWuRWT-zQqJ!*qWs z@ac**XjkZw>{+d($e1o!Iwwn0FlN)!!O!{vUdDxaV8v?**3lr&gi-IVuf^sYNKH6lcAY zA^f|-^~;BtNSijdmMp|X6jL0R35W0uhm@$?=k=WRhaL}Y>lxb}H%GJ!G3etqB$5I`o(x>=3?x}cPxK$!A`l)0 zu-^=RB~q)RfRk_GG@NoXO@8MOOnW;o+tud-=K1VMFH8e3spC;wFp8Da@r}VuuUG+T zBB1cqODDtk+m#i1HyR|U1PX;LI>;<035={m^jsVyH><;|4r00e?i+(SLyPtK1XHAN zbqsP`i|hF)^LR3=m66$N5;tvJJCD}!f)=V7qyped-KP)|-hIKKrci&Pi`+hIwmzx# z`-mPF?&#^#J}>ylb?C^UAcc=>Xz4(%G1EsS9+=%@lKyCH%gviO7g(~iFgTw;#DQ7# zN^7F%AW1FpBo41EDaf(Jf)?HzmUg!+j}6K+JOO*?Z`!LIqNXCGkStirzdUjY|F97i zkR_q^eOVV4=8p{SUfSmvNEtPAZ;)a+DPDhIPn7R16cwi-85w(ra7jBjuY0}zSN&l1 z4$F=nfk%CCD&!r&xFIvHAEmx->QYI(3){J>>0`A9xYUiymyZqpN#wW;IvUp;~{;OBR zx^QvSEYKD%@a?o`d+SUp4Zw-Hb*UDZQ0Aw?5sWJu@DFkU&)c3CVtwRhNEq*%QL$Ja zJne0i6((B&zEcacf3#^kQQtwm@kfwHTpsE6^Ry^duYi+> zUl3^zhy>LWnRNQk)1f*57(90<#UP${AvEPv69~wkK7CUd?6DW6Wo&H?>s8&#Tqg3e60~sH`s0 z@X9s6KV*0z=cnyNAX^#5uMUUCPNB^IB0y_c#L7VBlAIgo1WoST^je4nUmPLRTJgAn z-hdu&|9xMS51BQyDE2cv+r6DrC+1_4&8gV@99kvgGtd=uV&O} zG{ESM#gN(34nZ=EK#F{_-e_|1$jjR>1U3?tgY*595Hoej)Y*=K<8n@03fzQ3xgmL4 zcul-FxozV*(O4=Fdb-4eI(P7_8F@i@QQ4fa6nB1|Q$AuoA1c8;wkeKOMu4|q-MR_SH?nFyEe0t3)>+DFM5?a=!h=A7`Ri9pno6}aO`tH zrapRc6*2HgrF=IOjL;Q`1Fw)Sm0lN$KmVps_A8=&4fltZ zBy->!0w@8F?aERFwH|N@LAdqUDLB<){xu7enuh(5EW&b%p9g?1mFMXwPoUAr3>2hf zrJiR;{pG-u^VvZw@1(Y)^((V#Ub|FjMkLcFUXwF!mISKW2>|W{nzJU-oF{b7oIuha z)nBMMpe>4Eg<4jA79{zb@$-q%09TPq(kOGWx>AhS)Rd5q|?;YW@sq^6R;Uub%>z+F@ zg^{^aQ*;YyseWQJWB-9^__5*WNTs2_94E^es23lkz^-*ACXY)8fm& z?j5xz{c40qq~-fQP(_=%2EWX9xHf*Z;Fouk~+-*P7pjdp1v>@Ch~Q#O1LmZS$GZ?HV}!c zNk^nx%FZZo)(j=Tn?SeLXtcLp;4{W0o052^>X~L#oDFg-&i{D z68)CL_7Xf_z@1N*1Qqpv<#_l-eE3i#Qso;f%o=lQohmiezjXo0E1iYy)I<4!1$p7i zod5b|OK0SftY`vBBT&Uj@`W37KqrW}NI}TXfVsR4ZBj=^P z_tq;i*x0u2@KG!=^%HN_xq3yaY_ZoZpk3d_IYPM$!u^-oGHKyDvFW^HiF#$>+^H## z(WH36t!A}0d-qxz56Q#q>0^=ld(JsatzYGJZGi(o@>zo&51CEV{m;)%TWdOx?<{7; zvz~(f*1PO4=Q!)2U1Ez)fHm9v;AO&!7W{&IAX~9ZImlC>pHsw)XKv=y{pdCGq?X=5 z92rj1&G$UPL*s^}YgX>#PoXc12WqQ+Uc#Jjds8|)K}9CK>;&!zRMn%hQ8-WOB@YlU zLAD}w{K%~XFJ5Pa{FcKD&Z%|1)TeX(+vKxdJo`6SBWc7KrVU~S8ZxRXN1Lm58J(Wkd&TEnImEMoNKXl)5sBY=w+lU0TSpafopb2$;;r#04l^@EUhf>OQ)< zGvA+_`sFje2Ejz8)G=6PD<=>&3vd8kF&j7XRF0U0Q?0iyd86uDRcVN{~5b89yl zu0&BgQ?B7fDp=BHJOTaYl{*m5bF-WtEbJ{3f)I}2XYJa%t1}DoG8B`W$PLPvC4LET0?N9;vH$pc@&g&Jh zf*@qfIc+lRHhm~4@aVEIn}eY-74(#hU(Oj^xG_DcLY5=*+l+*QA>XvCT|JAuL=Z45 z_jR+O@naep6ta+0r3jd_4VWyUwr^Q}?Tw)}aeXaqk%Q7a8$>vbCN6J)Mwmy$Ok(Tw zupw>W`#Vp9v_HH*se_bVOR-lLFn=I+7#!vY!hVVl41Xc2zW(G~1voxoJPjmGU6K&` z`0pEMwnlz`PCS(2Xhi{~mz?41~=QMK}8d}F5N8b49=^yC*11{3PnzI#2DqjVX^X7_@T+WE!*psaGhPA zlNU@&6hTA@Z}qI`4J_tx+x7S-m|?2c@oerI-%<-1;-Yl&51Nt-1zsa5(b8<6#=#IH z4KdbFmzj#dAo+W48u!M~CNwlRNCpZT^N{wpJfhYWbO)PE{|LSJe5#X8xGEo+-hS{w zXYc9HAAqtV3wc!efL39O&|`&xB*^IHjC|X}Rx|*y~R|h;geTfRc-Ub$uj8JAB;VDPlH?)s$} zLXZ%+T-vd|{%z!8n2^t!jnBD5&Bm>$#kGExOr4Hy*$WWe^Y&Kf^>#sQz;)cHZ;iR* zw9|Vc#&$GP9Vpyaedy@qR1fD##vlN^jA+7FS7zNgMod1YV&W=V3Fv~W;|+;k>_ffh zw9NsUgGityFk%6cRKLhI3Av%qMwUfa2YTKw**7|iTiyboR7gHpm0GqGMB=LFs0L)P zhID%o%if*L!Wt9)IPGAQfJBtP->mtz>1n~YInX1T(NPa->Wvj<$Ebf~{S;{rGGIwC zl?k51ENi&lVT>!4XgQS(AGW8)kY>sXnzoZ=I2iz$#Y9zXaS>7AJpPs9jx{Sm(Vt$j zPW~K`61HP46g1fueg6&0&H*j{adWox74LG%b4W585Q6RGIa>GG>DA`v*P32go4l?p zS|t2bWsR$3i1twSQZt?>C=uv>lf56*^EPL?8o@b(xfA=rBm1S(6skvS^_x;zmU@Vj zV)3!Ce4W8*m`+5ZzZ2tT&mwQ|ReHDYwxTRK6%53Mh(eZjBQhkj!NiSo>Y~9WFi>O) z3&ZuV!((CMn0h;pv8YJI*j}OSL=^0RT;q~g0u)3!+M+OJEQq%FbwWDZJ3DS3zV+yl zX?cA!;(0KdEpm^-dGF`Pz;>qB`bve?cHs^3@XDMAEIDR+cVYpoHqzMv6jieP{K=Qn z6g5mU;QTXCZ3(5B!m4-k47y|_aW;GW)$pum0KC(Eu zGYMioMcxzz-c<~(|AsLsB$gO*UdfT;u zzNCyn9pt`>44SXv9Xv7S%V@hvFzXxWRyI)D+558AJD67>xz0-pxd+^b_N_X*YGy1yn%uXiLs? znbdNNQbWkt0IERnaeYL6@=s^>A0B~W^vzvj9O0^W*y~9$_ZubGG@;7AVpx})6_Y#) z$6U$fCT(jX<_Z>jJM-z4ACJ(KZt<(+&5+FQZOuNL*(3WG$8ghSS0VLrE=1C$6prCe%m*84 zqWcEdrB2{g65yKXy#&2uzq;HmpqM2>r7U4yRR%DLw(t?yQgu3TASX>@OD zS6j*xec~r39YQ`qQA%HHGqEMxfubnwUfaXA&J*rN#l~kD0A)N-abvFs7sm=KRq^Y~ zIZLV>WPm4LsA6ylDrhIot5P+j%K3L9j6fX0-*!lu>koQ$Z@lwmm;Hv zLLY11%8w(1e6O}l8%j+^Zkw1T%1t4uE1$VwJhPMehbd{G8Q_;1kg`k0A4C)yV6=52B6)W98)_=-Q z=Vzl&m0UFRDwU8(N$df+I8V8@k4{WE_t5c&Q1vxqJixyj7Y+Z8x6!>E4U^keQ zsOz0Lmd_f4BhuYaQXoBv*j4yq=@%2Ui*OV~6X%Utv2XJwOdu8V0w+Me*Ev{0wmUf) zEkoyN-s&+Nc|+~7a+-=-C*9QVTO%-MWH4vsF>Ye#ToE!pNd@|9>EoGm!-0@JpB3C4 z#2Ha;IYjg)rv6v2m_5{~IA+T=yEFAMVoY(Ie@WGQ*Cn12wIu$n9Tuls`ZasVcv3ue z-Gr+bhi+}eHr7NKBGy%-fXS)Lebx!}|DGwalheSoQ477cV7r}@y}Oe=L5*>UJEGp} zAB+nb@5z;4q*hIqM{mr6=*W^kQ>IQ&_anqjfSLZkdj8sIIeK^tPNXmw z&nabYJVMdbwliHio;)oL0zm@Lc|OlWzInh*lYF447~zG9Qf>6Vo~>}cUJalxewy(y$+D674qp55gswY`+#XI}A50R;|5s!B&o}#ucJ}tsyk4y)s*`4pzPM^- zPTmJ*S6F;nH@9}pdSHNy8g7iMyFgw=?22D)@{5*LQ&!b!N9ljHr<24DV;jXdC9lDh zGX2H<3$bmsKzR?Y-+G*FW*|7NHZZj_kILT7d2W+i@Ou7xVyUtw?c6!!QI_j+@V-;3)*7Ey-08m?(S0Dr8j-v@5+z+ zBO@bcjB`%*+RNr#b4RJG%AunGP~N9>_Cr0XgMDbO%xF{s3&&TY#0ZaJdBx>aM{6>bkA^E>IO8qo9I^ZK^a{Y zITTb}QMA|wn=Qg$Icu)<)@V;*Anbz*+pA7+V%gRNJ|hPh3W|4ArDib*|1;wL?%8lN^qRf|DnkP5CPuk!#i4c zpgQZnCE|Vub6u&no}lMI;iN3qvQGj~HM&2pX}CVCDRh;D(_+N|o`$FOh3*S+(HexV zLX`~G{M){1Wb=%F)2y?WgfSZ!BPCUksy3)>eM!rXYC+a>3HD28w&nP80Ea;m&wO`= zMzz~W#2abVdi9p{=a_@}haohC!J-FsiGhk!w}Ov*6JcA%icX^;F%F(5PCS%(b4pLy z3r3DTyPhOfiEykr=L5Fr$QMRL=m-l3ZT|(V8k7Bown921)CN?H3jrdG|H(?D8z(XD z`Z^v{MNH8;D_K90w8@EJQX64X^PVIBqR@3Tf^(UaV5=Hl_Ds8Oh{mrKWsi`66G&I8 zvnw}Hg!pM%(*2_^y0qua*t_-Zx?#ji2@80j$1@x#aick}_(zww!@=pcI7CO!(*`^rt*!dq!`$ClvYQOM>+Hw`DxQkq1 zXqgq8C1)HLJ~u*tH<+8t`jTz6GvxH!aCw^hkI=2wqJ=YvH*6cD0i+IQ-c3sB`|L8= zZpgGm8Tb54TUQEU=!S0{%r|7R>V3GBz~~wGC#b9vX9g0HhMCp_v`xqZjqPaEVOb$D z{7VUAvW0fW@X=MM%%}UoZZWm!S#t!G+}mMOob-12Cn@2w^^%3nTi#&w+%-}9X@UqB z;U4wno?4^qgL*7HGOB|G?4@RTAM6~gJ?j?b<&I6+1CcA&RhB9A{-b7aeZsc{{D;z4vRR2Pr@LTNrs+!~($TYC8a zmQIf30`cOnxR!b;!_E;5%`m{MiTlrmFb7%@#uZ%!?2-J8&ix$Yqiz+ZOE{eW-3;Mq za?T3E-5c9>?>emqSt~}^zQqYN?r+_ zBKeRp9OriPtKDui)KiwZ`^vni63Y?sgKSS|A|Mz|1JqXR&O%1cZL1$m+eS{o=L=$( z<^SKO7@7}O5HL?=4P2ydOW$9G2tD_8Gq!&d`MT!9+U`gniy(?dQ`e2uF^3eV_&x;s zE@ts;s3_3$@zn+v=9E2e6ioM(!>jKD#Nq|-MtTylav zDoUT#$lR9T-C|h*d%D&tL)VuVE(-Li1{;YFcu^4*3HPrjs)z*IzM20OH#&>BpsUuC z^ckXa*GHt+^$>mkKkX!6TzcZwC~~@HeQBlO*tL?)%2=2s6eN+4q5;skh2XhHRUYm6 z{Q4rizT(t_qa&cECcM6W+t7+$5wdF8vpH^U|xjr z!(ZK?I;zU)(1~o`ZA3<({{GBjZ=mQJbb8>;TnQrHky zQPR_rwAj37kXP&eO&#GZNQ(%_!DicsJTQ4s!|!uiJDbj{l8X7^<7(Pk1N~gA_l;Au zll0O*b(^~-J*7jgdl~xa=om#2{n-#Rnvj*_F}6DH)}%bln1QL9k>e8uP2e|9onAzg zipyuUrq=RsX4+tz7m`|Jw>oFO6g~}t2Q&OB<;rZDEw#2O&$Y>Y|-Gs5k>AQVC0;d?G%8Ve7 zR&3-44!(-7jK;WobP)0KjQ;aM2LDZ6;;;Z!wCfuQUc2wdlzD{u4Jf`H1g!XB3%7qT zQkpR6Dt15K&TOB0tpok6=(Y6W3DO7(ax_eVcD-BvM4H1I%Hw66Q`5m@2J4cRpCVQ! z9A*pKN(uSA?CnJ{Mwn*Q+r;@<5Gwx;xvyU?PD$_F|etg(qd;jkS9HBp|_P?yigiVGJ20~5%d@Q=?I zXj$v&gu#J?t6040nVF&5#r^7bm`BHU8uK%;Y>yQO#KB-Mq!+SNhQSGG2RB4zf<(uP zZ3v_!4lR4V0`kM?Z1bkFO=EcuzQGksM>R+KlLh+l$mJxjK;(EhO17W}ij^vPe`0dl zr0`_K$|xz?^)+bXmfz*^#3x(Gh4jI~sJux#hsn*rJWN-4$ zN=jo1pH$2RFlH2xu7N>)bLm4W?1R!*jBj1V3fYuK{HF5Y>}}fM8zY9xmLm`=J)l<5 z)I;1;D*mGc+=q~wr=y7&ocw=y+LGqw9GlD5mae#n-6Zqk-H_6bTcEl zJzb3V?4v<=BKhU8jFCc+vaxeG!Z57TU0&TTRdOP*7PxOzkET4d&A4Ry%WmG-ok5FX zRIxiThH+3{EX2W}X=~@AaG^DT{$sUq?*;BYRNWv-(~7;IvIXO5Z8fGnnDk_!0hJp- zmTd_?HBR0=Qr#JnJP>a(zXmVg;`v_K%U%v6L;Q>Sj8>wC%jibO{AXE$jMl_>ruOHp z5drCvqa6OV{+kM^6Yn#0Sm>H~|H52ua)hMr(2$Dw<1xh{e4-^@@Y>)QPi$HCI>5^| z7WX|?V#Iucih(<9=73Mm4<{}ub6$gtUGFqQSiP-|g%1wTWG@#(n!jbnoTSt>rzeGj zQ?BYA2p_{sIYd|Dq!BT|zuk~pex$kZF~S2HP|{S%rSvW7Zk-n6j|F$rXX8Qa#BEci zTy}n*`NegF+7Tp{t2`)NnuGFA-EK}D5z#+gxytGJc$^E=89XZosnUSq$wrJXXBk7mb9o!6$hgn5k(&#+4*8Kd&!7H_O z1%2}6T)FiLaleEPuY>T{spq#R!rmzF7l*tz`#w{1m%gz`{iIG}=Fo&-@bmmnn=n)q zEU7*G-d@}jZa!IcBd2K{s1M|0Iz9q%Si9`bfS!+9_SI(v(I8qBo=%H#EA1@yi;d_^ zA!Kl+?-@%mHo|n)B{dWTf7+20%#DG6P+=OZt%ZkIfqdE{9RO|XfeG>a=-av^xnFJt z4ONFEeDrvITm61H-4SRt-k242;i!NmT zSu_HEKsCRz4!$&jOj<91&^2jddnVQWVfcRQ2le3Kc+Z7s#7@h*j=F^}_gIS2t_*nw z(3Q%s^ZT+6#yGd+Vi7&rXwOIdPSg>~f5u-BO%^ure|nqZ%!hs}i!(5MK3FE?f~9v% zimlfIXc?!NSoq?iUTkcv{9kwe3cHQoa;=1E40=|h_=SCZ_&bFuAOhP-E#+|!WBcvn zakD$``_oF+!3jp7mmG;=Ox+|WM`UiJezvd|IiVUwf15ByK||Ik&=Lbry0F>xm1sO$ zEG*d^sP7BpfUbwl#7dhT6m;Jqvej?Jj&6ctK9DgC%lAZWmpY#;xX|qDNT|_q ziHjm5Vv++L>@fEZO%Hys)7CZO0@D!rPKm0F6hr#0fi`oWPQ=~O(8&VS)tDL8_Er#zjN79NkkR+315+$M4{Slf@H%#YRSf4UhH6tC;5I7H>a3LXlyy*FR%4L zbNo-!@R7)2HZ})<%+Pf^DOXz*x=*(5{GYZa3#8?lDc;hvR>FGa1GMIl@+t>jW zeT7bpbAQIbQg6#&BzStJ9;(EJEcS~B_zo$H%2^-+hEj~{O8emtWaV-#=a!E1r?*HE zQs)mMk)tr80zp?0+||Gx@oT$_aWwPv+*h`Zk@Gnc7x=>BUI&bXO6(n?UQhB#b{z); zE9r2z6R+~CurAvQrfor71{*g6zjwaQlf@igOSBJVp(27B7A@4ihqWNBq=c6(N55-N z&&Umr+d^K!K;_XV^G}J-n^M;VV5HskbI^ftLk4z%0)VVKUcjZ9c6rd^(br`#0ag5N7nU5NCQNf%PbG zG#yPnEB1Qv9dG4?{;0XNsl$ehL-_J;E0jR>kCIXZ1i5sY(Jv=@_sF3}=a=1f44=Dd z%>-Re(y=j7bN&SUO9ci&+f^09L4Yn+$Z<4W%>Ev3Lic}6$Y{rYIIOs~xF%~xCCa-A|fd-X>yckCG~Y^ z#AuJ9ySs-(VTL3oYXp#vQ>;YdY~w@t0FYB;GGeU}0Z(fVr0x(tar(`zrixFUqT&CG z^LopkL;?8Y3Aa=>rdWuG%Qc0a#Dcc8wmiuk0+s0*THvNO!WYriGDdbuS6@2U7}uf5 z*-2j^6x6zJNd~cX^B*U5jU>XWa4f>`tsN^QKY6_WSp9h*^~6+5DA$PDHIu!ur+1PHWwhbbbc^2SN$#0gB!Mv9)^csDfwBHFSNg}L6;jliAO!-(D4%_ZnSrme6-^?emZ4CZE zl`ppkS{aC<)J=WU)DHp0y%*yr`9HR91F6s>All5C%bbnk36;`AdAS+W$TV?@pg%#l zr!y>;u?g`erlu%$k9x|gDpJMTAYb77*-^AuI^1htc)AothSce6Jvo<@bdB|G}?OOY^uOTpYS_*%H~A{=S_QC2WEivxt%1 z?_}7dG+xhFigMw)PFkF}A?XE@q1B_q9~#@txcMU&0VfyE(RF%=$d>>2gLe4f>1ohr zef8P@4CvW!{Ab3+SXjZ(<*fOiRV}$|2pFM6F>xzO4;OBDo zl(RP)ZU3-b1ARQ=nbTy6yJ>RJ{(tZ9?-D#wB^m{wl?!oj7WeM#;L*|171irk^6=a? zx8RnH+1B;g*L2xN5$7zNpr{JiFbZ)ruhxvCno=bGP8T``Mj(`?CrbL4Tx;)wxDQ_d z0-U04i=A)0yg3QF{^3zHH;QJ^hRj&j$Yys6=pFvc(7}O?q?Z+@kdV;i+FCpms-ZhL z={=aD5*ugg|1l&`R{RLS4COBfic-$jE)43n?y1n0Q=+ykDdiL{kC^3%IUI6PwzC$b z?LnIy8<$f1Sk7zy){NJ^d~Dis67fgSaW*=rhdi!&mFD2C=k%f?1Jk49hsOT?K30@W zjWTv2lwpq$H=|oN^clo5S_3kN*)?4aryNFGRc4|xL5KiymmC5s5t{|rXc!o#CMIu^ zlarmBMV$35HL{bVQ%<;2w7yeQKQSHQYo>!w$5KC8JJ`tBD7?Rn{;963E`L0BaAXaX zHsbtAvOGDr6r6cvyOV}jSn`vUm31|pcgb93#rCS6_&N}64rN$*$A*p25Y zrjSN7Sv6tbCq$6P!sd-Hh=XWw(02362gG?e)GIV7u{=4u8fVOOCok|W%oIzSdfWM< zF^lJL%m_xr?Ash)0yh3rt4{^hDsWArMB*6#rOv!}b2D9nWRA+m5gO3E(5l~j*EiRN zS!l94I%(NwGjjcAuI_J!bjCM(itXfwMrAxD5tatD(n%?#HEg-6N)5X=x2>EHRy?%k z=JFe=(1;&e7}&=o6ty|^vq+q8rUXeveQ*|u=QXr+!x+$}AAa8Yg8Y1( zxSSj$1bAz3EfafXuZaOY0ETIeHN%&dv}d$=z=glzIyx$?%l?F}p2Sf^{70mzy|uI5 zAoV2V=~v(~FD3%~2{E;PCoOF*6pp|tDhi*riZWY|69Rz{5fe*l8XyY!wQ=&=1qW)! z-1ZCA*Ym-$2w+S!#C+6}LzGV$Scr*>3pqGAl9lsA)XzMIPEJPtUL)t>=a(+#9^`ZT z&&!?y!h{@Sw&cs<=MhDn!?io-45bKj+^pmrM-r`0d5^f01*g zU;;~BjGUFJx>eJ3DgZzmJb5*taW%adYDi2E1KZH9=ZL5A7JfmQhMQ2f`By_cHFw*{ zvC$7`8Y~zYq|l6@TbD=-Z1)v|ggcGn7a{?T#S)K+0!yJtZ3m=3kq1-GxTRxgh0u3x zqH}IdKMLVBxozLQ4b)W@N_W5reG7W$566T{NI;N=b?#@vr-zLk@niI))~H~eLP~&0 zlH(w#J3oBQq~O`*f2sC?#-%MNnb)Nzx3H!_d=7)UwzaN1&cQTb_sUj7zbPD9+TAXF za%|g)yn`KH4r83cD2dmJEy=q$GxALa*Z&G5W{(g;d;|FI2_^O4-V*Ie{v$$@7lltv zm7BBl^*VX~3>d+PxZ+~kmbgCC8eJBGV`HWJSYgX7CRVzHI;MWIK`iT zx>J4qXn|FnOsS6OOjxF>{`*VN1fjh~#0SV{c6L zz*OA8XF2A9)f4@k`P6no=swwv=MLHvN9V71X%LJM<4#9EX-?ppqCt@Jfo1bd&Jx{l zv&$;rw{MHk^W3jg=ZA;AKxUs6dwszOl03%FEjJFL6rd^#F|39}M3BIm+}J4cGHzdH zefo-nT!L!N%KN}*X0&y{1%@2Yy%$5IfzHFEOa+2tz3{PJ!Yv*R(9qS3AAl6+`#g zm3oTo;&-RmbKvu=ri>sDIte!B0 zXFY3c-2kr4dhgpoPFMGyppMuwsn0Z6vO2`kQ(JYxk%Pz#x9K>}F8+#x0k*hAjX^E% zMDeYd_un$ob2EcnJfp`w5Z;gFa4hBQaDjER6S@fFKekw#@DOuQT!4H{khTN1e;JH% zSo0h>oCW6&LqS~7F&?UHBtva#;G-{xz$9kO>icrZn1WX}26}p|oIGiFwl^`*4_3X- z>WghT#Y^ZaBdy`#<JJs<@!5|Fm798 zV(y+^B`d0E&^F0ikhIBGN)B%XuO4Ru;?>(h`yfwFL`_&$=ueEL z3=jw0(C`3wM+r#$11T(jJm(nusu$Ge=Bk5B+iIM}Owet4Leb_v~K{ zGVWCHA)*P1uB>&Huy{a`v<(MTlO)o4adWJA0IA2mFBRF?q5l$rck@`+P^Lg@V%6Yw z5lNO(daL)CUOOcCp#6g*ild;#_cFbh*(yPq(y)6zE0MKmN6|UU`Bfr;i%hi*H(~Yc ztgxkM(`$6*Z-%q);`&fJ12WMf2t44;%F3!C_v*qzei2Z;>G-u0HnfCmF!(3N`<4dl zGaG3SS-})V^ta@Qz^7K|l5RronkO2jTEXvnKq@cq!J!?5CnK^uk?s1%t1to0*ys~} ztNzmD3N!{e4mn0CYrPBEtU&w6j(?kGa`M61S?O^o8fn;mT$R%X0pUJ$c`o$in30Ht zL`pk=Idh|~&Zy!foG!}Va&BG%QiCp}VZT1?AF1Ge7Iw?#t0U2;WaFm_9|LE@M zoE(*$L#plYm&RHeUJilUiN$l9`+!c}z#yvs2!*GSuQ0z7ldcpsaG9qy)7GV<9ec4a z?BL8^O3sTN5d9Nsq!Y1Kt86&JDx+zJsSjZO=E{pKt%y$`Wqi$}UHH2M1tKlVFvbS- z{Ybau=a)}(Bx7WRZVNb`T$}rPbcAE5_B$AXi$Wz%#rl{CEW$qM@8J2JfUwBN&d#9# z5uwf5gR9+Sw5clS>dDaBro^qf3W%Fg9X#iFt!%@&?`fJ}8m6p`i!xQ4n319CVyp3S z=Ii6I>Gf?BxUm3vm6er)^1Eaj^goKBVI551QW3^Pm z;4^);qwg=y<;hjf=+|4<>)4y*!AV_li&FdI z3cDS@oUa~D{z06p^O~xlx@9M*kc$}dQW?78V?N;`#F&MJl^TFfO&axq^qP9(s*41P zN|DYskn(M5U#vnZAg9CV(!-4g5V~p_I&k>G%|12x8SxMSK;yPmvK?0F<{pwGH+f70 z*(!0yBz3>?5Y9%@c%bQ25+~R>q{=}5gr?N+CQ^jHZ0Pjsii3EGf3^T z^jI6!hm4S2Z2GQrRXW1chj$=_Lv+)#Le`JNrwQ`|`tIu9@e{Lh-q%l@CT`=|mXuD; z|Mkm4Kv{XLiwuPtFD~i8FD7*Js?}WO(+5&nt$H;y*^Qfro#Ugv z_rqr2wh%l$I8E&R-?Al~0n-myYJBjS zvq&C_E@QvB#N9}t_g35gS4~V{$k}0yrT!$Zu`pmIXdD?)CV+@n}nB4FQEy?szJL) z=d1}|B*1*E4!Ldi*%KNM zx>7bR2jyF%%IqlqX}y(z3aN7bzCdG83&@<$(e)6 zg+&|@@m@p^{!j#sTlef=2MWNk+@<6PUnDRa1 z@)1GnyJZ2m_MIScAHz5+P{lzI<>zsJ4(~7}r8WsTLWP7_AjFFt2J!^sw3oi!nHA5# zC1lgtcR1XAG(D=ALKa`y)K&RrT}nH=X3y7SioK1pMxCL;S?T}Vj40~6_QeCaVs?V{ z$N;Y~?B9)cz+3) zhZJ|b9gF;W8p1R-b4qc|(Ju99=8X61s&+eev#HkK z7`NTj6u*7e&KoVa27ow0_t&G2o0?*W94@bZ?nb|g?Vg@>;wIp#ot;H-OdWZb-w{5x z)hCFIANj8!zRYD6-WP^wTF><&Ts16KZ~(4oeJy{Mc_4Z%@r&J z+NDpc=50T%p)OWf9$0zQ(%Z*c+^?t#-q)>?QJ_7-eK6Koj~3rZBNM`*w3W?qCnso= z{>>MU@KST-+KPSsWRmYz=W`(PozUXUq!Nfu(udzsegnkye|@72gty0_Z)a;GT@WV9 zlQi?Ofzz&o^Y!&M1hJ8ZCrr6b-kH=cm@jM@h6a|7B8B!iYc|i?4oLa05WvO^usOP) zje$KIiwwl|oBbDWRYxnBUar|CCa91?`w{y^wvixDNH~Q3v&Od5MEN=KREs72UI3r< ztY*5l-3LpPL1sqDKn-LB1mDCw?XUgcRh3oZ3p)y7`heWgiGe5lqeE4Gavw9agmxh* zB`%#irOqhUzs?ghug5`*&msH=-t0{0gCh{{9sH^Ci{0TzyLzKYvA>0^+xK$jb31&L z!)M~u+t-+3#CR?`XY}LJRS6s7q}knPXSw-i>-%nnW`D0vamzB}$NCs;dqRUyB6`OJ zoYiRdnDC`*BK3JWo9hpJ7%jCUfl`-lDKwTLSXV#Cr{mW5qh?8C9wZ?JH`D&&`htWm z{?LjK{USoPiszT8>{R7tTH~hRs0l|dr7s3xtMXavqE2pZk?RlUJfq;>Ki`T%lCd;@ zM0Gb<9h|9;wu0vD3i#7ObRjgB5*N*)lXkr3{-HkglBKgf5>E+n3E-+9apYB6u3Ub? z#4Lr1K@~k84=T-l%S7tA!I~kc7+m7E=(`bH_ra9!M6_vgM5El&G&zf>O#I6b@$rl0 zhuLJ@q{*s`T0+^1G04j?$Q;HPh9-c%K!jl>CFegY?`QZtz^wv=#EUKJ*NxjfeM$$! zpGJ~&_0y&O0^autM-X?QlefJ$LQfr3WtVuIWft(b#p#~~TGQdlkI2ia$RWCNRc#(* zj7%=Br1Ws1B#nQl{)sF~Rw)p;Bl6g~z;V#}e!u~2+6+Wcy%u|6 z<&vL@Y?r1x43tl2SNz+Vt+ibV5ME>8+q@#=@xG2G$Wxo!Lj6&9ze0=tdYujUtdxY`FbhCQA?7Z4jd5f@5yIt3`w{$T5@0bPpZ+{gz8|w=X z#pCMnpXd8l9s)B*J^R*KJkH0v$Hq}pf9K7Wk1b7MYODEV4rlNl-Ns#jci+IgrV2AB zPf-_3234WPHDFe85JjCc7VBY@rxadKw!Ih2E4Z!al zgPme!)R*w(o;v%tGeQIgd9TyjLU1|Z_~u|up@82Z(>R%MaN&UJ_EIrwb8c>sPTpU9 z)nbC4eUCyedSU~wGkRP%z*FNhf*(e1{}3d?Wow7hF#me(evCxGWv_xqW1nHXD#ze_ zFP_ZX?g`^$u?5v&-5Zr&EvFwEuza3HhFHKY$gwv2H9*)aDX}$p=c@FV)jGEMo=(ya zD%?X3lleLRiyk+p4PPMK(vmQz2w!mBJomTHA48R_RKd+);vBL#>(f6#15I?cJkc=J zlnCz9giTv*xM&!Co{@|x`x$XOk2;yRDhmHSadUjQZFb4Cd*e-h0S)F^#}!T^Y)ULG z+_?R)|GBqe1xJ}FA~88HEOtvOTj)2Yn%EQ0BYgvs;LXC#QuR4sY6Q`V?+E+n-rv-v z=fkLKgV`) zY;jlLfM$^c=~Sl3Z4ZLy(hg1Uy79OZ4gPpOA?FgKddVxQj**~eO3X_<@}27z4W2DX zX;=_0ug^b+ITRxi(1_XdNaqk(z>FJ5Djf-b&E=cnYidZ!fzRY_)bpC@pp})%4 zJ^EBsYVkp|NosCfHbkr_M>u-^^Lq453JU`r`new&LzR<^n-zU+m2q#-3%$DWeB|Mw zi(!j5Y>>{aVU(1hY5qZTYTCv5j4fq$u8`vt1%pf!wK$Xfu^rAwj8OFi(l=vRMsGE# ztr<)mal84vIHDysP~-8$#&d%)4G(^Qn!{>MK_mg3@@aoq6DwmSSH9()Y$5GigZK^c z7!TZRmzF)NZas&YrB4!@`*6cF?kg}>%Mp;)tSz=)8z5Wmml3_xHoGi_v4n@9dN79l z4CTZR{AAnR?MbidE^uy{h%L^@vw2}Jnmbs((Sd+y%*4HARsT9xE+k^$*jJ;^oIAp~ z+47Njt*UYJScmt1)ob9Q#SWoe!=}3_+4ABPkJ|Vr$2NV2{xgea!n*qXt1t6fdE-`R zPI@z!V)X@I+*VH;0^Pi9RHG>Alw}IMRiX z^rB+@LRxsj<}V12F2-VSq7?3|W|Pf7$mNrs05!CkYNLlal{SY#@9`jJ9DqTVFtBrG zL%OyNRt{=`5Ir(`$0MDsFd~O2XLJ-XCtD6OUpaPW261eBtVHGP@b;kx;2IOdR9_gi z!4?6g;vyo?`>I{qheW*micQ<&hKd9YF|d+L^XF}w$}meB?mKcf3uHq%-J$6p7$_hm z3uCWku%duwRl16_N7aDPFwiA=?Y_>RN;v5-`$i0arpgZ&P?S~F3JNQ+AzHsf0y@ld zg*g`1!xD+%W!f5YnuYnej3J z&0dY;bA;cI&S-jCLx`WEe|fD!el872zVE2qzE2ZQxhGsso%;5&)@F7;u$*!azx1ls z6t_(=f>S7E=l6+QdF`NLAt>eBa<5XE{2)WjehGGv&B>cqLt z=-hYp(xWqhrblL(GXd?cOYK6sz;7Nw)!Koi*+VxvDTue5V$E8y>b-ITCb*#-bElA8 zpUQlty<6V@pT^fme8qC3H$`vDlCP+-z-kyH=4KBKjTxr|D6&|Mf!jLW?Bs>g$sCX# zAYQ~*5p?XbebymMCr8xGKNP#7hFn)SrMKBI3pR@>UZA_AoC`bDKg|DCtKv_vNmc2M zh}gnL(->2X^f`)|#&+FtY@lOq1ahxqE^@5J2~V&5-8z=tH?}o&v6UXjZCuD=nX{V1 znq1%4(0netHstF!B-~?uNT1ko@eLe}U*{5Na$;DY{~rne@N0#~*^^|&Jvn1;xu)%7 zf?A%&_76Ogq)btwbUIwQWi#C6<)L;#a|1zWp;}`|;fshnygSq?ZG?3h5~V{9t_$Jt z-KvXZ4p+y@p^y=AQ6{V$xOGt|+;N|3y=S>C;IVkz+EY4=)W^n_Q{KMGr<-3N?220k zFRbr$H3G7-+pZ+72UtgL8Y`RF#MWDXukEMa7(o7{HEJ(Aw?f`0vupQnsv}v}Dg5Tc zo7P%2s4QwRUMg?Qa9q9JwBR^6^sOCykb}7!(H_JV(lz8MM=lKLKe>m9YI^S!YdjBO zbN|jFmGEsMH1;}aNKU`2X)8pRE>sj;4h~a}&r%*AY{sEZ#&tzw*R$KNhv_LoG^!(1 z`BCfosG1m4x6?nu428_uS-fZsCTR@2G>HhC>pQ2}s#}$$n=lR6F7J;tMJn7*PN^cw zQ&QgbXj^QhSQ_lA{16V-7sa1>nYsM`S=tuFyHXNuk0eS)%o8X143-RGSZJdph&pPm zv{I4eHO~z2oa``tfA`dIKTSO?@2K9rUr&W~JyP}jUQn;h!B)~pniW7o!ueDELuvEd z2io^#4i(Z$2J{Gitx$OveZUfQb}oGBr@q#w6iRMpGIY_xU!y-K7uSMv*CgvT+jIW} zUb{CGbQHqlGQk58!zcBPqW0oFclOLTY;6gA9}zf&z+czQADyc$&OUnC{cjcxBB!xi z>UzlLJ5c6pPjTu$bDZCzXcvrhB4bLH#%7R{!$Nz{$tUvlIaYZGFO^cblPEPqkAa05 zQhY*HM3Xmg6Kra3X-O?ktD@SF>iP;mu@M#Sz$*^RkRMT&-0s4Q5U7cvDbv@?eBXms9&Fc zOJ=v_M$|sL>v8WDhVpPHmoYNSDp-gLwISx89Lm|bal0xqX(W9iOXG4?H=d4d?Dy5; zohc08^5AI#x4FHG?l!J(;59X|2LN*b9-np@hS_Btjma|_5$bvP!7VN5pJrzVRYv5z z%!I=S!l5hB@Y~Ao2*n=(T6s?Z@RtYT&?(oiw45eWrxl#eQsBDabe&&b{o#NxWJomV+T9B#XXvIB zrqBg(MM6(hrZyst!KNo{xRvGf_|}IcJr&TmZL86GFDxvL=}>)QP1RUd+WvH$yuNEm zSEC~7W!W?75aneowY*E2Wf?z#97_OMW#y!`<&c(Wx}Y{pT~O+ld@=a<-pYHY^BIHu z0ayQZNZjI|v19rkO&+JeM2kOce+l30yqmxd+&SxNy1QQ`5dhW8s2Fyc$xSkci#y9x z)5gXwur1|A85e-1LrxqNH^EJ1^V^9o4xZ5R8AiX9Xzv;r9W}>7z_u0TE|c&HdaPB{ zFcrev$X0TM)1jAh*-WLZtjy|rg$%jR?=M~+>@s3g9XRuUOgJC>`#OJ*_~nX1;cw9Y zaRT_m#EBO~|D%al>i#c(6R>=CK6ib&URfn+#z#)3iOnXOlFsDUuOf7kWo~dej>EhQ zsxK-1QC5KafTihGiP6~!3uYsh_V~`fI$z}DAMP%^Y#zM+9s!&pEz8>hD-DT3Z4wB7nq-3h9(Hz7 ze~}#Nybn=}d}V#bAWphz3P{26St?o&VW{pjr1$4O0u9l}^qB^%T+e^`+WDOPB?kKC zIl_D+Fad2PqmAErsw~l^Mz>Ln89=1P|#jU(8oH<;8+>; zLpE}5_p(HB$yA?&ZA;XU$;k<5VMU^-ubtDh()dVfc5Ihc?m;o$Q5iJ@%sV#EH8*zL zaUiRFsQObVbfm#G8NF47(84yd-(RC+qmsVhb^16~YeW*rPCHxj9~PR{EM-JBV8@l9aAZV%I-@dj zFL2-rN@X{but0_5K%;gIpR1HBhq3-}2EZ|N)e$xcgw1r>s!661(4`WcMRtaWzLtk$!sTbN=3O$@rxqiNe$Ce{2x!3U@k|BjrMTWl+krMUp%&-Ip{mMoY z1LR24Fwm7Gd{ExSiUaQMT!NJe`n1sQa7HjBUT9rEOzTF5<`a?j_KvbhZAS9YD4||O ze)O5p$lcrD1L2A0AGUU^kMcJ{Ur`l9!`9(i@4p zkIC#4?!3DGMbn3G6F>1Zdu31Xd zDvWgXvR|OljZhW-sP+?<6s`FrVq$6)6H`}G_!rUi%#R>t&aaz^8fBJr(3P35&%yo- z2;m%x{O`)kQVlG=@wLJB{Yi6T8fG%oB^QR#4r9m`dAH zW@9sOKS+aMAjG*aAN+HVfTp;3+t-%Mc4P#^L$uB482CMnP-E#4Pu1d8EEt>hErzgb z6<%T7xPeu=q@^}nZIauh*1F>Q7wSxXfW{~Fu*Z)~X|-H<`@7)wT9nxvm0yCQ7g}fN zO0AzwY_1c&9v}r{h+f7-fBXLFD|m+G`X-^Ev<+^|gSTvOMA}Dzm`kyIQcxtiSQstI zyE+n2r{~e{FNPao(&pVGR9*dR(y-}{4o^W4UnVp=S5&X~SD~)e{=tHvjFfC5%m$o~U3-#}?dGYsgHkQ#b(DzFX z9lfB;B_=KHz5IMI`TMjgP^}#HddR=tjsXU-WSk~ivAI!7p3B_E3l&dgYkGn!0-0-{ z9MZYk3i8Oi8<=&zC4P_I3Pv-ZR^g)MM=ZW>X%|5C!S`?vDapbiPP+yxnw!%UwpP4} zQyKfUU|OxI6W_83OJ>4JE^wW9O@E1Pc;9zzy$x?`RX5ZMK8YUDyr+x z$3{gFUq{2m2@fu~*Hg1546}%n@utrH(yO?@;}`Gg`c(fHZQu3pH?(XF>}u3cEjQ}* zyi#V_vT|ow;X;U#SbVS`DXMjVrh=;0Nqv#28wIj0Zd%Z z9XVsxHny_TK5RdkufAzOC6+HYE>_xH-CI}OpQ-A-ZcGxZ{F;C4JDr{ zsn-@QsD2k_7FGWGp9(xP zS_NPMiv4l&ftDh3!;V079~%V*_F*b%op><#ZHi7RxX}si=98@Z^tdElhDgpL93e6I zpKRb5b{0?k_4#j@R%-@IFEf4K1bp3Mq%#c_gur_JU?tmsjF+Dm`*+SA)b@T!{0sqB`&xcay23Xy8NMH zr&5cdN~jl8dx(B_@L03BiQZS$680eIvpRUX^;jS>F(J1b=ytW`FVnIv4Bu+Hu_V-H zK^*0ZH}ZbCP-4eNEKu}cqf9}@kG2wRs7gX5h6q3`xtL#8x>zZ;FLPF+_rIf;xCaIrd<4xgS$H&Ls{mIc)W_JLYaW3sfPk>QdN;yey-y zsO&tfB<&*(0pOd$Ef#N23u{T60L`;VxL=MvsFsk}{AJLoow%J{WW+3B3gBf{wrLOI zR?xkpY*EX{O~%oDdAD8P+&0KM@xMeW+(g`rA5uJ*#mQ9|@zLxn)I3qszOQk4H$`7H z4VS!0j<0quQIFeT^nw^q#FhAX5G%_;a(qQ%B*B0_+yH&WkR}xRstOZVqxjvON?S?_ zR3)h*On zv16RB$E?b!g4KNX+4}E7goy>R6hf}c37t2(DDkvssIdaifsUfEK+Dj`%nFBpx})SR zPydbi*?%O&40aiI>~3Z`?lMVVS5%Uip!iqGPb$)tCPKpG>4GWod!6HQ^#6;tw~UHw zZMsD_A%O(9;F3UaYuq6~fZ!V38h3XM9y|nh3zA^LA-KCV?kGg0m!?=AO225djJ%Z7-m+1imWS&j;SwO_Xq@7!B zoaCg;?druvdb=mT3bVaOVoUf7Hy3QA$Ln9_dvAGlUD?t)-F%0i;q6SMl8-n)?^x}J zJt(%oU3nyMx3NREZYt!Bq<42`3d=RsYy0A2-4j~>3vpWRuzkAa;uHVve&y9%B57B+ z7Fz56nSn_aqUX{*>cgGy1Ff#x(et~rUlq`dPWk5B7hb!LdYvPg*8~~Y*CX~UxnKW~ zBXk@j;Hfv>g=!E?&0k24-g4McMG`I^G}%c9V6^S%l&zHso}xOThO>;XF)+S4IAij< zDKE>lG{8M|6ejlCR=etV^%dc=q%S4)g4es-QcePSU^?u;x|y3pY#*;axozP=wBw`5 z1W%=%=+9xD&(SYF&0D~4BP$9fBr4jS;|t!;GUvFfONhUFzkQEHdOKDNDr~Mz$KhO4 zg`d_)jvDbjw6!nE(k)HY<@0ZOnAldB<+*q-ZQa!x#GE%ahc&k=ecV65ymq^MgV224 zga>}bB+4-pVe1QXoN;H>*eWSvMa_IXTVC;!n}jDZF_A@GIKd*|CgYvw1^)^o?T|KO zmhUQfSYx*5En%$@P0OBg@VbVybon7`I5ah{unOMJO2m9pj~cA9bh{kFgVm4Rqv|d? z;`$x)H~xgXJNZFIp4+I`4HVb~Z|*HUT5T;!z0(-)_&>ywlEw=UYp@IyfK- zo&srmJJ-f;_tf$$B~1lu9GC+%jb1OK zePHtn(0wyHxpuDR^XFqomMoSaFwp%)T|L+OBG-f=uw&+acjUNfd-?4EVQwuip58-y zZk_HD0lGVA0c5xOw%*77vB>SNPw)MY>H+7D4|o|@?Rx9IlS-Z84}QOD5YS#C1iZXC z_{dX^sOP&jZ5N2AC>^{FVfI0uG-7%I9_RMCxbK1OmMR|y8kUWcJ$JQ$uWeU1eI@vq zJhEaXZnfWmFWp=3grVni=V?Zm7V~y08IJ$HQ|)YZ?Wowm4&jUr?3-Ay-^1fk)cuHXVB`ZTbq#L6Q3dg-| zHGC0BIIQE>Tx-xa!%NQvx9fuC?tyuE1HnV;9xb}#>N2kvJ#2>6>^at1Ll%;5vA6;v zLd7Ia;1%+6mi~*TJ9eL|qUo%fp8no^k}mn?Q?W+ZD_#+ZF#|JGtJrk;xc4>;`hj_r zud1iTa_XoPqjMAfXpLyulR!@IWsn-$deO2wA<4P{)hqI>ws4^bG@t8!-I*p88<5J5eC4%BJ^oPJZ?vSjh+#ww!S<^wL|4O?zQNf$>JQJlCHXHW zYGJ#>xyRzrR2|S-m!221$%=?$63Jfs`0_m+sqb3D6>MC7^?>9yJE@+BbnQ<2Ia=y# zQoUmD6^}111D*o7>`&~e_NN}8#!#|hHahBufh=@A0+(D3ThUQ){Jb$W0xJh+xfAcI zOOJ`ZU4yn=7bP!Oo%S%tj$p*idmyEbR`PoG>OzgQYeaV;jQ0K~5y@(KAuRkzAk6iG zItDIm(HrNy>q?NIj-m&BedoxV2yw)u*G|}bi_&Y;wk0rZ=@mC40{et&b|DD8VaWr| z_rdfLnY#3Kmqjd;N>e!@1ZejqZz%>SbJ!w(Jt*KC%wR#nM=eId4ju?Gb_zc7In#PH z_;DSI&*954AGr)7{Zeb+d{}-&7IG&p+vkpq_aHa6q$H>-TQhP&Enx&_<)WF&6AO#$ z5}a{z#hc>z{YAoM!@kG~-%UlmivIkK$?=!3$;hMIJggWo`tOIi?YL?-^8JVs_8RoA zFn!L7rnBvzZ~WHb3(oxJH}Auqjj# zJ1CseJy$4m2{G6t14S#gkBR%%&-+&OISq8+YoR?|@LGll!$cpJg6^*f3F??Ot*ku1 zqAbWa2bk(DA{Y3QGOeQkq*J?xF-j+N`W?R1+>?`W_YZk6)bZ^d7z;il=~a`B+kK8# z?#p2E3W>@jF>oH64Edqaib`&i+c}<4r&`PTI}2VLf=<`Bft9zqZ{aVMQAX;F6-L>E zwljU6l^t?FQ~NR&x(nN@^K(R`)gvXEOW9M<)r_d@xmYcif27QCcc$jYv>&9TyR^~f zc6>%_UY|6P1SQP3Y(LU+9>UK~OZ&F$7cNth1QXRBfLx1xSZ7mTI87D=9403wP)jTX zpU(Al#_-H@S#;aR|2Te}FjpvGF_atj+ifjY4L9FpXSd)`VS5(|^|NR%UivFGG=Z07 z!s4~l?^zBLD0t$Q(+(Mv9k*cJGuju`_J|juY5k&}dD~mH@g&xEZI%mt$!ud;)q`aD zW^3KZE(~^u-t6a!mJx3KChS|(T6s^i-$hKdsEa-%0MGXrKf_~3NBxMO00?OC%(8K)?;tog^6_tt_ih=#RbQ9Amt7F%vy?sN%Qc|qH zgS*#5my;(EnAqi~Uo5iM@?XBo@G`$eg`d_-jV|+oA@}|y>OApB@6u5Fn&N>uGpr)X$6#USvYm{HGqG^I)K{ueFsSw=V&70O>N9r!N+1r%i|Lv#82es~u zkF6yfb_GkGXv~QP-r{r%^tGdRxd#u9^T5zYA#K0U+XNJ zX-ulx8&nx%dnTq#!RVhA4mk0jvVK$(B-1ATuwsizj}I=+k>YM78nN{-g}-EKe&`Ih z3))u9ut&(eZLb}j;iBXk(TaE5>a$(px*dM|(VgU=xNXN#O;Pu2Xh4Wu&Mz9gf)Tye z>IwF$aaXNRx?%K*-xO7K1H#6%*=uXwa&2oJ_ywa^KMGt{r1c(|cqI%GCbAV*c5HoL%}47{=E}pZ&er+yiKFAy zPIu}G-7r1eC`TL2eAtu>{?*J6M5y1s#>WJU_C!&HG^aXlkGzRKnVKG#omL<$%`eFP znS*2OlwMWM3AxtGa(mI6Z&~s^2REB<>H}~j;lBf#v`}0S(d6fjKZKBuTo5SoSW0{u zOkFQ7-~;Xa;t zkKKF?EjYf(h&`4_1Z{Jy4TdT^QS7x(ju*gE6MZ60eXi;EXT33wnj2n}HD4ew#qhXq zpR2(Rhh4wMW`^r%Ewztidc%cW9JI2HJUr`r@rg(do{Y^-sB1P&=(A99&&eA3nEX*^ zf#B_@s_2pSBbSxV3$^1(TftCT%fG^f`A)`}va;%)$8W~Fo#$;I519G}liZ@M^g`g> zHaDk#IbJgD^VA{QK5V`It~b!V>OBt|*K7W47$R>lP&8tAo4sx~&STR#wtuQlc*|^r zYmkn=>&U#umU&G)CY^$j5l;Si0_Sz;s3(5!4MniLkq6X^%zC+CQ@EiQYR6p?LeX(!Cdtze z`B-TUNuf(q2>YIw0(Up{dMovbOPw+Ix3IYZX7F}K6Sv38%gtNsG=5K%Af6q!t)3D6 z`I>{7lN)Kbhw9qt#+*j%_EzIfyqtKHv^N{<m8)++yrDbj-f2yb$LXBOJCIo ziS;s-#lm0mcI{1l>Tyc~dR68f&!3ZCpZW&T=apx;)^A^|Mn87=c47EWsZ-}8XA!A@uZ=FXJ z%Dmurldat9Y+O7h-4Dv1LWK0vcKZ`NGAQV8Pj5K1<)z6*KYdv!M$xYS7B*L*M9k-c zf9-6|WdS)11le^BEq9ckE$0#07jt$O5_S&=-IF$--;=FU{+{*O4n10zl8axcVJ8z8 zHK(evbtmd05Hqu~5b2MvEHpFg8GVlzmChZRvMZ%B8MhA5y?Xl?KIqy|F}~1yp_0L=N6)nwGE4?K~*!NiH@mkkfZliB;M_s<2TIaUA;C*IP`XaWe zWTw`*sJQQE&K@WICX&ub9)7Ono#vRB5w2=>Q^m_4eSIHC1|-ZiSiZ$FWmnbstz~qC z8scTM*({86YAYZNEZ-)+Bo!hazsVT97SXsm9x8;DqjBs%%@}so0gt!Uo z&!T?2&9&D!8;RsX_k?Ka`~fVH8u{@rS@3qx2Z`CMoktU!o;%y33Z4r+AV1uc+v@L4 zxgMW{Gp}^v>4{jI3g!3Qz=n%j5(0ciUZin1ZOeKc6h*IBPw(7(ziVlDMA^@n*|Qw2 zJ{c$TA`tRi|4WBUk%o^5)_uyn!f~VP16!wt#h3YFPlxRqmh~s%_7#dvyT3!(p@uPS>w~*a*;dE%<5nQ9njJv>ab0dVlLXDYEa2sFq%*W6LaBCEpZ{76<2NBFW%i`}*bRNsog zm<(LvxdswXbYfxYk&pZN!D2MLdv;0fwKm>(1;f-}Cyz-x@_~V0T4xG0!N#d{e!>O8 zZENpUYTO+S1qtH?-lV&*saSCE8(^5gerpv4s1^m$3kSeb8H9iIi8mN{TrUr#o3D`3|FUjo}--YlvJl9Qc*3|QV5r3OXyPnlIMd@Aq@f=NDK;`>}5 zmErcXoLJ0Ml(JNNpb63^R)st;(kQjeOprKXg@2$+z?2jnoSmU+U}d1Gi+&pO*QPTe zsqaglOd>%@{?}oND){j|6_7^p30Q`sB;T2YKsMHjtOm19;iYIt?g?>_U*#TEjMK%t zi^IjpbbwQ*!)iajH1BtjK^nL9ZdGg92MeC994^Eg4ZA{_*>Ep`(P-*a-??Wf_06t` z@USzEYHhEdm-U>aHn-20=EM^2_xV-jj&_sFe{BZzdwHqAMJ~OY7I49yh$~Q_A)l`e zz3?^A9N80zOsX0l$B6N$2*gAD>tPt|@^ z8vP8FU>C#cSWp&WGScOb(CJ~K5VWQT@|vfA0b+Hk?+}ivW8KR`>!r=j@uani@qU_3 zQx)`)zjCZ3hy7GxQ1keKw3u?(k?(1|f-6c2q-oo?G(SV#-PtTwcbW-6 zNu&O9VJcLZVbOq)vA{4=bxY*_-Ht8+cd6qa-GMFL3LDh4(XeFff%uV3_QguILLg-f z{9S%^MomkKY_pA)WDj)VwuwHK{L^yrbey25CE#W;PJmcQ*Cc4 zjV#ib68B$SfY31=xc;N#pTic8)uIW3h?K}_#Sz}c%93Nns03}D7rBv%Pum8siY*qp zcMzay>p!p_Gfoz&L72uwy>H|exPu8l9QLEeC?q6g0{U-TzC)@XGVeZ=3jQ+hLW6%U zr)xRC2v*QjFv@MyZqSPg)Zt|(CmmV`4~KP8&d{?e8?Z}C((y@BJ_~aN5KQ9mHt>!@ zmY#KuV(@z0f~(YfQ3SL_!+-rN8qnS9zR!uzz`39KYyAh9I)lt{tp$(pSfVGtyu|}o zF%w=&jG2xw1u`)cl|#=%GsOJwkmS_Tn0dlC~_ z6AkIw8@E)Qe`N}Qq|wRwk3#S9lw-4dl!xz1K`n*KtI^>F$D3yaX|@v`J1%X786sjD zuTD;o6w{Q#4yTwVrl;Su{37NE>gpY640|G!N;e0O`D@3islMUiL5%&Waed=lEj+jX zAC_lhk-;DQNT{-|K7tbEBEP=&8OfUvyBHU9H6vAli9S1imZGJ8wp&ezm4PRx-5+#ViBC0(yv9-nhpPP`Wl3U|l*!z5 zo?HFR68A-5iKk6?AeD`|b1J>!)c<8F@6^jPKoSUfL;x3Uf1Z`*8HB{O~szp@g+`U^8lH zK_AcYS6CfOfD4;91WbORfzJTW*eIt#b=RJADU(?M8~0Z?KLm-FD#^lN8myX%3`~q*b1+Y7wEB&<|3nb^Reo702{6=$u>3iFhHHzZ_X69|&*j|F)bjqC+j zP{4DIP5YO$xWAZpJ?xsgtT9+FSLXIT#6ctF_RpWvy}E;Y?gh97r?)%pijA<;5-6EM z&W}=ryiXj^y~FpWBcS}a4(Ki!T*4Ma$%~}L>q3pD*h&tV=k*?v#in84d*K0iAsS9$O0XkoNq)x-d+D2%H+jjb5VM%dE zw!r*x`q9JZ!6nN5mK()^}>gDwpKotFy{m8@zbw?&7m z#Nt)xSmekQAxtS7VG*0^xqzG-KQ16QLvi0u35XaHnwIKFNV?OeSPUq9jgJ^N9bVJ6 z;I*(UQqWP3I{B$|Jy%^>k0pVA)HNH&kCPWGJkT#}qf0=CM5pN1^cRn5<=0rX&tto+ z6A4CdOX^7Wi|^#7Iw8%vkrW zCT}VWw{?Q`g=*$JB9NJ|v1dXNGet#Jaz$eP({$AdOiQ_6_LD8 zqK3Z~Vy6oM*@};?;R(MT;#8*Eh;;qOi^b(k=;jc+F>K4l84L=GUJ(FFDmwEro1o7> z!;o0(IPl3bTQ{-!?CvZ$RiiM@<{;W?en?^SW%$B0SV3|;ffZv8gM)?H#6)cq?C}JQ z)Ta3m$Q(c!VV|gRdV?R;sr{4qjE?o_TsUQglhyAH9kiTLu> z57f_Ur;#&95X*Y7k3Osb-8->h(ptVLVd21ff%4&3IJhsL8+oB0?B(Zab=t@BGf6Qw z%Q+}%!)Dj*mAz_Z!Kfp;}E*aYm-vznd>>;r!RKt0R1}oy9L39 zz%d2`I43lHdSdhjgAap&&4`_;)~ty;^ZDWtA@`sECZV_g2C55YJd!zTKh^OnK?_CM zJfu|r##0qQ=WGnfo(a4}%$d|TSR7cEalNw6@b7kSV+$|AI=gQM;)Ph-x7n0unaBhQ zPBJXWvC#WdOu-4e;A1Eo@T@v@&-L|1VW62>{bWSKCL#Dh4A~J*62#=1x^89U6Yss3 zq-SINB8S9OD>2;p%cSM%Mv7D{X-4Sc+JqlcV?)UpLsn0=X-GMEn00`&73!L$E_o#P zAHfU>ey8QQMH75W#)*FBTqIf^f*3q@5=+vmBVTrU@_SKl0bY+AaE*Fjl?Iqo>w65A zz{e7V*WKL`SsdyhHqI9%E~}4=bSP3`AY@%h$jkCSGeshx{Z;r^_CdpFG zm^H-8KnKs>nV6`+ylpZbOMVl<*S^c|1emqO(S8YuT@yY)jt2$E@l+h7E=IwHW7|f} z!?tBBxkn59#tp!gbf`cWp$G!>gm5K>JILA%Z z+Nq0Tk;b=bE?U$FCh_y_Xbo)tKZ*xc8;WVQbr6aGMw6DdcAR7UQVGE8qhVxu z+#%oENRk@xi%HhFqszti{Wcb0TUDsYZ|y$~ zrtaAA?=k+MXNin7hNKv$<>z0lG!eJ)?Jb?Cm<}FY#ka4ijwC#klXWip{H$ZK_8VtB z-%U5jxr7i2UR?JMND7GBlW(l654=Iz@iN;m^{xgn2rZo$3=l`3|Ku`6ukoz zkdeb#(=X!zg0I0M;-V&eL2a@EWcKsVQmT3t0w)+_YV6DrG>0D#XezDjZmkz<;AkMZ z4Zl6EMWj=h;tHa;C-lm5!>E=b5y`Pm?TCQ1!Ld(Q<&-(TME&%su$WE)JNb9JKUN&x zR#pW!S&(scA#I7U&L`S$%1Vm!qhG!muzEYA;zRek-<#6+)6*+xs`_=ONU2Pye=!jBM%ov+t!Uaca2`HJix$oV2 zc#XZs5DGy%mda#pyIFbrrbD-h>ZTt zTnF^(t&mUVU9uHh$y}l3D`^`RBjwZ}$RCs4+sYUxo?|ogloJ^?wZ72l3 z)_~nqUUeOFr!g^$_)y< zRYxy@Zqqkgi&M&1Go9@D`8~ASey==^t!XW@mYvg!t&u&_@kvQL@FjUzk!-o26?}?* zsKGs>>0Z4ISs5dOW+#tL6lSL>=sTIcmoqF>l{Jvzi8zdrM2U{jxB3-uA{Y!&d|_fj z#qu$;sm-qO9lptF`NeAsZPG*%xM+AeR;QeV0cyR>Z`q-?c=_TNXE@TV$~mHb>UiVE z_1f<=!*qYju>yU@KcLPYhMrzRZ^4}gCNkeK!zny-q(ZCGjsB7aS+2Cnp4M0wPJ-FG!zk_4zhZ>PF!=PZU_!e9D6it?X4 zJ__)k_}+86R6Wv$|w6O9SRu_i=UFY-4~s8XGZ-AQ?y%N1Gi z(_>@vH3i2Gxl*N)qOw*1vT5wsxHz=fMf5;xs3o(oq&I~?@%Gx?HF7TlorI$_hi3n{ zf|6=z)n4Dn-wFOFyR0|`o5I;i?d@aa#5a=e#cSOTrA9lWYFn)=r3TA3s=nT7;n~;#S;Vi? z2f0mS38iE!d=W%6BS6L$N+~~Hi39=uPU;=3fdwx;wuNNRTK+pofJU5R?bCKenvh4& zCWYJejHlhGDMZzkgQJP@>OyN|h41K&c-do}n#SxW7V1#ew9I$_^j&^8AcQmjqGU3_ zm{od6&x=6QI^o26Fty?(-+s;~1?cD5}FXEb8Uj^bcp^(f?m zpqh{Zo6XKM0QOBkX$TlpVN+@D9628_u?XZvg#3>rYAbm6r|KA{Ofc_Vwea_HW8PQM zYpFMCXw~R8YE=_LlBHPKqH>e*VDZa$_{>kzPPC2j^?+FWy>1=6V12}3*Om>gxcr$q zDkAaA;AiUQQB+YBCpEvhiuSGL!SwFx8r{QwW1%;zmpm95E%ni6%Qba%A9hNI8m<_| zbdyp$MDDV}otTPpioxbKa6Tb;ZLLFU*=u#u1JZVUCHQYEp%8!Pi0C~q&(xowf?5dHLP#D#ImAm*% z?>KfkRO(E%={%mLgJ0&CpY$6}J2GNeAbrM3x**q?D#f$2IMT2{TN(_sc73+C9s813 z=;9(E^`T$Cclt5}%a*oss;W%j{a3X*1mY4jrZ9@p@L*LY6jn9`cMLdRk=i$YiI}pC zM$*4`M_&4xev->F)XuDHF46Jj0|hW9K{9CP6qus1|H>ym#{h+Kj%iqfzrJh&|4S;+ z^`{f?1_SniH-}32EFraEggoP;-p0UgMHvtJTjZeRbk5|S$T+1EU_on zn=^9le}!IoXc8Kw;L_S-<8qmUNjuSftZnHL3dA>u7U(t{dbxEB;mru4ofE|=HPMQ5 zI&ql@jrK0gf|p~Lzvy@Hze%w{`-EPoNsX1W?a+{VUn9C*U%6=KpCbqTs8e?$DL5@% zv$Va#m$!MWzGG--!qrW@y+0Y%sv5c6w9E__Gp~CymczdM-O%eHk8EX#%@c~B%v$>K z6sX(tU-ZXb?JO-TX!dc7?xYXa`x|N`9yhsWb|m_q;#?GDw6RFZe|P6U#nR=jc#(O1 z?s~kmN%4_xK*Yfv4T+F`!(Nxa8FiaBQ(!&7jOZ}lBHz*HXbimH;)5U?paUh|li2>) z5-r!2}(8)Z8Mq{cv`eXt*u0 z&D6j7Ed3GP^)97?Tk6-GlxuveUkLhQYN|Pqa&OV9)Xc!I&iyOHRty zZmlFK@J*mF&h(W>w~K%Q0`JA{q3U7P$Qth|c`2xGjbo)mRbs+mk(Lqsd1_q_hMnhJ za2$z&dQosrNStHou|2sC%~WZXMQ0jv8aj{`U~D<+en8Wxp+_ffp9ozJ`gusTFUu43 zc+)YmM(wGayBs*nmoZ*4$f1}b+h03xDII|7rRARYYn z@o!lBsw)g{#4Ft1)C-2FvB-;RY(Chs z&oR%P+a>*29kGl+c*j{4<6xJbz^$woES?PP+iy<%m21V(p{49$tLG|H=mBe~$qhpS zif=FvH+S@xHTJyiE^%_2wA*F7@ZGh13;F3An?ngUrhdDa+MeF`_mj-cekE~JOO^$8 zblY?l7SeVRYmE+f0vlWjvE@6tsWNkP^zbdctkHy4NcBu@#`sKLwFWK1X)$R``@x^P<$+-Yuzhw$^KQZL|R!~f@XZ+ ze4;J%xOcSLm3t(m>`=`fJ}8ecyjido&ish6?6tRzvyDZNT6E%xxp_Ja%Emt#`H)i ziJHDPA7zUktVwMYzU%Gp1bHK!m~M^0P(yl-aWj(r>?+Mo_%EPTHV;M>@e&4j@Ji5I zyfS*Ry6)lv!=Ibw4L!jI=t65VXDe*u&@y_l&r$Mu+m79I$e!7mMO+*K{G2W?fBs>MLI_N zHF|=cuMKyG{1Z z2fbUuhiEmR029S?6sU^&txDD%FwHPf&B$m*D7o``3*$$y*%9`z@JSn+<%IBu%VrEP z#5=n9z=?}@LoWdZUg=RKch%`nV7HHc8V3wkDqGkpQx@sLW96;e+j7rQ9I0noDMuxY zSDv-K84EkHKVBnXcY#FK))Gag8<}|gwtLI=dS0GXSlIbRiK`O#;;&mzMJ2re*JzRt z;`VUA5fMiv!8$-T0&3Qg9lmYHdrmiZ>jA+;KY9m9Zbx}<%Vn1~1+86X*QcV0s!^x# z@qgNsJRjw|E9^$A0Z6Aboos@GoaY|}kFASWlM9?q+MTu;#&hC@F-E5-0H}_fL zbvR5ld*)<81~}Fv0;3k^<)9`w@mzxbP;(~*&Gmj-p5d&QTncsgSM`-ecwwuG^}Y-w zQqh8!=rkMlChO*3Kor(wWSJ40YIzBJ1`TaS?Z-)2?s<7;2m9a5&73MnzjZ1FCQeNl zh?is&ebWv8QLQ;qTSLyljJF<(JvywUO@|$$>*_1?t%7xQ320Xz8{-*ZH}^!`bp32& zLhr7l__zZ4P1{m5qQlS=Pu?O>ei9iH&Z_XEn$;_5_+C7DlqZb!;DGE6>X@li_^>r) z3HWz;*m}5kmmqm_XabuG?!m!gQkH|Rj;dy)+?HhAX3E`|D?yw`Z=c0Ersxkz2u_`d*a`NUvo7d0U6n(8E))Th7df?_W z&F2Q5#%=U~3J_4$95i_;b$j0)>k`*FAoM6PtwO7jtGJ(V+3<9Qr*k;DT6#Dmv$%DMAFGqF-?~3QGgK|ZBe>y=I&!YRe$m$PWF$HpVTb3@4fg5Csw_E}}|`3s$nd(m8I z)^hMo$}@F--NMOr(9juVd5nfGb#8QS0xoqC*_ZnZ8f#2|w}6uX>S*=m=P8S~u_b;% zGOnV=EK-h@iaM$v^Glzpjh|*EDfBqDg9b~0KszhCAILu$kSrGVbW`nw%wmzP%t*;s zxD1X)dKjrla_O=BRT1g)yrgOoA$|Bgf@zu$|2jN*s=;kv>K*qY26T(QV{O%7W%CDZ zyo~h1SG9{!S{MFob!`^6%GcsyTvD(gjjv!Q?YC@QncvTXt})HKY&H<;iE}~VxcnXQ z(t^g90aWb;y*OV|N3T8%IuU#~2>xNKPh;~t&|Py@oQsB4QK#vi71dmdMu6qGvM$tF z`RX}i*YB5j^BhJgAL?f0;{w>}4J5G~FE3Eh`h*KNIm^){d3YFYoyLv2jhbl&KNwS@ zXb2_uznWv3>Z*B7i(|+_L8uqa$mlQw&!XZVB{SYHXh4fHwt}(v@rO+3O+QQE>cI}t zXMdp5l4j_ROPKRZmo9N~n<)WXdHjUfl$~Xqav(6l0$fVtW#uJOI&g|B&8r8-KrZTH=}F@Wza9jtLvrf*`s-@=x-3~L^E%kg2&BeY1^J-G8B!4l9b zBv$?^@367#s!n@xnvw@UaB@QLI*5SWp1+(aq6qW>iKR$Ny90-*UoGu6#cu4cuGc;I z#3Ws#Glkk{V-@n*UpM)(@VnoomxT=`aHGRMJEfq^R^JgPtECRTZ4t5;K#h#ZX=;$r zl{V1v!dtUdD;hWaLh2L)N27W&v(I7msw@1s3sPSB=$n(DxmWlkh8I1@iI z7#Lka1P|xd*Z6{5ajxbK8AduObKJV<*oSV-zR-&%ewS#Fvjui zhW_3fYT)!<0y=5)q_Q&$N+klP-76;{lr(%HS`i_K9GK0=;YJM0({_NRV{e$gBSjEg zFY&Y(Z^0`fx_lm8jb4U^_#~O{O+672ZV-3OC-I{HOcO?l#sB+G+O6jA#XiCFYVsO; zrbH!}s3d%P&+;>(2k3I0CI0f`@q_1Z(jYKrO!+&CTnClLj+VcNr8_)X^%J6 zbfyKm(nEBX*FlDM`Y+kW$1C6}!hK#&veEG*dvlYTHhF6RG8jHmcNYtD*q_eSWk>oX z#BBt}Do#KwCEX(Ifl(K@DADp@MZ&tPGgV~AstCT{n_^d9f;Y13TW?VuTlC=*-vh}q z%;qH{NGQ(BD|3Qx@-=ISatxvdDz~jSu&3J#?@TT8LZt5&;*GRFO0~@nsIjo~i)Twi zNytPW^~uB~LO`7PfeuDk6rvRPM2ZF$R`~FX>1Kttt!KrKL;8SF=mOtUWO45n)DPJ5 z*PGx;o=hiHyt4d{6x6|QF$+tm*r(zFvVTW!Uy-ow>6=}8B89K9;rsM>U%d`^>FA0; z*)_+Os=@X0e zE&tbJKtvQ&RndVR4tBbL4k^liefWu>f(iUa{}NbU0&xAea1{tlI{mlQ_H^_)4Dr)S zi*5(kcI?^rG2L+95FaBNt?M0Hk33Ob1{YiZz6RON+RXf@1A6?jJ3oJPYAh`3LN3XA z*bUH!11fzjr0~ppQa(QMABrh)U{)VWQuCB>b$txa^cjA6}@@4Kn z44%P|r(w7MVTXUGv4DXK|K;-hYil4EE)Kxtzjq7;7(Us&=(%ys#{Uf~ewpM{7mG~h0?90J6} zUOqy=6we4Mr%7H8B4*cxW~B$#DT#ltcmG@|z4{ zSQ?=;KmYaOfex?-^&Be*{iOd13^0k#b0hv6vLBux3-BNjlLrOyk2}oR+YG2QtjqiM zcenxh`xxiHtA?Ws3&ip!BLImIcsig|MBU!?eAMs#N{wXpQSsNbR$Uo0GPEGfZ`kt^ z7}=YDyQDU#ZnHJO6@GYHUw{zCz`y|6NBY|_U(5C?FSAN_{VLM(uwmFi08(CEL5-c$KQeMgv;RJy#ta+)kIi$gQpTyom^bn z3>>=+|6sY}-P2HH0EKuLe4|qfq1j8q5wbD{ZokMl0CLiyTIc_~48T-p=ZFKT@|Z`g zXjy?mD`L70E>!?2RqP9&Omvf20*?U9)xRxzKh4so5=FqugjDF{)nO3#v2X@|1hC|9%hz^m@+UR8@6G#{e7GlcNT}My@SmbaZ)p zq-oF&wR`7p#~q`w{o)_J2icuMK*gN&{7i^4Cdekv9y7(9gG0>!fvhJ0qScL#Px@sq zk)ENTWdAHCer@~-PG-v@?o{omV`u@ZAz(C!kK|!q0 zk7Buy2Bp?*zb=cA`2+vO!}m@$Xa*vl1p`67yniE3@-CkR<<#!KjrtekJE|WoM4^3q zUFe%(FytT+F2ORqOhBoMH12S79s$_Dng0fKt;aJcF!ScgkcC~bvuuMM@PAyA^*>T< zf(*cQ|E~f0Kewo-pl@qi1eD5PH&-%BB%3rzw8?^t>-OB~kE=UG`?ESwwAqPUX9}?l z;gQbhgB5jjqxw(iWGqo&_!;KG@Qxa zVjL#y9-n(4PonVnTTFiff$i73#A!^3`325NN=4b@gITo=h!lpgu!H|$aDZvn)g{J5 zaDS@|IE`Ic9gR0pj-%q0w=Qp#V|v}w5?^`eGyY#8%u_hbL{)$n`#yYgQA$ReEc62g zWr-KACNtAh*hI59UyBNawDM052~c#Fd0@y;PfSSIIJy70UsH~ z`>)gF{=apaq{IVl7zuc|YnHBXT{>t%YxI^HXvJhc)SdQ;6p*Vq%>=yZqvU#GBzS3Q zSas?G3u9OVaa5<8YI$P>WdMOR8eRgwE`!B+5*evPRrU)%9SID%k#GsXWc9BAjNJ61 z5Z`ApOSJDj&Pe2{Um$kkQ^7uS51h#dmbr?)Qr6sCRM~b;lJYVNg@ejvds~dr`Q-(}S74`O8-dD|n9Ughqdx}he76anUyw+AFMJkr zLik}%Yopx1iqQ!e&dEsfWs03#Nj2c3Fs)aMJNi;VhUk?xD|wviJ4U>i1p}$uXZ%9$ zm~F9mw0e|ZjJ7Dg#Y7+HS+X`imgtnPBjrKL%S>7?_i9(Yw~Pa0*=%fb+3)8slzn_@ zM<~5GNZ#_QLY3(J5#?IXC&@;AY~MON}F7 zthG9RdTXNr&S`p+I;+O_Hf@In^PQe=kO&?my)?*2Wf}|8@7gwlmuLpUEWyULA?*h9 z3Fh@67RqtW8opoqd3NRLV{sg~BykBYoIWV%3A97TA`&1WP2S9{;}*3|Yzt0)~Q(z}2(14xrzgiwx@KtOu$AiZ}Gqy$2d-bI1}DqZQJ zgGetTJt6cC3B7aUIS=={|G<6vmSLa-mVBk(QN$; z!i=h%k#`fu+1Z(PPrFysLwAe(D zfQ)>Y!mXxKJa2^y=IrJ4!54Lp(3@DF0y#zz1J5)X-uOHPH9%^9oTCE$%_C|yH7*{d z^)alpq0^!x?q>@f{w#LQl*JCD4Mbmj?9BLiGXD@vuxMGP*iNs;HT}7#*+bI8=naSG z{q5hI>ILYz27;3+2{C5^NxTD^rugdifXrPG-}Z4W$vb>dDhAv37(F2m2P_|qoJ~l3 z-0q1xHAN?Ezlh>3JPHLKTD@l>Ua6svxsdpqeX*@MZjFC7b%?GHc1!Z^Aq0DdBSfcX zxZIz%iPsM@{xSusyD%c2c5O8s_L*c8T2Zn8C@eE0NLxaKr6Ocix4yvDe zvP1^}6N(bX&+v=5-1q=~RX&8_9IQlf%5v-xJNi`Mp_awZe8Vbt<#abi>)^L;g17!> zKi^=Fo5im=d?Qrx;c({TaSwU;$SU=Rq?GuLs z>T*aNRl?|s-ZTnq^O}!?dfaVFHeZBOC^S38@Q@Wz(vp`PQL9X1+F6R%ObDPhOzlsc zg(HKLIxoIdbsW8OppfyquMq$IjdRpOviu`j#O7*Z$}%yKFB9otQEU@(|F*$jw=LDW zkLw*Ep$0l}czgK5Xpr6cpGs5JY`4_?=i&19g15N^uQ&ijBA~?g~eN5 z*Wmn0=!)%j|EH9=4Ex-nZBuW2dP-qlP?l)K;O$4zX=^h&1t+nnS<;7}*-WuVus%-p zY5;Crf4O!Aq(x*nK^T@8xlAXYsakVQs(J#KX5_joQ`wB4h_nlSNhKp<*I)wnr2N$V z#HlIAY_Y4l^~=W4#fvwgT&7a6VVRD-oeCsRE(8R;`QgO-`|(zvCOR>MkYkVhBJt;& z%IJr%pEsmcHU@^ZbDugX7r*fgX5@N%k}e;JRbLT=#%66re6)}o;~QZpgX3>1RJ_04 zuVf2AQ^{!EsL74>A7T-8QS4ttt@VKR5!No$$Wkn43C4OA{ijN)m#jHp@0B?1nC8n# zy8gVVMnXs)v~f#m<;7FQ!EEGu+z+JeD&K8 z4CQ_!9mPxif{}Q@Y2wp@e7*&jGc_%qs`XZ4LRxz5sRkUGDy~SqX7H_>JyaFOVE8n|pb(zvrp#a?oOr}6 zi@sf*Mqh6R20dvKsH#(nNx>3SWPjm3R!p8=zXA{O;9Z#jKvhrq#cL^>5Jqn;qc3ZQ z$sN|Cm-{yD{wD}yumf5uCo2tTiZ|$i)$2|TENU86^-x@? z6xW)SI#w~vct7m4aj-igGAbSw90L9=TClX+@bGZw3MS;qY=!;irt0LHSC_RI7Vmep zg5bkk4fCyT=l1E-JE5D0fJ`#o53D6{B3YLU>Sq2?pMrpHtMm0@^yQ6ngX_~8_YN|P zry7GDchks%XjQO)Ic}+RqLet(NwB92w8$%)@4zE3Msk9Z8wZRG=jU z!6KRJ?+Ls#q39PvmHJsP6c(x9q<+=3^tM-popw5YQ<$9)oomz7 zW2$K7q=xqP@X0mf1g0I$hFCPuXyS{*It*Rc;bOHMnW7mes^{|6FUbleA1%uW-F}P1 zr!m2LIxMyQza9vk;YlKoWkrpy4mEoZaJ{78+q7m)RV}dWXPf}~eS@DTWM$)D7Mowrs6jdbQTX<^WgTMkn6n88xe1XVqY4a9>d*ykUKoD_lp>dX{-}e_O%dpEVLzE!kr@Y%hDvMJ#1(VzsqPwL(1~HJi}(()Qd8vN;{|-}2D{ zZGf^P>84SC#w#>n``%4U`};KQ@Ds;!0MIv-ICtBm_xT~sk2s5G!^0KkF{_dJ5C4eJU=H<$$h=LM~-jY6x4ytxnI92H66SR zRmTsxMWGoH3OQ8eF*K_Md=anG7n3rL)1iAsh}E~6=|k(eUZQcX_4O()_|{jhZf=jA zqP~xon%b{`c7z+27iQDSoP=On*A6|FHIO@UNlP(9)V?=V@p;(k@QX5c7vRcgbw@{6 zU<+Nii8`_Ajlb2+;}ovHv18fpx(stGcQV;ygKT=&W-am(fr_$_}v?bcQ2x>Rrb zZVJ*_3C3p+L4F<_XN#Z%5wKm+ZqE8DmMltU6=HYTbc>%p_I=(%gJ(H)8u9 z8x}r*WPR`ekwq=u^CkDSl4}jd_VyzNos^+G1tlQvpyoZn%{i=@uNBp2qy0c<+8w>B zgO}~+^b3#f7pkVeV3sOyd%8mLkc0gl_+gLV!UhJ`@=fLb|Nc6=m-e&L4~#*7*t;2HIxjuH_>g>!Aij;*1XI)ZY{W_qYabe^o+Z+_ML?bWV9)7Q_%?$I3)aR7~N9^u(>QG2H*44M=oh^F)kn2G~-)+k9(As&41B+^%~7g z1l8(dY?e-&jDtYj#Ifl%p|m4oGGj#?E82h75K<(wFU$xw)8ikQl1u;4aT&0`sLKVRBchpI}4X;3=GzJRbK*EnCo{3+2q_^;1a>EKt7qFNkI z&S;51K3e6{c(8T|Ma&53+?3R`(J%=%A$%T+aNHIASbNUo;#Z?VMdR;IhI60wr_>+Q z*$3jjq?dORxb%VVZf>8rTacMd5tn<^ z*V`=3Kcz)~2wJr~s5F!C6~))A&?Hbk7@<#5Qc`MQB+gg+X@a_Sn{dbMufM=5=ki5b zdXR^PVr^Gr1?-fO4nA<0-!q`#8U*zfbahc}bU@{SwfHQ<`eR z>oJ|$K+PbTArJP7$=(|)-|kiEva?>(3Z7Gm}?z0^{WCmu||25y^Z z2>6nmg1c`_Av9Ge&&?Ly`SG%7;5|>q(!7Ui#NRJ~Yo|ek;8nZ__wCH{6X0zKLnuEM z%VqveB>Kdr?So0J(sv2egIOr8Z&NTBSRVecOwQnK@?tptU?zWeY6G%o`(&|mxv8xO z_wvfa_5c)u9`WL{z=*Yt%Hg=bOiy}`KRYjus_1oxY#5+g&yd~t2d#<81{J`TUdiii z3;Q294&rrIJ3p&1BZr>@?pCzG+By+45Lh$fYP6reLdErgBM43GZq7z@r#^Fs-4eyO{lm(OW!V zL#>SSo^-%2h8sOgYhiU`u=D=px10oC<)ZT>!l@^-YT9PSKMy?{t1g7O#jg(Qvs%-3 z_Ph-Xxmepcznpi+Y$Wao+I5957i~R<^=>nSojeyYj&LsH`F9zBGLCT?kX- z!~>u4Kp?*$n-Saz2r&Y<`F zer!r-*tJh)NP5Tuy-_5-8<_3gQgjzw+3>FSjm$-lZ3x^AaQRN?$wXq7!*GZ0=xFa{ zRePtwPP>ZRQsACNel`T+NQKQbScjkeR{lajGNbyT;8sd(HRlx%o-(i3rod9umt@r7 zo+N?Fjl_o_C!yVlbm3_} zDpEi!5r5+60KYlga>_LUcDXbC1btNGyRc)jhw1A1jXrh(sI$9-(T081<=p)=5ckqq zpb%XWdqD!nLFvhP!{TCcmzwMZ8`)HAJApT?fNEZ7ndLxt4o0Zl;6)a(saBPNO#DiV zR+i%Rxfff9_CD(d;E1vAl{c^Kg;q}%wDq6r-OMlWm1%^a; zD7fQ5)%iq{FDQ^y-+dxpw#?q-vyz;n6Swt=JPyk=UhX6Bv=Ud`qhez(G!Bg#fp%-3ooV5~V1MamDKcnz#uo@}fGCUdfTeCkkmw(QysHAiz zfK3Vu18kEc>(Fc=J9hKXBiVeww~q0f7Qw)-aI5_Zt+98i;4g74rQOC?o4j#3hRn^@0lU zj!tK-uhhgI^c`b89=G)hQGaMZ^nUsx;&JR!S8K}93{}MA1snDS86Iu3NF)cOD~_B# z_gD-)vqEGduworO%^8E}tMD6Uzrym!K4emFm0T=7YY=&|+$Di|b_1Qmv)oE1ypd07 zK!?%zWZmTrSz}2~cJ>LPe;4Hy$)TY2cnYhK!@AE=uD#x>*YHG;@Ok}XCb?7 zjr13}F@+Qs(n1hQRc~;>Hi>}Q*BCdZqh%F-k1qra0vXGttbV98GJVt^gY}h09t)0O z{hkAb{;idnwm=SKNGMAt{E9FE#LA$4i0NRxWd`WGM$Yf4I5=~zkK{*XWrfDGgukY0 z2jvefCNF!h@w6C5Acf4i-Bw?b+_C_~%7d^ohv7I-q;U+{VjwXY@{F7`|LaR(mUjqi zMO|Hv5t>!&k+fvX^@ZN*pswXSP*LkG4(U28&}d6pRJ8s{CyuI;62s5`(n`F~W6(E3 ze%Bzn`5mFVrZ49qgZHDbYGc7R6fF53@>5}j^4CL&k1;%9=i3|_`PZT&;zsEk!V2O@ zb3w+V%rKmWgKf4>4R#1jw-2*&Hvc}9hgD#-!tZA0*^{ah0=)+dS>xtL!<0&>|Zl#fgPn4q>+>ruE0l|@@S`EQFbVy-OKPNZADtS7;I zgG+Z!m(F>lO^g1*FC6aPE``lGW2^7}MQD_tj8Ldp{MWgdEOXz0LGJ8x)KgOz&%yiM zlR9y&_^0g7eWa5O4DZ)9_2MA^bYro;@CO|K`gQi()1~m9c+EoI?F z_pgr;cS~`l4n^giZ#9H*^8OGd``=?}c+k@8%q4TobEwAHyAd>QxCk+KzxNVatZ&zBfX3u4TDtUXoJLFIZwf8dxID5XIm&n5-^C0WF z99-Lsi;rj_eFJrqtooh?7qoBteSXNJIVc@U#Fz^}@22CU*9RV<@r$eJeI3OOvF2x1 zB0J*;tV*WoWh=8L7}SF^tFv)0C0TvGz(6i@^JBSV5E;qI=YXZHe#4qe>2r3c@xqDC z+IkzUDK3{;j4UYqbyDL#V)M;5WA#SI5&%~~RN~_Tr5J-&hn?Hc<)%?oB3awp;3ts^ z7OYaP1$1b9OYw#!MD*xNztNG^F3W54JV*@K#1Ah|EEHPKN?KfpD3j4rQu?I)w^UhV zX(YO~KRiGq*NeVu7r$e1xw_Ql3vp#J54IC1k$*uMoRs+_XXMHLxXqtF^&0evvZ0_> zdhM$;%tc8dxq8W1z%9XtT(JjD%5{zcveCW78&>^?)YG$pbpB&W>M!FEYAUw}r~ z2*oR5g#0Aamf7d3>Z&O#KvkgPiNOuHwrNRx%|#XIe#sPY=Rh=ZDqyP=edTnNW!Q*% z!DrD%^4(rTcRl$99TOzF_1tz=hA+tBkyHX#NSzl2GT?}x&+J;NL{<)$weo_-t$iUc zQ$-KVvMwXSJUSe9|GT|hbQ5tFOn*AiZuFxvRp(`{TE0~1W6rE?3dU}DYjX^jEo*ZS zfFJl9H>5g5h=wnO`FmlY4%JWUvb}1+;I^8UWk2j9U?ou;y?i9n+Z;mLSgEqdhu z9>_}vDUAhe;e^fPM4QR)ssw6MvSW(6CUyi@&TA+IeFMo)gTX=T4{PgPdyx+$9Yy9U z^HA=Nl`3w?SBO>U{S**N2=DC@Lb-DcBolH+66oB?DW z$fuLF40;b+AxL23*xYFey)_53C&{>!4Kp}>{& z$To8-S{CK0DgIw_0S~3pZki=S4rA^Pbp-ltb(&U`p2=EAvSM**3>KH#%HV=hk4jW% zIE_f$^s%Hv)*ywXEqQ?511NK#fgh|cH{cDZ2G88#8u8O99n4a zDw~7dbV)v$f1r4&jCn=5DMskO`w8F(?peEVpQdTpVGmN}W1(e*?iYoa6Wx(%oj&l_ T_-+HdhyA=#1}Rl4T1NgKSVKH3 literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-ineligible-devices-historical-report.png b/windows/deployment/windows-autopatch/media/windows-autopatch-ineligible-devices-historical-report.png new file mode 100644 index 0000000000000000000000000000000000000000..2aeacfd0d51eacde83709d6ab6e56755c5be01d2 GIT binary patch literal 39892 zcmYJaWmp?s7cSgF3lyhVa4TNi-GfW8;w3_d(T?ymNmf&a^gtvxbPo7d_a)1?2m7u2AD&x zXMFIV&sy(Rp_76?O}d`3M1ApGbtGc}31ZTKdY~kTA6||eX_!eZmm93R*1N;a2(7u( zbbEGe8rLtJa*GljIq@OQD~V}opSu_lyBLQJy^*wpJ8Qml8M5MnnUi$umjoQ3>nq`g z>Ao5ALxt9~=5{~ZVD*Fq3YzotWN=3WF8}X~cVF-t{QSJ}@bE;Gl+XhL1Ie!_;tQA| zRSTc}a;}1gzY_~i!GghHA;sv=HdZi>h@eg9>#5dG5~xzB6ybO9lkj|<)IbD1!$dOd^FrZ7z2-E2vMJCg2Ow7 z^TXXRkK<8+CeA@&n)Uo)SV?%FMRcysOd9!xm&ODSf;zC0eK|ON(}O=W*`XPm{KOqY z6Lr~*lj<9JJ14%uV-Gf_vY_~hQMUC_W>G&j z(r&qih($InmhcO68R=R}tku;OieVy702n}#rVE|$o6%ae1QQ({U7<*Ml2W;fH_n@- zL62(xhS;n-@W>rGHqr^izA3&@i2b7}wPA5ra3d2hj*QSv0o)ZXB#{4gO~T)rB}L|3 z;o0Y4!C4u((Ymb5zX^shR*ilf$o!`~(``>a4ZokfL76 z)7ODN6IPFeZhRp$P<&*tYs{p~$*cQ)F)1&ZXN=@dKYho=BxhJAy3tqbKp9cPd62kL zh-<&06^K4Jz*;xiWND8I6i8wff$NGb2b-b#L(@-RKPiYj(GuKFS~n`tU2WMEAOvcZ z_8&TA$KJLT3d|I&bg@Jcs}VAGn!xpcbJPk+{q#_YdmULJn>?z$9A+cUZp5g$~`|PA0HA6PLwV& z@yOWd$W-0O>8K==C}$8cO13qxS1*_Ymkon5sgzw76}pMBNm=NcOK*QRkWmjV8_fJ6 z#|jzQ7NDOWbZz1&Ll$P>6&8y^XRsPpQ*OtbPLanSbXY~q-RDk4&N3$lBMJVJlh(;T z{z}uYRvYtRn(JhruI}{AvY-D_H{nt3x>86%0n|**)cMTe3mOn^aQBMa9z@k zKMcNSmx-nNL#+{zhFsH9G&}cOwwz{I=g0_MJ3)FJzge-l(mtuuj9EB|)DvSvL7seC zHimp6D}%oh&sK&>k4q$(&lfY%VqbQVBkicqMFwNy2TA!g4P;k|Qn`JH8U8*pnS~ko z`K(9K)oR~taWWY_qIpD3GTlF;-&}|i)H^U25Cl*I_BkoFnbeGnvtRJ2=|OLFfD~T_ zZj>^*kh%e43bzZll>8TJ<0Lv>SfsoP5SE{-srM~gptY3myiT$rF0Y-8-WoTzM-(jg z80&W-F!UGDS>&a;si{;*!had6ESD7$p%U+&d~IDX+={@gTy4;OijAfUXqIncD>QB( zK71*QM+Cd2M_$@aH;rzXh=0Q+j`VB8jP6;3xwnN9v?BM)uk}4I05~{2*+LaHI?C6M zF&*ei*s`ts47`N(26iokk>98hWyKJNc(&H0^q~9xS1%0wy{{V5AkC?T1PUACdjaQt z%_{ey?(oO`MBa)~{|5bkd=^=?F( zl1C=%SlC#op|bi8hPd8>AF7g?w^CDrC6Dq=JgW{4FztH`jf@!i_-udPEOqne>znyw zB0=RFduBCr->(c0kByK@JtPh%_xN-9`3U(HSaQHQqwek*=30{2t{s@qq+o#>8uH}B63|cW$cRTm zySloZ<^rOX6N18$5^-5~vH)@5#M)H&>R&Xqlg>{Tvgq~k-l3mg0Efo`Hj{~JHddtk zJn*5HOzi9-b+_#M7U|u|OZREOn)+I>o7*R6F|o=3OAcMYp(W5+oj~|*L&-opoQm4) zTTaZPlZIW4vH3wPQ20JKiSp|3E^v-94Pl(dB}zp(z<_;N=3!!LA%vunrs~@$6pl`t zz_;2%*`DE86xrI^$_CP4@{*irlq{+?0G81q28E9@w`b0jOsjM~LQBNZ`nY(SNbEvFlmm3EK!*JlZ8 zxV~S1saIH={g@>D(UEu+GhoWlduk_2YT3sFo1zyJaBR_DcXF0(Km8%0kJ7(nurduB6qSOPN9Yr%I94D0k0Y*l4Jwab&25_!YagiAdxm}l$lpRlA z`nyy>)TCv75)&&U+?(=q!!k1McXrscD=u!slvqcf)qI=d`BxH*#rucsu#iALn88zC0VDUb}t5P)^=lCFvW3KuIbktvMz&d zjQvt`VS5$w!4k6xwHd$Dc+2aW+sxL#SU<{jfY!hGhOhe|CA0pTL+#E;rm0R=440wB z6LU)PFx#whX}rPDf4J{`K3><&Y%L$e^wSh~<|+oD_n~B0m0^?ufoOn$Z_g@8O%XXA5S+0crg955;E4ite2K5trSRhYij^j}zmfqM`!o zi@>&cpd3ouLUi9icGuw@nJJ>+Tl-XQcjQ)IX2ctZ_02{WDykBH4$vn~**W3f9du6H z2i&Fr;KYiC$P<6)awoHK4KBvdwvekm`pw}3r9$IlufSo2UtspzGaj!Jj;n(vNKW2g zL~;34Q5AbK`qQTm@@_9n{Y9p-Ojw6d+pTO)2Qzb!%VROE1~&rJa4hYUaN~mm@gHUc za%o(Fx9R*C+T8w>e=k*1hl;!=GR00u%s5@{i7h7@A>0GoI?Z9W3G_Ktjf6c9zZe^R zf8W)w&v*Dz6&AjSwWzDg7YkdAZ~|XDH+xQxeJTpXBCGFAawYfEG>`Y_U)!(+4m`B~ zDfXVPR2-gmiR1I(XibAQLVI&i!fT$5ikCW`ZzPgE;cKwJWt2-B6V>Szd)_T`glz7UnCDb-u&`JkZ#&yL z)~*j1p<}Gcre?Dy#A9uYZ*&ZJvHf1;>_Lxq0Y1;dMw9GBuNEU`Mu>2yd9aI_Mm03B z1e%-KlAEQ>wtKE|KQiVXI?mkW@D5gj->H@GATmx|MpCa4Q2H`@Umrco3?Xc#@?HvD zZux3pq}^Wj2gc8w8DGHqQ(r`MlG6#D7NsvpRm(rV*X3BC26m=ag%fhk7!q=I@p@|k z;AqMsGNDkaLnu4B;gkWJ9+q6}@+>i#!e_UYCD-u;;mwtkTpik{3OHc2Ia}b_AcTOl zw4hq~_~T8@Htbufk3M~;7oaK6=-${$fZXm|^4_I5DyZs+QB>n|w;~&%oVFiXoe5f) zQNr*fL!R5Mwc1?Jno%+WSRtJ?uupZZVHO7YQbU6ZDk~p$oLW9X##W&XDmSrz^#A(i zTaVO*%M+$=;dD8WvEiahQfykRu%r;0!^1CX@x)nkNpiea3w>tkiC|P=1a|QF$i+dw zKJ8D-Df|$t31aBsQ2iNzf|BYzL%;yUYOnw{6*e;#$?1$E0F3E7U18;kQNLsnZy`pc zwg%Du7~OL5_>8a0!c3pu*=WXPTvFT_9FvgAz69BsCe#`&i^2^|rI>PjShPRR3Bl(X@ENGyz>9>rZz$d9@KwSy}S@Kc)Y;K5%EV@mvN-Wx)QJE zcQcv{OmbYL{6lc6BF`g?NivFGQe`N*=H~%!f1gTr_k!R4{-91~ zxx)`ofw}C+#gPj#mZ0#R|>q_+Fn55tT}?#8m97gYd{IS zJL&W$qXez7z<(djq`!mmxY=|7^iX#F#nR%;5P~uJIyXkpck13Z&cYdz9?y-x+=?D3 zpW0U_j8v-!NRT7yB(LC6)h{71t$HmAYm_S5ajQs5MJg`S&YcxvepRjH+4VZ31mez)t=s-TWNUjE*x ziXIz^vpijdb_0ync3sBJf?Tz9{Bxv#rsW|ki(sfKHmD3)o zU@TqS8iZD^)T9C=^o@JpT6Ln`y}djJ_5p54c0!~sqYkz^-8&s`#2mE5g%LL(h|7zKp_l^;q#lPDM(TChy;DC$5<%_xCI4J3Sr^G zd2CYJF#tPU8JXgJw~0{1o->;!)RYK3!*@Ov;H;)vqG#JSW2wsEog<)3_(SWo+iGHL z$rL=LZidqksE?e}I?@2SWko&~2wJ?&66LEXi;Njw^C#;Y=W=;lyZk4d1T=cS?^X8o z$gW*G5C#}a5nR+2r^XPLM#=x^17NU!aJYE1z8EX(y#M~QzG*X@MAW@$X3q1^q5`xy zvZkF<*6*P#4vmDSMG4qlL&N^-X0%|N7lwa7yZ{%En0n8&VXz_Mumsm4~FqL04DE$dg0>vn2+W3rvU)y-9%j9d4GMG@jMTd@fZ2J2)`47FSV+^1J<8=ADa~x=0niRkc60>Qp#2d@Hqb)lbuW&MsC{vs!3~~ z+}9yucrkncgpYsF8PTD-eHdFfE8Bi-Ey%(Yv6`-PZSR_Opphp}gxGnJi zvSoM3QhSv1Rh0U{L~&(($ro3babI%bl)Dmz8l@Dh0*gk;#L&%5hkF zecsRwHb)f9f3AMp9+57(E-6UmA5T9>Q!xwzg{*Ndt8GB)QGr7Vqk3ymF%8OEp|kn8 z7<&d1+A@fy=5STs`u{C+BSXBqFy>2JVMpzp{IZYtr-ecqaBcC^agjUK}T^LPS_~=fhq`|IZu@S!~{G z&R2>P`m#SBwUv&6>Ww;+G#BQ;|Nr`*VsHJPp8sEV;6q&ArNeyU{C{V(VdSo1_pDvX zxBh4i3D{Ez_=Y@MTGsFV#U=j!X4jhY$B;4*ji`A8Iig1nWcdAQyn{d`>dR5Xq!fShh`B|P_ar; z=4=YFQvdkEObDo!&|z^^udX|=H@nDKg+?Z0#?*Jn(p#q_VAa6CL)UKv2sUS*rz(Xb z>($iO>8w}321%{E3@ar<*7#tIzvBuqV)P2@@na$&V1z8Mw8^{fvo;xqo`t+b_tms97>Gy%0JYfm~BpH~z?7Q^%TBQjJ0p zimnHF-q|%_*%v}g1%!H-I(+2Irw-%NOH^m#d?Cf?dI11%z5C9@?M$V(bpog4dgDq3zdqea+YpuJd+Z}q zGr$T+7y?CG6C`nzulHZD%zGZxXS>H^m zHX%l#`F!fPge7qt_%CrL%0s_r&b}Sr-crFW3FJqZW~Olgzt>lf>zf-PE~bweeZi7D zREs=3?{`o*JkzU*8Tz&c3!(-c?x3^+d9V1$fVjF6tO5F#0^(g}Z5|R?*Gi$4xrnVa zOH%Y#jJVj$*0RrRGcyV%;pa~+nl4mj{{CWNi~93xo4s)#1yZ9LyKy_97V!?pS7t&_ z>tK{QYO*u`K((IO8C7Dc6JM4@4@Ef_YxwsCAxPVv0&gj{UhfjbM8s-HqdFfl+= zongd~y*-noT`&JRx24q5)K8||tMABLh~uMg4^$f^Rh$pEmc#JyNDSCPsDg#$E283G z97cX7$pf?u5ZSpi!MHJoLP>aHx{f8*fAv?=@stq~9L>p$MmWI-m-M|TkBWMsU(nP( z84m9!b_VuQOs}j4Jt7{R?Syh7cU2l(^Yo)KJZSOc~r4rj&E7lDBz8;Q$i0yr1^^NBw^UHQ%baGb4eVsf%x)qfw?aQu>C&G25~ z0Z1LPQ)p=fdHTrHR4c}*c3B>i;WkOoz8cL2`=YINg2WP+(rsx&K#;_&Z%jO8yv47w zU+bcQ&7`*K|BYKUtEt%cdZ#(h(2xc@hQbD%1Ka{^NW z38z6(D)d@r%fbq4Hq5QhC!yaI80uH26+q-GEjb0&ug1Trx*`c!Rz0b#%}TIKzd zqn>^Rfk&7C;us{bfgPZ$O9T*4JFvcD+0leq^DdzRb1Hv>*(R$}Mkr>vB@rtqE>*TG z1gD`<_qq%=-E@9{_(ORy^A3s*)!!GMF(q>8UB?wBSBdiGnLH4Qu)$3TAiZ~vhxPR6 z4!#@GhPb$m%MFfC&G-s2n{u$wZ%igtQ_<0hsEd&oR^ z5BtEg*4|tX zv*kG+2@oZgf-KGu89F77;zug5=vTg7{!HWq`5j+5CxivuyJZaPN4231?lJC2+B6$@ z(DjHpw7H z!$y2VOx3ayUkHM(wV||uO}n3EqkX-RWAR8c@?F96lB5#{$+6SW7K1?1kvV}VIfX6p zGFnWuPKh>mR##{6F^YY&vS~VG(4!FQG!p}mn zhQm^2;$IO?KV!Qrqery?eT4>HLCnXHd2};XW=f62Ai4YKWit6jzk^jkcz{ZU{(F%! zy!wYHzEX^Ch1K)2so`@j822bG7^Yg(b?P~G9aZXSvBT`#e=0RZr=XPiOmzE{r) zIxVAsKRw;1q*r^?TbdZHIE*lgf?V&3yQz5&=P#2gomJB{|#^JuzLzGOZrVJ0c z8du}xo4MVKdMUDuSf`z;7wS&Rlx5UtwE(K1xeG2mH<8jrA**?6kAauD-KTUxxKP__ z#w0pBltgMd+O)_I`TC$HIea(;Ucv%|EQpls``hcAVWYu<4=ZFa-S~WJcGE{ai7Y0Vmxi zIkdF^?}7@A{pAs)uHiEqK!ZqY(4aVjSQb9)^F!WQPbg5>e=#1|AK1*q$sRGf$bQX! zC-}}QMD)?&ZAvEi#zX6Rfy}KGe$a$rC@7g_MIW`bEflEijVsKARb82%L05SJgBNW8 zsS+}fIOFccoNv>Z0vOAnwTdakp+uHjhM z5M%ihBF#9y;@3NCIgLG&UEPE%_NyMUp~_!e%rl|zGaz(tEXPXOUu{0HJiv5XRYlLZ z5|*6nSAz{ZG?D?vBkWSY+H_XPu$Z(N-ym(M^+6|>^4xS*emNRlT32HF0`68$h+<~d z1c>|Ah50K*QHPHptFGEeyT30#>uh`$qX1F3{Y<~fpoM4Wn@l|HO^mtM`M91uAtFQKA_WS1LqM9f;QrveoaadO=(;T5q zeiVc9QDgf0`ja;)e*Y-e@a$GP%;{)!y?oATU%P)7*n}SdPfScR>$*~@MmNsGmzbQ? zb8H7#9FV+5q*Yj&^plK3=FfmN&HGBx`cWedo+f#bz~E~s(0E$INkmC4F^yzO*K5Hv zpv$svy8+&`mJqoJnPf!XG;`uG&r-7#E9W{%qnkwPPbt>ipbIz!AG|5bPhU|$;VvvY z?X79Ko^O=DaiO>xy#Y~J-6ybgqH3$;giR3>ch2>m(e;ZO&b*&qn;nO~$;Il(#5QE6 z!3{@~^F?NU;57gHq2;6E@9n#ZTNe}8f{ampV!xm{l;)ub30C1fYZx6zRGkF>(MY0= zan@2AB;4Y`{pARuvKa-fl%-F>&zKKxdpE=XsF2}NRk3#rQ2#udx1QXd<&V_7ohr?{ z`;8VX;Fdi)dx?C9wY!(F8}k+BSBQ)k&$>7(d-%fxSBNbzkmdru7NkiCjNnpjC)Z9eE7v;S8!nR{HE#D!5n9V9;r%*a$ znl*PsUTrOp6CS;Q?rs%~VMg=5@oZXTV< zlSUjIxY89|IrLq^#s%pc?ta|*+E*$0?NUi1cJLo6)C|QWhkT4=gvcFNIBY)PQ?63k zMMv3g=4nx0x~2u)YoELFDGc^9(qwqWAx5Z{_)M4wNLKg)jl6oyz0+3@%h;dbS!ytA zUBNaS>NaQ`$>~HHGj=AE{XEAK8t0$U8UT<0;=2>q&=@CjOIx@zTT#NJ1zq zK9xNd)hLG2m(R?W72r~z!IUzI8g3#1x(j%jE`9Dr&vYoARn_CA2tiFUdoM!u(&S7~ zlI>?kWdFJVN)g@>ZqAH1_NB~yCl}ve`q>W%-4I^^tDjZpr2y#{TJpy1#o;zE9wZyXSDFV3%{H zJg;z+U(YxL^a;3o;=hG>RNz`-z6_zn-6u3#7M%Tzd5z?WFU$7?f?s>eXXeTZUVC7r zo)5ktHOXFB%lkVsCm~iYl^)SdME@x6I;gDB`g?qL`Ae?(qsUkIMHs1R%nnI z8H9@f&cA?anYBeHN}BHLc?W+g>frTGodkn* zkJO^R41ARht5K8lJ<6H;3d(8DRf7(<`7hy8-rxlQMXZ#;?hY9(2a5K}NrOE(-c0QX z01po+>&~LAL6$@`7JnLHKnLxZJryeMLDoga5I$*Vu78btFw^jQzytrxj?>UayZaLm zd?ZG)_*Q{_rAISKCOY(nZ1LvkDbf}LrXGFULBe?zs0g_sHP^!oDM|~AV6?8<$H+E-%!(^b5;+YR1fgN;fre#5A01gS zZ%%R_9hD}P0WlKe;`v>^a5&L3Tds`ckv-sQ$vcr$F2tHyy{DzK%+m6x;cz1Q1c{7{ zaz5<*?5Xpq+C3X*v~a&X5GRbQYvyz^iJLs@J3=%Sr+V+v+w$p?-VM=7#HW9E<=`2T zREP*lg5>QYzDr^BBo;t-=`*TZKwOs%Dmx)OHHD>CJ|ibxo6CsDSS1EtogazJ9ST^5 z#r(pimHT~L!p!>n>HHQ912ve!nwoG866P}NOQ08$IL0|lI%DS|yjSUCF?X^WaxuzA z!W&#pU>03r6@IFRWl!4l!!$!)dS$~DoHp8ajS41Kw0uiAn00O5J;tFYZUuGKz~~lp zt>z@8*6?&$)6ejsSL6JgeuL4xT1`>VDU_C{rkBhLQ?sEHS^Qdm?GU#9kZ83*pqSm6 z+uk|uWGJTndN&-R12bJ2JS|NCT_H|wwrMx1iKu=8_Z4OU&@PPx=0;UUM$m|Pl8Bsk zyGx4mgxsh4b7r3e(d; z##ey1xR>a6)oTok#&ZV~+v|%E=IeDXj3-1Z{LN0({|%xRE|3pd8>rjF<3PG+C}6!` z@r}7JIFns(=2CUz81i~c*nD2mr+NNT_T(ONHbzzcCINn}@WnMRvEE`BJKCf$t7R=q zpnCPJHG{f2Z16^>5RZ)&>xcM@bOa_~L=wTI!FRo5vqV`t9gFCqD)kXY&0)KUgQj}* zeez!9lAcesrugVIY*1NFCKJUM{9e(0q*9yRd&bb*{kc=< z{#JYF_XY%U3Y1AV0bxr^dL8Fi_0%SijJ5x`R#YfoVC2@}h)gPf0|Mok zPFI|*k@e}O$@cbg=c=|VWSJiQczrgD@!_cPe9{Yb%$nXduF#m7#v@i4IyNX z?W-^#Zfii@lP46nuoZxLS{$FA@V?F0(BgE)Fp^8}tkMsJuoZm5d{}6(W; z#ApJ}T$Cneh*_BtL=f=#)ZOye%&F?GjdEP9y23&rd&tj^c|U%G)Q}(MQJMcR|CW5> zu{LM$cw8<4Bs1z#Y!U7lJJbwxJLG@T4-;w!P$0LSW?FNiZH;{ZMP3^pfgSJ|o0RaoMW>JnlQfEqmjI za4=GVNgH{NhZb2H&c&8Q3ek@MD5`i^NcC9Y%Z`J&86?M!F{tI0n0~UxiPR68jr}=r zg{Ea{TO?vQ5E^5x%7NkX*GH`r2$>P5mzg`E*6DS&GFIoB7AZ8P)RU_8oQsJs(z5b5 zAFrj5tSq5IdkQCBImA21tj1ab0t412SMKqpwa|?Ta99{(W>yi}NgBa#T1r$n%T#a8 z#PICKVnE;>QG56i_W9wF)p}lnPFGgi*+wf0fBO^BY40l^Pvu>^$AGyC+fC+ruh{mF zTH^I8vb{~}mdjrDmg_~c`P)fbC(khuK9>{5TseN%?McN}kU> zMrxoYjn^J(j@fc^{O=0YJ1Y~jgh3|c@|DcN$&$c$Z>#w+ir@Kg#5EpPGOm^!h_bp8 zkRvX?F+K4T%VCw(REDC%(W>RZnp4yaJ2ytucU95q`=uH$Im__)6#~1uazQwn)({Zt zdaLMx-x<}#lQoW)_iP9VkmOJWG%WRs#dh};M5}%wt7&0qh<)j_09n98-(mI0Uc9|h z6X+D#Z79@Za|8_J&MaO?g+mL_)~*kbV$0b*oeTLAR3t2(Pa&e~6x(l@Hp4DS;XCE@ zhC^HEJm2RNzHRe;{+nvj0UM6|{2Y%XzcYVOk6wY5bdJXy=&F&*x%9qMK#te_T<+H| zj#TQxibLKX`-IA-KK@G#+$35l`+SXgmg5?c-)0^iij{MJ_V zmsUPVpi$mv5vAR`$zw{5Br7}eTh@5pS_AY$JEC`#-g6o<3Dkpo5-nOfgkJR2 zc$e#VWb+TsT5vc>6eSmcl7McG?fW*A;tQj`nfrPJr`NOAnEU!>%5w&O<;|Z_uXH1C zqu!E_d=Z|1m4e^wl*0x1S%cqVI)lct+gv65JtdC_o!t@N+!DTeN?kk?okebWdj1T4 z6Fd^de-oH&%WCj^3o5)T?68Vjh`DXmNS>9h2$MP}lb!V@iy`B03+2{ViaKwi!c7yV zLVb5|EbBXgPpAwOdIBCG=hdwM-}q2PgZd$Qq?w(&2h`wFdEDr}&B~=*>@-&Wr7}_X$+pi__V%&?DB=#m-IAo{U7a<;IFQT6Co1$s)yUZ1iQp~WH_#T)A$ymSh>wAGo>&t-#g0iqLW-; z@;g3w$6ICdfl7)n6u{$Hg#2GuFz=^#XM)knB@_XBiSGUt3ECs=NLVNm8~)`IT(cPt z5G`Q`Tl#hHBW8zwsOXcvB2;X#Oby)CuF)|k>kN*0_4 z?HzMS@StT(;JD#2#TNCNvD3=Mt-^qM5R)ry&U_{s#9ps zEfX!;rrO!JrtI*LOigOcjTV?UT~j1*OJ=bY}>uwT!w>a%M6S1)Hw0|q^L!} zmh6X`ixaaGA*1D%g}sy%_B#?O zo0t~w^DoSPYAWG}vhT4fDjQNB)RtO2k(znG6f;!Flhg|>O?yWWaHs}GMI3-kAy+Kc zWLLPju#{kx$Sh6{l(`C{jpYIK24`A4l^c6wQ%j(&I0JmSQO@}wn=%K-rpqjnR>3_@ z35|lz98^qCK%{>A^Lt-$A%sul=-bHuJQ2OJ$b2KCexqeq)};5o?by!GE%ei2+~)<9 z!}lCZu#j^_${@vOV^|a!_JuDgLVgC}U6F#^JW$&^B=hL!1Rw#c${g|5av1)yh=6!t}I}f*LGx$Gl z4lJL4Ma#82278>owV3qV(z|G)NUMwz9Hw=Xh=4;taeaN8U6zL?m8XcS(|=IekvS)6 zKlxpisW%rID+Z0b40(%;uaHEElHYsr1gprCs=5chWCo^W1o_<`QQ5^B>UMzfB?S6@ zgo%;VFq{OnaPvtb(DfMQ{mK^09yqDr{ zpCX@6-@azNPQ3O0&wRRpJa(;hlD(ax9k1As|M; z&h(lCN9LcynC)+B)BK@_vJU+Tb0gJ(7KcC0fLS2o(MtHeu?B&h<3hl5xBjBv^CjWl zmG#9nhJqhnkGy%7>d1+8(jrd54QFHoM@6-W%RSLD&tslA91zb8#O1XD8KeL0jtk(W)z5qBE%W`J zYAVa0>CCU5ef4v}jC{U$ixBrX^Xwt>6rK`zrTo8tg7O0Ark!KBA9S{I!a!yjs@l-Wx-fQm4RQ7x4ZXtZ6hq5Ij! z`}bxpIF*(&##Je~H(@0yA~&9>Z*Yg!lL4jr`3{;U<&urk*Dic_>msN{i|@4CB`c4S zw)PVL+ui$RcbYxY2<)}?s?Mc@rUX^_v&&zSD`pSAL3JZ}tUD{YEzKAiZGor!k&g75 z7ENw1X+x*emp23FcNJTW36MY6%n^H2*2@}%XDdxCD~?3smyR~CqdNm@^|dbe0}oGg z7pVxGKkdXO59fX{9}liMW@H#7-Zw2Bogs=Jsq$K>TDCo2K1~IuN^{0Z?};uakd|XU zH7b?#b?8-{{tPTn6U=afoB$EC{bT{Gc@y5d);!!4soxTEvGUNhV;mAoJNp}RU99xJ z1?(6a9ZXTk#^l-SB{2$4GKaW2-S^n>Vi=O3QIs!%H;*hUu&3^=s^pIK^)b4ZTQXSFB>GNjzD@m>**acMz2-?OUpkP% z9|}3QUcu=*G*Oea%_TOGT9jLK;Q#w((Bk-tb(GK<^lRvjr)|($aw_t7n>Xq%>BN#X z{nAfnqV6VjDQRY__{kJFN{_y&D)SZ7Cl}O_sm9bRipkpV7L$LYpU@6MDq<$3l+ZjL zs=B8z=T2&R>m%hQgDY)=52E9(5~eR%S0nYlp_qi!#HymnyCpvp2&`Qxx@OPyG(=Eh{W40j>_IQ#X+0t@AY8h`1l(ANT3@@ced^1**7H;24ElzW7aI#&=3ZE z5$MUUgHJGP`HhtOSEV|G6yn0W(Go=J}YVp2*?}AAa63B05OVwC zOsKhKuqX-bv*8{%k#~zpeTkp^jx70{ub&kBB?nJ_9>3?{>PbS#iAsJM8SlFT-m}5@ z=W07%50`jZProSE<8nZ{N8?9^))^nhq=^M}Zfqr`SUYZ%0oJcWXSM3wFloSMyEKO3 zzOj$m4T<@7M+eI|NI+34LL%)oz2xq#%6AI!L8?iYPf1( ze!K&9hM@>a*fmm@v4hkDCl7jCosZqw+QYIgz))WeyzU1s!mG}j#1c{0#Yza|?N{Km zwx9OyM8h@!qG%biNrfVSR_5U``KV?z=&oImF#a&@BT*E_*~p9&DO?2BR21ONu+0E| zP`y{Vx4JUr1WP*T`nyNT=d`yAE9+L8j92*KtlB2D@VL1BV{>6mBg$TVQ)K7Yj;^t zl@$rAd+;@-Br7Os`<|AAWFl&(_+3FDRqxIa4Ldv5?1EMT%muc66N{cotq7gL=B7!- zX||c1{G#|%60jOSDGN#F=3aZSr*uTvZAEn^)ftSbrl!Kmtbgw!^Yk5}zCym2VGTi< z-RLFlViu)-i7H}d+9dPDT%_dAhh*->iPdr8x%Ce&uH1~Af^!BIWX13_Adq56Z-7he zTwRW1CQ3{WK|jNHK{;#8LF%>UWSVgS)}Z7|US*XZO8ENcuwB85$$mKM(9!`gn2}ok zhJ64-EWX0bz5b+B_>hwD({QZV*;#!(H&iL+>zVMA!hHQ0T4lz=8sm~Oe?5b*HY1!a zF3A&1E8gXghSw8pOB1WXqmQc73A5Sxe-LLzMvRNgh0WvzT!0vbnOju-e}fkX@mVJu zO%DiwKdgB8u52bW);^SV_~S5t-&8x@lc2cqc;4`A3ut>4#%kHXk)a8gm=%1Gcu4q} zh=h~p2{8b;yAv1}nPflZApmDSxo~STadJnLN6_1`|H!g3h)t)|Fdj&}sjtf_qe1uI zQK2d{eSc2;V>0g1I8T0W!>Wu4mb;;0PD$G4(TRwP#pj+Wcv`+KP18l{F~p0n0?ZnB z#rUnbtuG=C9<<`PUyNpt#5uJ0Ze+`hEoek!ZOPJ}G`8cENdXbx>fS?;Ons(3&ZNuu z%Sa9oTX3QhbK!-38-<$*eAQKo+chJd@Z0`~qL>C=K^YW$yr~yE)m2#c=M%Y#ePOPE z;fxA-gStY%5eI!%es~ z5GjUrd0DYOoR`wzbkF-j?b8P>Dlgt@Pmh=Y5Nv2gxOctYk$)X>i7E;n?yM#xG zO49V1ux2wLyB3f5|7d&bpg7a5(RT<55S-v{!QBZOJV@~165PFk4jLdxqrrk}Lx2!0 zKya7Foj`DRYuq_6GqdO0d!JKv>)unhD*uG)YI&Yz?~>mFzF6FHQTD2B&!B{%JOA-4 z(&t1s47y<5LK-t;-QQu~2kb#VwQ?ixk1R(kHjRec!_+faN9x2)6$V%yo^swjsnk&8 zc6Q|*px!>y|sR7?zz%CS~J`#$2qZrsjiI!)~E^$uDSc z2?Fsib^j)193JW_xivLtR+zGUweC5JvBet?$tWF6S3sPi^g{}uyhqIz*W&LN6sk{k zxl>^8J3&>|Q0_N#m6)Batz2VNxhF&T~tPh)7A0v*K9RQe#t4I8ig!4hZ4)s-vO>-L>1SSz3)k!^{0z{=_%qj*+D?xL>!9G0)6~0m?6wBjM&ihZ>>4 z6dh6MU?&mHS>m4GGn~I^D8XLu4Kv}LT|Q~x^re)Eu$B75|5||fa<*)(U7RlzGU~@W zrl@P7fswL{##r=SR$2Ge^|kP4U;dymL&V|?B^@dJA5NCkSwr$F8VIPpB0uAqs>dQ+ zNXfm;J`kWXIhBnyx$~UR95XrW(|S$cYJ46=8+`A{R=+)G%);1q#bUKB6Jg}Vdg^K< z!|~z{nv8n2bbh&&ve)FKAG=`^67Ry zkYbCn0t(l_!w{maaG$JU4|T`6X(?F)i)P{HQPQJAa)KHa=KaDvWHXlowsfHnC=471 z?ZLZKs^EzGkDFFYTJree3aF~;Mq%Gd)wtcC6*5zI#ATsD2Yt2Y>ju9A&p|o*n@2I? z7nCki39UFQ<8MIBk=FL8ZSS!uvM4o9k^L+!DKsjQdB50G;Yq)I5xY@9qh^zq^83|* z3T%lmOV#G)z3M4cZZo%rFvCy^|HI1a>vm%> zHu_WS9A6lt1J?}Dz-*WL>w_@pwhyL=tpyH}H31 zd*RH}!7wuVP&ozdu%9t9R@l&8iM)56+XanLV?S5iTwY4MXprIPiM`#VV*NEPCY>%; zPmv2^>ttjb=iwQ%8mKO}+*ZA7S@`5N6~-$rcSR$HkHpy00cxhj%c`ZPP2h*itIVnJ zBz#G+sVCUJ#=Coy>fq5szgDi#MnsvJaJ+DcHXl4q zt!;3EQ{Vix6Fw3V6sAZf_qj9?Wj+G#+jY=?iGp}x<(~!__M;Zg!YD=U2#PLvS?G@{HTk(x+3p=r(+gxkDX^Bdu{uUnhz}Izlpg^_!38JwxU`?h8 zRs5QW6mvl*v;`Dpfr$z_YCo?ATslmW!I#9sZa(JEycF@FOkf#WB%uEovTpiYYgh3A zN>qFG+Xl$*a|*tcvbH5atK^Er1krK`1I?SqT;C>4JaldJJ}unq?=pW*Nr9YaQg>R4 z`$2!C2BZ~$ur8`;c~+5_cW0L{e4d=?Y4JFtxvBOe$NKIfh4XUAF%?aL) zbu5No_C{I)&JpF?3~J0``<9z#l2$V>^0k0hs+ks%k#_dfl8jfPB}XBR&Mv%sSJBJD z+LhN9Zs8CD)GkzY)j#U%))8qHRy<>u3He}5o2E^oEI-F%t2^Ot1%ys=Nu_oFnuU7-2))$L9`mWjt(T5FA!yBgz;3;!cg z5%@Ipa;L`cr_DMgeGl=J=W))uMhrf7xy?S}9oz)t=hdSbRWVWu1$Z)Uv#VVuA zvl%Yf3?Fn_8RZZQ$HL4EWw^vpf@1`^r*lECGTHU-pf zkL9v&by3>m15cB*y<@*~K>%*nt?dcNYQv(>lf}zlHAh`?EgwBE(m!=jIx*Gj>JGMU zTZn?!wZ+?TW5lBwnr~%%E*OThy_G7r-_Gr;6l!e;D+q7}M!+tXD~2EF7KFgh@3)?? zt~!AC^EZz=4*ju=uWvVx?y~MsGiXU{ylX6;P&S^k)FWlJ;u_y^H^b+%a(`H;>cKb% zg4|RP8P@0>s?{scChkaT)A+i^eALeAMDEs9j;6A%oWR#z8JrCTT;#{E^Cvq9(K|{> zyQjo1Ho?d1Q%QZTt z;lP8AVgt~2E>sqQRw;P4Tns*iA41(UF+wFE#y&S(x2Ihf%PJrzct!bKYh4JV;R$1t z$J4Bvc4$x0woIp4w=l;oit*L`_~&i$1-m_oy7AWSZXx(QjIzr~Oc3=Duj##cX0F|F z*=OBRI6Mg?_D4TP`YeaSnv`I9l+u8wUkF7V!IxeHpF?;{m)jv(h`=eA5esENUO?qE z8K^|Yd4B*wWL|g#cINw*UJ@MhcFN&g!T@XgY@fkElm53b1f z=V-<S7!rEoe&bTimk z;smi-fYT$_tK%GP+E4^m==b=d`+QBw$X5_Dm7N$hufTI@`>^KFX2u+8e>T#?an3&Js-$4Xo~ zZ#L%h?iaBSyx&;L!h3F{?#%3RyQVqJ0mSi4e8}z?0YX}vX1?UQ6r)=2PJ6kmEgpjv zZ74NXO1^j|L~+wS%voAV_r+d04rz#0VToWPuQYeSi_Yj~eHH9G{2WYEQ|!;m&fc20 z54&hSb0=$2Luly_oXWgr&-8M0qUn5s%D$I0WV4#hUlD1NjJ*74vgf4HUd4|GW2O;G zd8jl7+j67dEqu$8rqrY?!a=;lnZNlp4nF?v0L&+fO@vey#4Oh__=gwx-_dttI1Z?U z9u1v{x5fBZ>VFfa8Nr%dfy+^L#iGGqGzDM1DsnHd&iCSwj;IbT!A|FOrrqfuyA4Kk zT22%9c|rT_k}|<2jYQ>PNgsTEM|<>XHA~G*BbRQeNxX=iHH^RoE2TUyfJan@r?RlW zB@#w)C-Nt+v3UXGd$IB-Q_(G$1fyYmuku%IsW}xa-?w5^ibw~=btt3zxfG7A+F}2}p6vWE7EM+a^AgHB1(x zM$RNmz%*xVCc&sR<-%Y!}t^koX#?%KjU8>hvdj>vZQ@Y(tTSg+G#j$r`QfdH z9rc)(xTOW~aN@W0)pR80V#N+9(FnR1qxO~*|M(Pe^Md5&?HFao&<2S?lNb40ho-Qh zu*Me|g$v5b{g%K8WEXmh;OOeZu?ABl3_aidx5@WtPUlJUB_O0jQ*O0L>C{+!Kr))~ zV8;1ltC*#2)qJTGZ%W|=mv+9V)`dKH{cP;&1*?iS>t36nq1j4(#Hc&H);tir^2u)N z@t9x@IUq75ZE%o#Auhf|6v$RGh-XLiJ6XGc@1->?p)1ku@sIO;Koh9^K|MuZ);l|u zTsUPjp_VzqH8lF+i>xbEoIIgn@!S;O)knZhCEO)~F#Mkr{@BH({`g(Pds~khQGf}3 zjjr22){Qh$tSINH_V zsYpalJtHzKIxq2OiKEcm#X7DOHqz`p%V-4ESM0|#Uv9*0DWunag z?VFvdtnAnP%EM+M(x%F%2iKz)M_o=Ml>N`+c_}NDmIxO=kj-Kmyasz=#!C$ff^La^ zI2yDyn-z@A8ARyUIA+J4vyjH;RF*uS;&IHbD*aE=L~S7AO;IpxC~af& zJRI#rO;t7WzD+F>9gCXdhPltyE+6N~j2H6As3v5u(TA5$AUnG@VJJl|To}JbajBlh(DNy1_@a{E++3`FpdU%>5V!uO%*i5Odt0 z&R(wf3&*muIF$9ZL9_0j9NTstIYsmgH-;%r0b-VO*VD@)Vex^c1-~;A72#F)~=Lbb%BZ$t1N+(|KG5|xG@Kl5f3 z7rfsQKgKWtKVVK5^m{tRkp&waPa2uik%PIQ$0%vzne7R)Oc8z8;5wb8hwsm0ibb){Q<{-3ty2LIbf|G4fd~s;OA6RL|9c zqK=;0L`aACMRsF74&Ad?J%cQ-?JoXEfCe!RGzZ-72%UmPDtN2M?-mty-PGhSQnxSugGuB(kwH~B zJKs(qEPX&x(DR;EIa4Gmt?mPejbOAXCFsj9OeIGALUy*V-nn>e81B}EPLGXYu8tNt zIXTbqgM+syh;(-`O_HmCPNz+(aaV)w*3GojOZg<6x3UbT6ar7EIo4=tx9s*i@+70b z)?4ycLz*7z1$0Z@S~0LQcj7kAB5pl8Jt= zMnb!bU5seC-b)%SbBi-clRDqVf321| ztzD#CRY?|0W%tKU&efbo3M2aQZ~adnkccfD)Hlna8Se!Bd5~9W=fS&CQ%AQvDl1po zenFx)p3CG4Q_hjhZt@&!@YwZ?Uv*8&wxlK(yZfAe; zhfgHo?}c_c>{NW?Bd>PLFU@q)F->O6{5~Cuo{{+Q`|w0&~)UP`Rg%F-;a2DiauueB`e?v)XE z`<>6xy)bxlu;ys_08!9+%h2BY!H{ghA3eCnaiwn452C#Q#&T-BeqrS2F5FE|VTu>& z4e%`1TXFSXcNW9k79Y6%&Ug2n-wvAa+r!HI@890uCT2KaZwGUjcNbMMaB-Kmo~?Sr zcN9668N?sxJPzif1s3N*E^3@$_Z{AF0&>_rVyFuX1EKe#5Am?rjh)X?8|Lk))i6z2 zRq(+5b^KWC{wpS8!BGU)ALH=C#po%&^LIX*gk^2Avt;01Vv+NC<97VauDt|8%KHs@ zpWRTEj;)MtpOKJ(NET~r2dQUGwPH5|97huz{_+>w$e_JLGtzldSPVtSkY~+mNs{qb z!U`X<=@SaS`w2I}*B2Ko!(vgm+K#5FuUdBQU&Tb{;yQ$P*fr(3KTFeydDv1(ePIsCUH zrakH7mFCIzb`WllZ(>$MRqj*oUpL1b`kmNKyYDfZp5E%G$K*gFmv2s6>%nlLou3PFB7@>rKpr~F2z7j`U3)+xF5=u%+(m;(b94}WB!TT^|T*Z9T>5>s2andY=zOo z*!St(DlGr%V}BTy(Far&pOc$uwe6EkZbKQ-> z1uo0)6?*NmH)53Dk{)oKYML(M{-UOI;Wd*XmfY4g(BLIEG+AkWdTyfWMky84WuBaL z=gn%}LN}73thV&kta~`(L5Zkt}~_ z*s!xr5OaNwJByTel?@9NbrK7OWnJ8-*20-PhW!K=vUBWJpSAv;Rxf}R9P9P_VbY@REp3r6doqBnflMnCtdrTifc zIq~AoIa~F-Ke4#oHZ};Ir|py2REzhHEluQDUY}a*x^cQCF@E^vsrHK>yR1NPy>q=% zuKaLG!k{@dVC+_35PT%qL{*cswjr}O>y1*<P)l~P}S56u`|CM%4&!_UXk1b zI{`4T*@`by4~(a$7)yOo`Xi)Ho8t*nVFk@sn_y+lvSdAJeG7U~Qn5}huZ5DG)eAL%2UAeqR981=SeC&|3U(2)U1!lr(z?z+{$H zHM}PFA`3Bbx@Cd(2G3d+Io#9tF1&EE7ug$dIy!0x>5&#tyO@8F!@3x`1* zpkI0k)eld-^lwd=%SjUiKWs_e?r5u+9gbG2rmVWhJgsh&WkG^ z{TUXXMi{-Ut1#tp4V~rCmhXS&HqP}p*zhTh6JNV)(3BGs2vFznY?6YjXz|ro& zlbu+~RmW^ZW2+uBe)d&Hkm#dCf!xa%fgP(M^OoI9OPm9sJ%9k9G~&x1A0?5`R;deIiI%5GOp3{C3KS?~aX&ZvbN!or4SHr=qB z-#_KAgk(C2J-uVE6=Cn`mgOq?)nPtjnlRL)PMuU5pbEO%RsC&%)7S(}9PmcI%>g$L zkGku=bH*)eyd*R7b0B3-^WscvR3Y5V*6tlunhNiwE=?q6l#|Q;HH&@h{hpTy2NJTJ zw;3lA_LlGC|6puk?ZA8(j$edlP~tQtW&jg1ItA3G+JPEi9dryU#5mwGw;CYru_d6$Ni1YxxH|{XtF)OVfrt=OeHbUumMrYGSO~4 zF~WLl*n91e#r+Rf>k+#pWeGVDuirPS`rUZsWe|345ErW$g5$m@t=LmCC)0Bm_BY@x zE%vc}y75_WA%;%+<=24-m|Td@GD9;SZ$MAN8@BxOr)dzQz&=&KZvsS)++;ZJ!>zm{q|v)2v}mH+n?#jk|$=d%lFYwzspI(N5wP+e&&`` zqpcG^V`O2?y+X3_8Tt{a-s7!5GBf#cAeW|U0x!3`icAK7kTX62H)xS#anX|S-#K%( zwM#BJ!|ywwgL=2}85CJIqpORA#qdRrV(07`l&oPis6xPx;}>{qgwQ2Pgc%Y&RekNK z#&*{Pt9AJxGb@74)ze8kMwT8~HJj(`27TS1x=}bBTIQ%6JpQ?%AHeUJSB@lhm|iUI zPIJHoL*GI&44EgG202ri()-^olc_S{6Ooe#*-9b;&E3^rFI<0veQIA`F<#5bs;U}= z;GjasZK;!3Oe$t-=33AHBvSwr_>tc)KQZ@8SVl)i5WP_3<}{yvLP2<&+3Ce?LQx}U z3t=WU-`f7x=g@V!_zgE0onOP@ z7P4|e9vjD7eKC%&xfOw&;NJCKcm22jeBzwplNu!~o+lkztS${2|MTbZRtTnVQ{G3| z^DJRe^xr|@{|Fq=rOoMt!0q4|ii;E>rALocOGxLM3pFY-N`tvgc@*1J4;PGCX>rQ} z?aHVPdl%vB{h+e--J%;V=gM)lr-%});VE6u0G@lNrPlKn!I+PWF)6>VIs?zl{5&2R z@osLrlmdV1R$2_eL7ozp{7 z=AVxCH1d8vyZC_JaIxPu%46lcwM4PE;D(*y%RMkKWMV0VRIMJp7wHCG1vnw%yaD$I zj-b<169X}%--6^xYC#n)_*ZqWKvQcgiP}ao@7%=eh4r{t>rK^EvP(;G6cP#a63N{8 z@U6FrKK8GMD&(|w;oiVEZiL^L3%y|ab9#k71DJ@H7OnXVgD9sVFOqt!ybH#y_9D#e z{k0-MCj=HTx+M3Sz)PY%v_xRGD^~kG9Tt~s03<1MYKk%Vs;djBg4ER2KmAyFVlZ5* z+})0u=!(9cA8c)ZC@rH*9d2`Te5_!;*e9uGLQKMJ1P(< zR~W>-Uu+H=wzf$jJ8!IUt!Y&~L94W8uM044ITCR+-&mfnSm%%pX7SB&2oW!=^2 z9q|aMD+}>-^U`U;8H!PS=QC=-r)2DzEdejMKgd+I+!iOPj?aYeDNZpCiSYj9H`Q^7 zM_MrUv!|2+W<;*)Y=EVGkkNvWP0W8IsnBurw@ zfFU3Hh7~gmFYgN&!(#l8XcOXW8fq^vMDC9H86zo}hI(T?_I|_p*%y1dV>Jpmd8b1W z4;#ZMZ;vhTHY`>zmqmNndSqm~pEceLrA_-^vJR06fAsV`2wbp_U-@(K27Qw*x3l_o z+APE<2xHN1a_JhXfREUb5S0@SI4>_J2s=Jk=5xFPjvz1izIIn{{O`0Lg-wjE1LMCJhK-W@Z$pcz-R z36Us1N|I|L;-C$Im!A(>TJ-E~$^O>v7EG{9J2@jJwVnWU;QI^30bSfaB1#^QXiM~wGHo0cduT(14ms43|^(&{n6?)<{U{J7t`F$y)eMvM5` z@PUp|BgI>uG#9>FDuOL@FRhRS0C*FCB6x?t6h0hZ8{1Kdwrc49Lk`*&=S z9Mk>{N%;+EBaO^gLTNQ$-!oLv>Ys=pZmboOQ`O0!$W?gf<(E3g{6CviCWV|a)srTJ za6;usQgYrF!9M?Dt=_|fay$)^c>1JSx`~HN@5x)-*@n3VFfAgtSguK6GAi!NlK7D2 zWBKr5hMf`!Q`d4%ZN3`$izu8gI}M|U-id#NuhZE3_=@{9iA*ppb-{23BHi9Fqa^+Vlp+iRaFMBGyySf z!5|7>aK-dIXCW_VO34_fwx9o8RS}=-=wMP`CMdoRvcgdX47_u{@aLvR_57~3S zfl7XV_YEwLq>S#_1&pbs8D5+;ngZM;AOwGYLO)@1wnCRr=s#}L){DSqPrxE+KJkf* zdpCiRjaAyj?^S)n&B*wCzd&Nz^iOBYgrq4f^TW{YT7yx_sxDb)5Wo)TY8{y&fb-uWO(4;n zE)lA#@fbOePoO}i$M4uWAPZC|4e84JdWW7<{$hsuqAPhqckD8CPv{N6 z2_|5+BYp3Na#HK6dbh6E-#R!vY-VY>(M-3JlJQpA$*#H_7&xoW43~w5b(t2IDk_MK zKLVHL&YttV4w1E}T1i}yxD6%sz4S^W*!L3tDsA(nA1w&C_=$)@ali8`4y@oB0Ap9)@cFHyVQmaF5t_R>!NZlS|oFw8;D zUykp`55-XfgP8kFg*Ci&Xe|}uWMWs(!1veplS&C|R=Gcl5b+a!h95sM-@woPS-O#f zkq$P)$7;M8C$m8~L8}@JB#IPk7U^AiQqo{Y3P3aUD1#-bdpk>hvKI*}E{phaAU*cM zQA4*G_b9AP2WJMxdDwdcHQSStfgsjUhub+9q=+uQPS@dDX#Ypn?|0F~C8&+F&@S9{ zTI)1k)4t81DYGtXW6G4DvY?-*xnHZu*4MiV?F!`_9dW|lxO+G)Xn_QrMO{84$52NR z&nDp4B5u>k*0d(F8;bGg+0Gc5IHV*@o_|w}=&5>_ldAOI>@7myxBgh|#mLMMOwca@ zs^Y?@Q;wEW1p=*`?(fa5@ob}F(bLfo4d2$LBnJ1j`>d^5EO`yRH8&CuP2Ev2sQU~_ z({{}H8K*=;-1lw80CeG=Q(Zv1zt6_0OFm{bv;Nhg?pHPD+{zPHOWFZhHgi`x(2hJ~ zLcF=q4OJ2oHi{fB0>FUzl~q*4q@<$4uyGJ`+wFS0aB+|Nu#M~=w0Lu1fetDU55D599+D{Tvx;dvNk8Ov3Ci4E_;-tBmFFzGt+CXu zLg|eADXmci#JNTSz#fN#O%U8V__Jkc}Sy-ZO;kH?b^i2XL`vpDkxz)nqvKmSublrYtH&PWV!mwukl7}9jccnm8mf$fX zyJe!E!wx)$I8|M+aI6;%=7j(`JcXjp&O8M#eR6F^D$1hS^@_FeC7c^7cJMJd!iCnC_!T#jf9)bP3IL%g#oQA=Z8< zL?eliQ1Itw$H+Hkr5tC>UspG%%IGzbfxRii%L04@{S@TxC%Svb>uv0Q83P)u?lWdy zEDwpCG=mDPrg_$UPwT+32D}(SiW_yWq;rXWX#>}AsWoUq3q%A*1Ao1&=K`l%@;dV6 z3WTyCs_GLCIcX}1PIsBvE9FY^^M(2RL2rE}$ zcYx-LSM}C*YR1?8>}>w>MT26?!IBB4%V$w#PH*1G4n|#<7Lj}(-tLdN?G^OC?v~3Hu z`kz~=b#4&{-&onRRhgH*Ry-~ zyxt3$b7UdBJrF&;(G>&ZOw^j`n~bgpm+U)|%Ug=b(+LT&nF#fn=Ehp=6oInUf!`6< zx%<09Le6XqSg>Kk_D>6`Z-_fMi%A64UNEdVf7Z?YV6t*Rro6kFu;nKW;-b;ZDE;YI zw=$plQtvyx!nSnLO2+bm9DsJH5Fx`{tf7fTY0u$&f*>B4L-oYmp7xXzuU}@0l?Fh; zp?^P>TPhMQTW%3Odq>tMqKGxhBADuqW3`QN+2onkL3w}aHtk`FHH0_U8v7khFwq~Q zENdos@oK^9XkuY1|H|xD5}*Rc!jKm5h8_5Hol>2Q&{^b$MtRMM+OQkf>Gp~LaV3Z8 z)Ff`z;5(*LZ+Vd(Pb0BF@vH5mN1{NdOStiiE;qql5wVAr3%IzocqsSq@>4c(*_&5V z+m~%O97~=p4^!ZqJ)?A%f!1YxLg)G=p#{NeQvcU5_$oQa3g|vj+9%27XyeuGEAk6M z<13tCQI0N-FIiN+yZgYh#8=)<>5-d|Y2>c6y|x-SviP;WNYf!kI$Pvsug%QGP`?~g zlX1cr%dr$$<(nkI`{9;T-`n5u#@!OJMiuG5A_V;_Zrf zjptZGK5U}u0wO#RWZU0&hvjnC*k4YeEKF)oifs5|+u&|ArsX4fQuGqu`eH?T#Mn;` zGB3gh$T@uAULfB$>@<8kbC+S;MEIMXz(%thS#?g@zJ zoQg%0gD~S}({n(#J4^hxL!RP6+A;pGZ^E*qD$4c=G1ZKGDHgxF`F!QfWH7yIOS3wv z;qW8O`fyGv_`0Rbo$(jMZu@4otLf;2y>OFU-xMtTYCseDy|rU|srC6Q8?S}1vw0!+^!`3ZEFx>q zM=e~cp3u7Cj@ar*Jku}m_yT#1E20sI=U&X6wykxFvbF7S$$R}j#e~L%zOZ1MBYh)?{z?gjJSECCxYTnl>>?P~NkLR?l zeuR(|$3&L=ewMU=S)$Zv@3oym802bCL~G`1&6I9hNJ;KMzICwOrsIjWLz+4|HyJu~ zF9Cj%Bi#qkGACQ-i&Q)WOTglec8OmcJ{=U`1Th9T7hoQ@0cuFmqu$9h=rM4sK~j(=?RoFrQ(c^saO7KULVGHkh1z z$(Dx4ZA&+K_LHWiLJ}3Ku(xXT!UlW!IE{H^dXXXqh8-g(?{t@#5yj|O3@J$Z0&$SO zmM&6o^i9z;rBaxuN4G7sW@eVz!qiFLnbu9qCNQo~ zB&l9A`se#-D&AmUrA_HXe{Czx_eolzg^0T*W?&>>;c3$tnq~-Ue*i`1CUDgm$iSEt zKDv@90~p6frV_EL=u46H3EtrTyrWB2FP= zye^KUH^N_zrPos8jw`B~FfGW>)bAIXwW`#6btoKoM2c#g(#M1g$)I+{Yo&IIWZEu@ z)d~Eu_iJaI@-4*;X-xihoZkqxqnv2l!^{Y#iWn{MTo_hKa!$h=Uu+6y9>RGcyAo?9 zZz>s^6e*yB^lIGnKXJD8o1+9hbwQXi3v3fF0rUEW6688x#u(fH2)kl3cc*;IHt9AQo( z-FsZJBRK)$b>Q$FBNVAmumy!GA&F|y?)Y>ydD@( zQgoT~%Y|%0b;KG@(eX@hi??d5C-6DoY5APvFN?ScySRi|NW2Cmib;~1m6f^x6f5OB1?c=t^Q}hXIqk$WZjCmBM;}F zzXTTAv5;tRp~q8{2PjfMR&nysfFuBY6R_o3@-Z7APY4v9l)T!I*n=OdPx0(PH75Bq z5W@iVF?m66_#RmKy8Vo_7HhNXQ|a0J58tHxZ=`2*>aLd2feL0canT3cuUDma{_+F?X$+ zn1be3J%OT93}gaRk!H5Gz!M7(!Z#eQw5aU(_w5A3N0JBZ#k4KXU-KDeRi8U)%u8615DI5{Oz!MXZc4w)6D`g3a%p*>WA$Umd_hcjHP*WuFi=oJ?=H3zmH;KP<18;bhft2uW zBB!{Cw1fK<(v7#Ot`THtL4qB)e9Mldwmss%Lo)- zHrq;CqN5JmpRLlV8*O{KtiO=t(JeW;g$*4H)mKu0r=MRR0a1D^0K39p`(Vq^XaE_G z95Apg!}Q1s-hKT( z9Lp~&LFebK0I*@h;nOF1Tw}Dy932=F`00F)(oCv`4Dhu#;y>>Gr$9TiX#RgW?ElgR zhsc0c%WGiu$L+r#b6Q4b;QYaBswFupB56*dc2Fecx4-1(ZxtgoS^7$g5Q!P{nxC5{ zDtKmcG@!ZJuU6z<8s$-Q9v4ylOLOMh=U7D?2|@9;kv%Z3iK(ESKHF2wNP0;i>-b%K zE|%l(R|2{al8NI~CE1VsNjV=yR63}Q>Xw25oj!uMwW`ZJWZ}J}ed5t$LWx3wFWL8) zm_E}6_)ZvrxB)CEWmc?U$+$0As2K_?JRxA*=x)>GoY1eli4?ix#UTJE>3e7*_@LH+ z9V|kzeUY&nKV1Hw*U>AnMJe5n9Nnx@9Q^mon^9H?poHDknSB5H9NCG-n(o!hC18Wd zzf1NUYU2M7YSG!sHbjekM2&~qx_d^Ajox)*`J#A*8Zef>$p58UIZ>R>)G^QY_eGOG z$Cw%9OL|%fAR&h?Gd#kq|5JBPgfR+BZ6!Rt1wzcZ(N8^ca=()qHU$|x0cPex+Q_fC z|1y_=Xr7#$jMXELYQ97XT0jAE7!iXZ?^}^0em{lwDq&4c)&M(PzlXk~!qy=O6J#zGyjU>M^f=F8jd@JBQ{@v==;xqpxPybgI>A#f(7(7YF&3Hhzh6Ua zHZrZ0*@&{zdrhwBp&?*)7rkv2?c3ru54u zJtAtj67V*5t$*A04~%$TRKc_+UbxXT3Qipw8aUe}f+SH2_ zH;4XTP8|q)=H`^pjbaFwKU1>TAbT_*ie+KBxt;tUPS?68qB)a265|w*WFkI%{KBGd z!N08K|98hc*xmlQ-$FGqS|Wd30-E|-+lo-uqVF%aAqQIPpOhe?_k9$%N7sBBx%K;2 z0`K{?Ni~G)xglN)?syd|HhSy2t76OF*P!LsVoaiJSM4r8IPCTgGvqh(qj>jrReI#@LDT;lws?#W-zAy(K}mcxH*3(jAW>vJ%t_kXxzcuInP4!6?vqcr@N zDfzGH^S`A2zb@dvY}li?*QGFa?aQ`q2Fz2RFH2Hkx3=F((mVxXwd;<5g=SSaNRIR* zAqM=IS0gA$va)LWx&bpgLR*o){&(kW(6jscp%sPR9F>v&ovMm*c5xHHly`L|2Esqm zXP#^Qe+9{pq2~W;@4CX8>b7kF1yL{*fgnvmdJQ5PsZxS;Py|GZfYM7MO@a`LN)IB^ zrAku*7!fJb1Og}lLI(*of^?(_Qtys`JNLV<_k7=ZIC zFh@m1b#vP0ARf;?DKG_h1IAs<{Dv;L=COw4uespb2q?WFqvR zR*l^N_=B<4)zzaL9cT(l(2AZpsVyA~z;6^K43*GOHcctNCDiy-a=+O;5&~ZKR{Ce( z_3uI8ypZ(BCsT-;DPR9Q138YWBS8Runf`%a;N+}aukc#DseeNIJ|h!gtK*+ji%6i@wh$ z^k&SD5#}d!oY}s*%(Gc!wubAM4Uc~}B@=Ee^K8y+LoZW~iiQT;&d1BI(b-sn zm9so=7Tyv`RgSOZHLM+<&#;wG*EoycI#)VH85T&RBA1FwI9P0N1iAy)W_kVI;VrR> zIbSk8RXK8DoXEk>ZfXTQF@2YUUEg*{zU$#(pyTyuWVT+Y#phfpU3^36K$Dw%WG$P2 z?bn*lqQs%*X6=@W!8%|&^V{FtO$2BucLm#~gj3uvFpZJ4|0p-l&Xx+0%;3LiOz2x3 zNp&U|1rdlQ-=d4oC@BaOT+A{z6UjBXrXzk}osyN%E2_h)fnsN8&zI{WbZO^nmX}{l zNh(;g-?`9R`&K5aszBp)yM*0~`s(V3pCinLW<>M7l6pmZ71e)<&s@@1N!{%AFFc6e z>@=>igX(b2RJMD?TZ?AgNFxu0R4G4q<`@lPx&B=R$#X$4CClbnDF@Eum)vdHE$w*H z_PX2!v|wLD+KPtd(M4~}+`BkF4l6TiBx%|@GZmx#U79^TX(cRmzQ{W>7m7qr@bCe6 z%>m%`=KLkZDVehsMsK!$1k@3W+j3HjJ}qxGJM^o+G6l4_kH^BbrZ#1qVu`PBoq(&P zK6+ptoAT16iQ^<7-O^}>Y$U&Jp8DBDrf<_vtU}+& zc-^5yJB<({krUx#C)s9RCH0bj0(v1&b8fkcs0ioWaL&$5d2Frq%MGViGH4rh_#>!R zf`6{UUITi5z{e|Pi|FEG^roL!Bm`xnZ`N?m%3D-d_gB#FsCeNKjXxGU7<|`BjJdl_ z_uZkr1pA#gHe!VQ3BG3wiIJ$6)^S>I+P-h?=Gn8_s?a}XX5V9fs;lVwxJCB7t;`b` zyMrzyfLY38!R&Io)JIN0hvn@s>1~=m(M9h^&sv&3dyO!++%0t}v%7id6J#;Av7za! zH+z0@g%2Hl=2ijZCmH`VVc(|KT_&H-3?io_qK{84eBh*lwl3WLeFKjYjXi|(MZDC+R(Sa2>A-z7NFz1GLhnKzJ6s;lQ( zpVC6*#M)Y_Sl&U8@5jgOk))b5X0i3y(^u=LXzSS5Khwv=SD&G6pLuJmrcC9J20zuh z4}owu4G)XFxc3YmuEm@dB{cmj#r$P>bGE9#I+sb4xyvP^_BP@`Pb8)Q4v}z>^%mP? zIBkE=n?bh51HOk6SvvOgKI^@cYLOAj${L?v6k*Fuiv{h4R_>RNNF1=wb~==6cPz=V zZTqbUalls-R3R5BmW)oe19E?Iw$smBB}axu0iw8}-B-!|$|9sU^v0$)_|siERe6nV zXHUMfi;L$AUG)@Tm~o&QaiH?9(_6mSF#$-Pt6N?JpRd^!=2JkRqWaUYUNQ+dNOq-n zVViiMGMgZBIxg#489yL7O^HwXrwT5_Q;e`}q9mxl>OSCa(K}*wfkMqa)W1 zk8^PHWDOk$TY08wv-Q7dvygo#TTM;g3^&u&D4Q4Q(Uz=qlCR1P}aONaEX%lJNwX%u5ParGp~sjX=OL zvr+n1q#&ho7T{hKlm$c%hpv)hj~2O(82Ky}`8z)@^A79zJ`N4i;I{=7WY5nb@4l_1 zvr(QUmPM5O`fc;^S@`rWaIKcW(M4CbbC_Sc{S8* z0|P};;@5n9I6Y>Pa`>fL^~3Dv_>ywUb2wx36N}ujn(q3{U*5PH$J=0fL;2ei#Uu!x zb-Rkce-#$|=a6Joy2Fv=AU@BGG2u?b_FHo$x2~8_qOG}krU8T6^>jHQ5Hgtb(@n=1QIhsHJ zwU_}bcZA@MS=u!-R;^|pH18}Q_`QfL9+;Mz8Ny|`lmn3wBz=t2EH)~N)Q1Rq0!N1z>#B2y#GF|kjz9f|;3zhmf`@IL1t+0y{ zTO*Pt+IHv@><6)_$oX$;$Qhr@EyC^@GuFx^`ZKE^PKqPu+608w%i>t~D;ilfu(G?nKwFld{N! zJ~Vf268MNn|riK-TZSr!++8H6`)Y0ElZA38H#Jl#Czj;r_Aj^R-fI^0?*obhrQ zb4M=s(<8~)fL#BPT!_!gx8a&SRsYh!RZNx3!cJAtVADDj)My5*;6$r56l>mlhQq-9 zn5F9-tOd$1hSSg3?I^EAap>lJM0%kW%h0|ZoYd!iN3Uur&53gtYuR>ag*=!^ATKPg z#(c8zgY4|i)~VY(WCX?NQA^=G1tycEGkG`+M5#T{Sf^v8+p)o;9}0IANp~B^yzzMC zvNRXfBHpO+!YcJm-R!5))-E%?)qKd_Z|V4x?p5s99 zckF7LCp&@ns_fir&2szcybimKy)4cC;puN>y&6%Ztn@<*kw zic>j~Te0{cVm)FklTx^Cc&5j>*|b;JUz1+`(KsqD4TeeQi0mePqJ_sG*W@~8-SL_xIxbZ zsFG8HX+RGyOtP>dK&lvE%G9Sp?eW37dcfCUEQm<@E1+{))KX9?I?y*DEC@}4g1PDc z+xWi*`;TxEVRL3gU|=0oW;2wHc3}$w+36MlfsQ`riZ7@KuEk!$4A3p8ce_APnZXL5 zXlY8N7Y+_^=n2Q3cZ=jAdF%GWLyPwn75J_Ug;)9ccmjdoW-fj<*Bps2Yv|$BOkqQ# z?KS%c-r!crgHB`R(z`AdvJ1yZ^gm~kZRD*RQQo{Hj*cWLjBrxJ8BIDrAK%t@_dD!n z38_%WE^gr9wcNJk_3PJ55rtVnS8Hl&zFZ#0Fjk?EpUSLb8KvdhXmojFtpdPF-3s}2 zbxKP+i*AoCavD%_0PyS{PpE{q%aBz&U@s0;13Y#f)zPY$6ece|Tuy%2GcbDSsMS>QByB2qsKyeGM#odY%+^x8~Q{3H3p%hB{rG4+c-;b=U zbJikfGka$CBXgqFROB&GNm1Xtd4us@K}O@v8(7yjZ(zKU5utY&euE;QUoajT@_;wB zGvsH`3wRqTWvMrB8WPcdnIS;0QCt=DJ>I;*9Q^x%8Fi_!eDh|y=)H`TmXFEhE0Pbx zYT5~k&dufOV$+A4_WWxXYd>F`vT2ZuY7V5TlB4>Q;BaCYjWR#s*RH>|7sjVKailq-Jt76u6Y`-RPqt}vr<2HUok zS}fec!f%n=t-qSUa%4g*h7E`8>(SG`#A#WvCb76s4?n(dVp!I$bwTyg^o@qpFx?Bvxz3{PqV;^yr1_FbUm-){ zTX{-IHhRK@=BdCT*Z4w#NmR*BDqc9Ldi65)?Mw3ea3lAzGynf zKY{52_LCODSE5tr`KDg+8~U#`n`DjnGraw)HWReDF31nA|Dw?Gx(Dl=k*r7O(As+? zh&WSFDMe9(%ThR|5GY($(Kxi3USt8T&TEMnmVr^ssiXb7ImTowaz5yf|E;aSi7;( z{$@(9DEJ+M(RUU*?@v9eO={H`xDh%2jj;c%L#e$iIF@&^3|E2az`G{tz***h(j&%* zW>=wxVSi(voiLV~B$0M-rDR@datmbyf&9NeHB4rOH=@On=Pw9fzZyMwXONrSLYop- zl=L2zHUaVJMgUi+Yc*$M`snC^iv9pL;qO|=XCPw?un7j+3(>?{I#_`VRf9o+6LDC- z`lIMH8K1&vK7T@y88DN|WJq~$M&;fnMaz_?h+@~QGPxl&v^5Uhti(OT?5&w3;lD}T zq1jHoyT9Z#0iQidHpD5K>EkyNkw~t5!1*D1*TrORZ!?r&*a-2$IRhJFYGs8`U0oe| zZz1vN%@X*PIfHc-pZCZ; zBtXJCb>h(867EcoxYtx`Y_jY?@57J65fHoO;%#lm?!!wmJ3jcAgPCB}E(*h~%4~1$ zY+r@CxtSDv&w9wYmrzc6P2obe? zRDm}V?uvHwfy2;{>&mN{vC# za_Ay|bapD%sHE+6mfu*%)Y}rL>Cj=P(PidpXbiXnGS2ko(0pE`pAguy+^=r(24a7h zD0LHi_&ynRTvboXe|kd|GTjm=)wf(lkjhFFFg5@2h=&9nL>W1>OSn*VR7_p`SYp6Y zq{e1!yH!n~kx6nUt?P}|m1w~kRtV=Zv-@nMx93ANXWe4S89k)uR=HR z`{a6J{Ck;=>I~k-|I8B3WaB8hL=@$G1}c-bprT%W<$qc-``cBkXah^;*O52fU2qoYYi5}q@=j8gFDf%GhFHePaY)n0U6h#{>Q}mekBNq2P~9+ zyEIW+0zSEfo-HlKE2YAje41BDOm}L7!*o*>vJCFY&|n6$wFmHrJ}X)2fJB@v(g3D z#H1V@o%?J)6+xPia2ry4nAgCr79wEuA|KR-T~ceth=%s!;L(G@{UPi)0nwE_ff}~B zy{vM|;k%~1r12vKOQkWnm7*2Wq_@r=!hZJSVZWyj4OVK$xa7s?KLbg33nk9qxuGY< z(PB?h=OLSc%+V>F*oEA_p#u}@Z}lVAdujx}?zW!Y4M}6|TfSg_s-)LiutKjVB4owu ziPj5_?m_|1uv6#Pp^o+t;-h6;SId>qu#Nk8b3qeeQ$H!VB!a`9+@s0n)4HYk?D>?+ z^|p}+VuHRn!C-|zxC^LO+6-%dsgX+J^1<{Sv8*_SypTWlkd_d6#Flg9ykT2j`xYC1R3-P=gZr z(KA6B9f-ND>zf5_3LS05?*%t~w`+WOkF?A(VLo@$yx4Wj4LpJ|ze6a=g#%-vTi#^% zd|te4KN%%bw{6vM<|-2Q$q#7dB_=Dt8;HYb$pg=y$=Ys3v@Xiuo>$kI=@f$<%_30v z*watSXwukr{pDHH4_Sb5@r|DEQrVmgnnN|5UY-9C@&*nT(2l~|4VNx=VENmB^4 zkFP@UF0QrKd1_X9_dzhxT;Hl4o9D_vt6F=HvV@A|Rs578a^dgk=wTy8n-Ec!_s);d zB+-V+D~JQf)sio{pD1Raoe)PRXPPX;?%lx96bQ{&EYPj&t=9*uCjC7cnTxLY>^F;- zF#aE3k;ZFv`v^31GJOPMD~UYTOwB(hA+C7kR2X0CclG&Py#00Ep*ueqzFB0!4t!F$ zi>3PgZd+^%Jbp)mj`6U2L{uQR8b>-Djx~z;F19@A2XTJTnKpeU;XJ$Y!8*~0(LF(| zJx@cVg*5im9zwC#my8BNOLO7f5d~GUZJ&GM-2N+}>JGpaDN#oJHZh<9Y>NUC&3-9te9q z(x(dEWYMpF`6w$0%)_y2W9e%)PGF7lFrPpKhYOmh5mDEw5?$MPohq$MAF0!3mbmzY zfuqkWY3T94(9USb@D0_U{8zU#=({U zgd*Th17LSKT>D{fRcA#XSeqW0bmRKQu{L?1k;BoNM% zQPn>0QSMe_fuH3_dNqo`_2tHQQ}TCx7_(%28O(eA0pPfpJEBUcccjgPLW&A zQlpi0PlHOF2S>Ueto9Yb$-gmk#aAO_iXwbPqE0CPuqU*5OLJ%z9!(S7^|?@j*YSuF zvU-gAxM4vQ`2mM8K$c5eOMuX?O$%GH{E=hpcoagMV+MDiY9cK;W}k!g#k~j6k!5au zKBPaHn_T=m(il2OL00qh`bt&;&$tN<7jz@Tz3D}I@=Um^7MnHa4`&^OsGf+HSDv`P zbcX2zVnkeu(Jx~CPX0okmq+1qemBa+Qy#u!AwSxYa!N)%u$O@;1z9aV`6b-k;$2w% zz$SNc2t8hk7`cbjIoc@j2DeTriHZznie9I3gg(|H9T{7oT9~kY%@Pt_TnN=+L?u8( z+ovR($rYLz+QjzloRzL>k!1bQC(Ib<*VU!hp#xN9H{Ufv6PfkiwKQakoAF|c!!S2> z#m&~XFBOZNxfa*Ur5vJ#0ji?!#|v%;Z{uug_PPBnYiZ8wC5QJtTztYD*tbnK51@m| zKqKwGtJXG_O=qSJ)xKrL96gcz;XbDRaJ`pa3K~ zGLsrr4!l-gX^RbFL}va9mMaZkzm}sv9L}lxMHwWtFoEBJ`1=%8|6)0mm?n#}goroM zf{3SxEf z!%-PbfOuP`3&qt z4;v1#ha`k6B_`C~>uFS)wRWiOteF=yylHwro8W|PbTW4cezP&#*Sh*kDs`RP}PhMT%5H&uJzQv3*TAUH|nTVZB6X=~GVxra&Odj?N~V+p*QCLZoP` ze7LUDN6Qo2Gpz-|)v0aun;E12WO$AxIGf7{qu&$}9VTD{7mJ2JybCA|-bnOh3oeN? zk({luXFAH0w%A2PEXxeu*x(=YQ!ddVto_l-96;u{L~Wcc_h$^>Jfp?mBtFVGHn~#Y z@`o$a!2b{!0@#FbgBV0@UI)}R`t{mq23Sq(n#pzC zT0B@a$Y=QJKnvHM@2F+nMhTBV;c#vUp@=eFb%Q>T8ImP$Nlj2wQ8k z1E{Wwkyc{xccG4(^@6{PPjUBuE+z4Q`HW8$V1`LLYl!FiFZ8ZLFAYk4!^vi_DtlfB zcGIYs`Z{+aO}aouF_)wRdOS}WM(a=$&XLhkZhn4*$U&I$MU*c)i7hSsP>rA;D|g*7 zLV-RM+D~b@)hrPcN9o!LX)@@v@>lFy5tQ?cKYaK?{luDr}x=KF`sD=u+2r`q}?6Px2YVJt+F)g2^y1``+%hP%PIq8BT=3^Gk(&3j zzr9VAq3EDpXU}&=fUX1Qa51i!Wm&KdzGP0%D}9ddI_DpiCZCBvE)KTXXPX|1@t=++ z!dLP!VHmlwynniy;4@hr=d$Ie&WszhYeFe%ssP7_uf=lqGKbHdpPk_hkqrY%2|G2* zRZxE7$A`dEptPi?6Lvp-bvV7b866l1O;Vw~rbZL`Pulbu(Bm6(;`5 zg81FORjWw1eBjeoD6v=3GaR5g8^{>8Y)>#?lME-~-l*7rRau={%&X==*0P{Z0+n@y zL`$7;eNyF$;}`6xVooIic5ObL1abfSj5b;#c%wzzj8vKO3*u4XAciew7W2f~4IE4tD}x|y3ei7u+Y6&P*5A<3q%wZd$%c z0$`5+sSbPHU6;77^x_MyNWjeH7U>3-5RIbF-R3qD?GWpPPlYA6sD~Wko55;Y2)Jf6 zkJ#lrhlG|t1eR|ee8Em%6T@*xN>jK#KNzYHT`}xV9Pz*gQpF61*7tNE$i(Cz;|r*7 zEF;UhDO9(-j?T^hM#_Rf*oz1fYB%`zOyd8OJ!p&=cQt^0Su_hj0417$@?~kLlp(iQ zuP~){K_a|UdWv=!*VfiXB$B6s?WG*#a(EFRSInD~C=}LDeOReQgh2B%v4jCd5*MWP zW7wmE-;onWeyhAcnCj;*P^>1iVdPr_aB|i=bvzj(NN(ifo+MW`phZKjQVRevuqv(# zcdv}{FNy+i#L7%zl?+E%iUgVRW5$Qj!N^16yNW#fz0kW{>@TzbovMQ$PmHi#H!OA* zT%Y1ImvX@X_7H)`3` z05F7z>kF+HfU~;3JFNfl6iN5p2-)fRIc~9l+6B2+={2EhTc~kjFzY3MtjW89Q)DRQg{QoP1M?J_;%$#7CFTS<^9Hd+&2y-@BP zG9&{uwq$)8Zw;Dy*GcVSR?Dzkv7CI3)u_?Xp7Ok6yHs5v=sd%wn;ow1!u2ry@2Fy* zDor8Ij6#zSyG1m<<#hubERXq%7tBq+4~>W`W>ae;j`wm%a4TU*vqPogAzf|t%bUfDtOqL%(EIspA@m-I203pHDiUY&!Yj|FktcDfW3nXL@q~?3rT^yI$zVB|4 z=z!mUnzo3pJ)jn;vC!cba|Z*TEMov@HV?rd-cPsDjefy^Mq^Cnr@{-_$+n>tM%oJ< zHlFz#w9$2Lf%@?U0RhqqZC2(q){13&HYc=m1@eJ)tG#p8gp-kFWsFpR`IP zoYr{p@el`)=4zH&Gbw-4dwgX1wI4GH>K0!7_GxI4$WlN8g?CpPA4x3N-Ic||N%-~c zGh#u=>bfp-HOm(UY~x zw%Tl{-kl7sPzBq0dPI>wEO~fx)NWF+p>YPKwyu9#)@U=x*n%`O`|IDPG9)i- z{-M@Si>9zo?(Rmorf6sh;m?CNK6xozSl{K!!A9|^uQC|^HXvqwESog(dCoywPv4+# z={q^$5N?s|s=0t^+Wvi2CbeeGfMaW)Ge2Dxr?F;VnvyUu-t)lUP!K4WG8gK&aA78R zVb=V${<;~(PA3PW)=M;9CYG2iA8b+*GI%B3;C>YFA5Q7&CxCU{Xf+(W_S{hFQ;)@q z7EH9EC<<1!jYoTW%^+1m(|EQ5(OiAv*|-?^_RSYFSRKuRi`W!U+vx#zhBs7z-^wJu zlrprD_&Sq2qVR!8CC^UQdsI00=8AxE{(J7b&_|CG*H$O&E2pbW^0T4w1DD<5oiD-Z zD>Q55pebea29XHtStCDklS-{%Jw6Ukmssl&w@Z9c6yC&Wj*kia=PFEH4g2wH z0Jh68OFK#)Fe&aGt+lmvq26+zSzBLADV{8yZs`)fcp$}Fyof>&<2rBF(@T=1F}5srhSh*zP_}7isyp$J)Dt4p z=8p|@9fzz}geXGfM1DMuJpJo!_c|SbzEWK7Lrrc=Jax-8Uk(!K5U28W9$)?SjjcyK z*IaKZ(hD7CeDL)VBA(u`hFzCK_DCClypv0vCeimYwS>(UzHlIix>7RBM zkE75Z+p-a(P~f^Mmv?8V>e#A;3MoK;(+{ns!fri4$bQCb=+kJ$gHtvnnA;GCcLsJ} zl*8mNBp4JPGosyPE<3@;a}7&?-L#UVwA;NKhZT3@izi~li(=%t^)n(SqZ&Ot{Jfi+ zmix5u32|36Po@8cEFQ1;6n%iLH;<<|aL(YQR=zKp49$H>De#uLoA6|0-W1k3W-FGH zlkxVGP;`dwc5hE}Y9IGU)NOR4gMUwcGMa}Kti;+&5(|^k#eh8H_6CT@fAMFCU>eOV zd~exsTo0(!Kmo+lzJ(s!?z`=MjS1767O!<3Tj(Ha0xS*0n@-ef6;IOvNH_mz1B=;jF-alKi`{@qp{*8W8zT#p4UaWTe(ae_G%R#waB=TQdu z6b)Y>7JhSgw=hZN=V$_jw31RR^*M7YVRTX05^7sUFkL?sNQI}%;g>wU ztT=3{&tX%mPMtF(k7~NmWhcPKLc+Oix*$Or*mFl~A{unuBD$rSIY)sX2-W-$LzQhl z=^iE;^$(IodL*O4*4okUYuqt^8)x?KM>fgF*jGA%6{1I_A+~~LBgHj0To4jE7btCT zT>>k}aVw8AUlNw4^x2Vm)tLm=7;Zt~)gezW1 zk5~^41^s*=!|2iybGo%neLFMQQXc~XfN9VOE44}&U>X=oCFa#c%PhzWH>i`&x)A&i z7I(D+`sN+Aq=pz;Ga61?lcMJ|#>$b=-xn=M*9c36#0{x<Dc-;U+}$A>^3;9v)X#S^ml_(}RU1Y_Prnav{( z8IU1wkatJV#7qVXY&7G^x*n&Hf+MiZ`cHE@~P_~xT6H4oq$tZ z!TA52y|il7c2C*}N0tb5S<5wU`;dcVVxb#`-;Tz&N9onhw5cx0O8-K4Edv!P`F^vL z#`o{V4(>+}o?DHiH(z6De2%d0=;=~(Av%D)UMXsA0Gn7~s!lazM1Mn!OGX{ar&Vlm z!jUg(i5aGiIhp{kp-gibk!5sX7S-M;cEreqi9Y#!;q^uA|YrF5Xo@y9Pv>ey6XdI#?sXFpeP8 z)zFBOho+4}@=LBVpn*2j$VQSjMV2umOp0#w`x4*g1q_Y30&TJ!M~d|%@e(dSkd#$1 zExTUgA1y?RR)RNz`mk^CTxV5AZo_JY0+*>qRsHs#+`P$qVu%&9h@rZ_qd?a#BRy_( z-xX-^<_B8X&(+mcgdp2ym5*H);!*!r#AP^2j_0a8#-G2bO9*hn$*QL+j+O$lbC{di zp)3~Lu|=J5^L|aVs)XM!wE`-0nt^;N5le9I4`_kt%KdvLgM^9R6Mx$(+z0}U{K1BM zCGoE!VoFNPgWe_@|8m~Ax;F6bvWHo2ikuo}8FoTAf=v$`92}q-!F^2$)1QfvG5i7Q z717|rb*xd}H5p=4@crE!8hv}@gPqMv(qb@%5H9~z7uqeinLIwOI&llBf{ym-jkC13 z3sIZ^85^mvqY9af$KvTF$;f3l^5iEw1zmKmGpEba!RTpr@$`RIEK)2qT=^(MRCulu zmv;v@3BGq7yyE`9J`+*ByB=&P#a5f{cjVdoezq9e($% zN_~HAg|fRYuR{Iui?eKOGOrcwA#z?n|E`zR3SCy)CHt{7RJ{)#15~#(Ih^$wpWsoC z8nGE?F0krf#85x<#rlYa`PT-!cMREJdHijTeQwdgte@=~0r)$o-*;6%c3GJ6YP$K*Rf7iVAHMnoshrjUj5a z3FwA@8*ZdWx%)VAyQNryD}4llCh=f4HKV6goLv~PRhgSCye=)hZR2_k_E;W3K3T2g z&iQaifE*KTo@mTDQorg2rCqTDxqO;_h?jkp0}r1JBXy0xO7Ps)(P&*(ehWmFlcU@G z8`({Z(*gUdtr1CV$b^%l$-2ADS*a0WC6JJ;+ac*+m2P}ef+z35E-HL%aU{r6UK(31o|=i&BuGu)z9${=cWK77escly zv@3_Di=s~uQ~fH_4R^NK6Ka!mZX73q1qNJ_WoXLUj@0l@)G&iNT>XTz2`LzGP|611)($Uq9bDw?}lu zm(ID7Rst4+P8EvL*t%{QT`trwfe0sts(VICXo!9<+`^)XDK5RCf(1c1aPPKG3o`rq z*5FN^2N#8Qwqowi-Zztr51j{L$j^d`Uj0QyI#u@l{g`|=W_FjQBVEte-lMm+75?$( z#H13PJjX7YK-g5a@UXDxdhm?wiC8wyA0FNPi^@(QP~kxy)6Y)Mo}-5XEzSRnF=X?~ z8M>Q3VyN?%^g7F=dee*wr947g7hGpLG#TS&ZTf{tlV%O;4J;{uGBr9~7CHjge(R+{ zyOutuCIDNqSweL4QI@{X%I4guS0*mI8ORxSzk|jT}I)R};%duPP|AhH@F7$U<~XQB)q*VBHQKwDn5-{4SCbfkiehdTy} z_876%2MDZ-d!>TT33C6WH@dE|BadjTnZAtB!uW^CV?6m=i$X8uj|Hl_?v5swmggWOhW zud7kinB>8>#<&uAI?o&$eW;@Oo^hWCXo`KLfkS|*HcR=~Vy}&jf$>;4Yv~T4_QRzf zXm5*0#KQvWE!o@Fcg6y_ESrS2*26mcWpvZ7axBb4LpLK=*fTS8Lno=s&Ir{Ml6Lx;WT+R@ukapCL9@G&eyuahK}VhIGXScKvXOCR;TK(@D;$O2?uNl~)4qKl#V_ZGmhvmy&v-8yXxZHG`hFO*lfE8;Bui1Eu{ zgUVnqieQ#ebQ6#oDNAxf?iG;H0@6lX{)U_W85rdUd-*j3$9hLLXjOPBD$P-X^*bt# zTqG0sJMM_yd42dyW{+%)df_duiga#1vG|Vn-{jlg+;<|ejKg}0F!t#(B(dsvi!)$9 z2;-#waX>kkP?~5tEQb&i5ihd`JhS4~R)f`XyaBL(g#W@=1VLtrqHb zR{KGuS6lDY#_4T^w-S87ZRgNRn7NvQ9zSNy8qq>xA;cv8j3Vf(rRSbh-}IP_wA; z!&kyf5qdqY7VUw4OnmCie*AReja{1Uxt;)}ACXEVRRAGNpz>;n(n64Rej zl1q-B34G5L1K&Fa$k0oLpqyCtf$wb+4;39Dtu~>^bo~MdW0{CHodG zxU?Y*6k%LlKC-kpc*4@;9Jhw&4HyxnvjY1n4>+fXAa8bwdmLu~=FG<&`!a38Z$9MdM%yTUw-MF{Vf zsxhodQX-@=T<#wXPnx!rUpfgfx5ClLf<+9YoQ%D%Uz@HMHP$1nGj#?LGN!<=YM>nJ z=lwKCIjg{8#YGWKK;&pbu|7v!Jx!h=P_r;s@2cvHv!!%zK`B*4DKbR{#lo?G(arB* z(H*zitVh}KKpghbixq_n^YHj2>FJ;AiTOeg9D0^v5+&l|H886$$uscnTPbAv+7NSO zv3lm|J-;|$F#5dG3eAsqJEO=_Bk&|7jgC3F8~I_tB0@UlAr&H zo*o!ks1pTTe@_*v2`#DdGNn2nI%UKYXh9dawm60&Ep|O$n zDY(f1LQFt>{WKZC|b&n-0cogt@eaGdz(4E?sTg7 zm#VeXb#Td%bXlzMV`QzZie^}pN)9q6w4aGL>hDXgUC-T#I=`;Foq3>K;O7>+mNe%L z41^Or8|CC+I5sMBEd4JS8R=7}N6e6jZ~;Z!CKlZ8fB6l;q4EnveJ#;+-GDGRMq;9H z#57BWI{EnMVe9hp@(%dQ%SR@u6tyZ;sOv#yW>kvMW$g;T-=EA%S1+S-YuSlm3BM5s zU1qAC?C%#-e^nTIczi^K+78T#G6$EJHPo=)ZKpjsP=~H0QV<2zS1m6X=FpKUxTllE>br$3=eQr<0NP~gj7b!BQ~ELJ!`Za#l}pCZ=+_i% zlcP#p4Lm$NGIMkBCz4N#8^_3kp&nxZEMJ)Nx$rH##xlyIW;S@ zoAb%V8=O=;#I3v)fs5ulzy9pryhV;BZ`XA}Q^NPPEWj?8T;D^2MTs4>grPKS9Ijv3RPgd4i1bJ$d%Yv-4Ld zY9vzL9siB6xz!jHIIo+!#Qt%p+>J=6t@;f~egH!9k_x~45XHzMeN>n3O&53GtG^!) zHDrhsKHr_DQWlW8?So}wcST*ieHM(y;7S1zX=zrO?1U8rs1;g>Pp~xM0S>^VPWS>d zfk-^WR~8*FM6GiSd>-yhWjUc5M!h(>HDi_2Wga%pD6^%UUH9yUs#Sn6=U^283riSL zz}Ac_TVI%Bi3Q`A2^G*6jn!c^#t0S*&-XtD?u=E7?TU|de^KsZt5@6I-6c}jIPI`9iV{TQ*KStvr7ae>iKo?D{l zO@}+?{a_FADOKNLJG}WkuFi2pA^%!^r&vhJ$qc~RGt|5JKRE3N-D8KCHex(Z0B{MJ zy#zpdWNh*q)CwK_70VhRJ3+cLx?z*Kcxy|CKp#tlU?fZsq5=u^U4Ap0jpq)ARZ&I8 z%s~+7LUFhtWKJW^gy_^v9CGRBGV7irKdlt0JAmIj;s;2&cn|D14iM>u1u4V*oPd`j z{H!+aS;IlZCMRqed!JOTRj&t!{4DKipwmz#&}YprS@wx8RpBO=;J;lDn?ZnC#kUps zfFHZUO#etspCDv813&aA^f>|fS5XBvgeJLLC;_rw+TpiuRL+x;A*ui^=8dmwk{o%V zg1C{a+MyDH>3cuAOdsLZYn)f5dcUB8#j3m5h7cLXY>0nevFcVcTP`|& zRM-0#(Lv!gsG$Uyd)C9hAHkk6bU$@XpR<^eB7_usL&BTRg}&F;@3PKZJQzonNy6Iv zI1DSZb*L4Tox5V*3o1a}hmHn(kf-a5v7 z3_Ef?LuTj;qtFqo^Td1ov-B$)saJo6c^Y*q0F0 z|FdrUOW9q4^;0}Bg55fOw0N$X4*K660H+$@`I3ZwN=1t;J1MA!hpiq$ey72Q;C`v3 zPB=!wNg{m9P}01zq7#>xh=xOODuh(Ykbu@61`BTXjl`j9Wkx3g@Ax`&9~}G(!@WSe z5F$tKJ4BU>1k(Y0`8LMT8*k#@QKaeh`OSFbAQ-Ei*+)*3q3=C- zrf5+6or{AypRc_z~sRshnG!7b98=@hm2M zE2CNuKe|v|iR+zUBEnr2^=0SR&GtBuOB`#wu02fy|y!YeWlIDHnr#f!W}omZtCny zs>yqwnN1AdK87F8Klyh~$hm`|;|?LR)*r9{H8!-gv#F>Ugr^lG3NG!Tu~tcFoG5e>$jYAA$u+_liUqRX+JZgE|iC`jpCyY}FC2 z#u@rKnac+ur}_h%6uTvR7bix$QXMI;)eg;A{1$X$4BUbjyCy`@-`Wx*$B3jiF+N*> zO_%;;x^k|i_0Y#&DaJm+`G7`>18F$htDE5*CIhbd#n9{CK=kkErXWxFD~fkM4{5q{ z^KO_uKvS>B1iE~nBvTfVLG*{9BjkuqQ7%62@PzsIxgzewdF-QlCY%v3NL*ZE{o!Ak zJAET|QDpW6tGRgALNtxxgh1T{2PIoVqFmv%9+zu_0h#&4{pvdMh8Ns%s_}cLIr8%h zE747(iRR{J2&LY)TYpuhNDqGKL7`07uQOAoroi;WYhQ`>gnEW&YZhwH1jY<;RSq*D zIr&(xP+v9~!lh;Tco@VbP3Yo8$z+XffmU%b<+JA43pHv=3?{hx$<1kn!xg=xU72vv zpEDJ#VY5&M6!=2D+OQ%BDE5Bjsqo%hr)P)nSW!ma7gJ2GcC))~uT;4L+z6 zsU*w*s<5T&_)VSd$+x6m_0sF=J@n1IY%>+I!upS;7&1nxG@_$_+9_n5P^Z7=8eL&R z@|$<-q==1W<;q^Fi6cCC9Xz!ajw~IPWsA;O@8GESP?xS-E!1PV^8c12sfp+0RIIa; z?@t}4xj``*r(Uh2=3?|q#eJNs#sSEtTji*$lm2M)a#g0oZZ>TtPmRC+zUcZu`A~zT zMtD=f>K;HE-?U-r<>>6}+$Pz0-a0zHy#7N2=dy9}KYSSBstl81rlTmM9>t4;XJdZc z_)D}Onzuzhuvl&A`~BAlY(5%l@E%czoFH|^%9b(52>(EYZ&nCEd!+9y42HF)+9hDi z_b^#L#G3b-nMU&iM96()w`S(P@Q9F4(cB2lEF_*H>^dX#NnFY0+y;AI1`XZJp&L}P z9jRa+Gjs~LMKuNVD4$epRt92HGASfHf9qIER;5_3btg54BRvCs(|uP2P#cm+Jh^W* z#*ri9S8a+2n=%@kpNc(%h_Qr?!z5GF90R6vlBG%g?e=|7eL{?kGYhI}oXdpagzC)N8$hfz8Ub78g z1e>zG^*kbM)W^SP0AcFG!MeELPgl|>}+G}GaTP9IEuNHx8}Z#tv4VBlx* zOY0j;ua0AGIcVO3QPt}zH=h$lksGN z&YR9sqWsITz4PMqqAwwp9DSRxdYSXz)z&m2R!8@tOA`0IJhUP(4Q zCFtmmLWwY_F0r3Ht~h-bm0NXmWQ0pXf-`)+7#Y1>wP0kD^Gh7B%?vW2mPDueZ7_)H zfSQEJ^@csofMCb(Soi7X&tbuSkk8Jagg<+)e?I+PNBdUj<4)l1hkc1Z89^8i60d*W zP(25kU8Mb?^vNS(cM0#AxCH-6hy3x74DvjA>t^F2)u(=8NJAnY6`fuewe=MAXn6Ob z%=k&y0`nKAv`%xT|Jqb34l;cBtsZ_rh{1Nna(pqDn$c2eDFcmdj}{B`jjfIwryba~ z78FMTW|c)1*b_N*YuM}R#8>2??=HV-exD}(k^ePc@LP4W-R)rHN~c-krQnwH_p3zM zH>%&9YtQ$8kXrL!=yqkTo4eH?@!9|26n=F2w=}4L!iXc!g*$B4LMD;lwwr;b^9yL% zUq=YZY-yS?{QoOf8ip9*&W{1*H}_Iq#V zH`RX&CTx~??)wuG^kDM`_dMvEOZ`KCPy|HxH_WXFo>AQV8p!ZY-)fT z=a1=U5h}8}xC_R*^Tcen;h&V@?fMPaf)#C0$|8snra_g?Ls4)SV@3Xg=H*hSHDQI1 zraKc1A-a!Z)Tp?0kMiR!By8uDc!v8m|K+*vR{qb=FB{I_gOR@p-Io7)_9yDkk1wxG zYQJ><;6F75g+pwz)}G;b4YrX>2-}(LUcbQb)j3MgU%S?34oOaW(k75A8?0F!O4nos zm9Ifbe!V5kDoXZ#u2Ngg9)l~}vp(ygJ{vig8%RlpZq=7&bgCTft6v+G4;q zJ%ch&LP&VbEh-#!H~yY&X4cf#6A>2-U(HB%zRc21h?h>pkffMSvr0yjTwMq~Lb&;m z?>@m_m`O|#GI?seJ03;iX3vh8F$c?81Wy-6DppG~wtYZ5h%fzGad5U+x6k?IS?bqt zn|R2VUo+*kgW>^c&0*FBBOd~OaJ15Q`TkyBbcrwyG-(@q_`Pj&o3T@V?^}N2!7Gj> zI^r!cnSPmDmmQ=Qw^csyU~kft<95})RrScU^MWt_XIXXdIixH2CJ5Q~g;SE~Z(JR0 zR=$-xzTUi%pZ(V{s@PqX9Y!R37Q+n}9|>F==mWO}zy;_m+->RMEJ;#v=CRlH`jZxR zb}$D(dSzv0K)L?N<^=8WFs<$9*rcjdY;GxmtpG}2#wsmR{$u$_E&-7^a2kO^se46Q zHFL)Ot>2WMP8IjID8leJ9zuL~;0%XklTaeTI_k3=BDWZKj4-IX_c!H~%B*COj)h8V z44??P+z4s?7pfL6H=$PbDIP?!kt;f+*SV(tfUSD%j$UKRJF%p$1kYoE02r-j-1Dji zff`D-N#kYS;_K5P23Wj5*+TEQU_)isp0(NB;++hxYZiNv#zXHaOb4E8XWhn6zUF~2 zy1KW$ojp}VPh`_gPdYp(i55U)M@>hiUfpOT33O2XW4+CRX7u{!u(M}xDc!!DD z%wvc1ho;z#uDDWTjafg(uGy1;p8^?er@|h7-czG&9ViDvo(#pJ=;J)LGjOcp>^mQY`cL$3?!oA^EE~L-4D3uycOx|R5 z8w@gHuASWqqyD$>-N@l#WAx^?KATC^53a&B_4??pHGVj;5qqwk*vL=y)@}XH&}vbZ zfpgH)c4!dmhhM8fzBYZs(M7@-k7!+upvd?;*90r~!l6Dhu3pax>OTWq+#2rdXpX(i ztW8N{J?`s$;VxkSA!n~#TzjYYNZ8gFfscb|bw5p)&h||1sdt$Qf>hw)0yC!`FWiy+ z>FgZ&xM=hH&l>KTwQ4zmx^D|cM{0HE!rl`I%nJJe1|44~W;J>h1%FJ3ykf@mT*9Ar z6B|mFYHgbY)g@Qddo>d%xQtc?bfuyp@SWd$drjen>C|0c=uW9eB8m{+^wm-%Xg78s z0-O>okfgG1770drG(k}TLl(H0I|}d~h@^=;iU;tv&y5zEa8c1K zgi6va*y{D)*@k?z9{;J^0Mc-!yyUQa6?~e? z5vRH_gedB4VY5k+23b8WYoNgAVT9ledLGx6Qi6E_dW9zBtXff$vQV8jJw>(QUCWTjYvqJl7u&{hn5T{N}$D z7gU@_7ZYIJ#N=nYrpD{yep+#wJ5@%OrHu-QP2w1**0$9rK|`0L(9z%S9QB^Qxz(Z9 z)f+wA`y#pXi%1Ppj>F|=#!ZZ)_<7gTJV=EvOuGY7B^Hi@v00i%VrBEf)zH{=?X44r zb2%Pm5O&%#26>wvmg(XhjAN$+og?C_LuS?`*r+sY@ydoX07XVx9Mm)3--adLM!+)7 zvU0Ft!MCIQ?aS*s^FJ3sLlON0LxH3oi<3$98FZXoE>qULes8%OcRYwWa;S8wF)<^v zwj^-c*U-{c{vT6U6&1%8Y=gVIySqCC*I*&I6Wrb19YV0+79hC0yK8V8Ji#Hr;IDJ< zUGKdQK87`G_4Mh}b#_(lz02`E`{1ig_)@_~Hp#jlSi4V*+`6EHD8tXko<0M!T?n0b ziSKUYsbf&^ku6qM?++~5)DJ(QaAR^*p87WNFXii~y&pKY%1x~tKsF}5U<4j} z_6QY%FW@BJXv@#y*}8xFe#et%nL;KawA|jhAK&^=JW9B7Lg~0-O1k>ryWBgY#+=as z1u)Gws@nvMj&8WGnf$NMj@_YeFXuf$Dbe9^Y;gzC&T;p7GL~=DnyaB7YOp|dwsg2@ zY2p0Uid^b(%F`yDHzt}#p06(_@sk>t7{V)o2@ks$18a`(xk=L6Q8dS~m_PcfYu=-DNcl9?}S>m!M9K?Zl z(r%p(w2zS^&b!a>$|PbD1-TT&HfMb&vUvmW9ZPlnRRuf54t&$@x9oMcc+FE4xX7L! zW~P47XZErj8?K15iP^!6*qGM>fPmy62Deq6GvViZWU>^ms{&~>(UrQ0w?8phT*K(R zF$7+nh7|LV(k9vl1~_5FEI5cTcDz|TbP4^o2M!C7dB>bBF!d!?U@yN6VM=Hpk9*DcJ)G!ia?JEOJez)3_k*D5-i~O#xBGY6#UA8 zkIn0~sSMQYGf;HzeBBDQJA?B&NC&^~g(~%K(%2m$!VLC{Li?X+fBI37GG@$iVq($b z-LQ#@^t5iwo{7Px5q5n+`>-tpg9-G#~k5D9p@nffz5;5ury4ljX(X>H>YoV9grL*Vip|7N<>rcD)uDecI&U zcmpG*bzTDQ(*p&VsUH}i!6_1-KF|ikUy5p+COhGP;vIgsjogmxF!bwZ`l!JBZ%Ax2 z531vqD`+3-r1Z!wyRgH9iNRmYjOt%s14dWKh`-USE-ZwOjmc9mLUqBUY`2CkVFHvS z-wA1md#zd@eW7wKvk?QtDum5NxQ+pfmLMiAEZ~2UqK+jRQmlawt*x=k`w@U3TMh5` z?N9%PZY1&Eml~yB>v$oCWwe~V@F&X~gI0%hNyu|_ET_d(9~9o-IM@>x-IxA!KuH{z zbSY}Un+>qUD0^zmh>|=&*`uQ5d-WQQ@4=`7Z6ga@dRDP^@}6L|tN7cpif5pppqLmN zzjJBRM|a!X+Y3o{qEhob-w+UQRr?x|kbqjSp1Kv}iBzn&S*_ArCw6yA!N@GY_th4m zmC`r)@~N|bKi2PR4NbtN4hiP@5+ogk44a zIu*)lz4B=L7F5x&txt`O?PG#jeyaTYCj+j_X+T@OyF-y07VY$0F$2hVeeFGO4tBuJ zpN?WndFJHRHf7@J96(N#@Z6*Gj6wXV<0^YH*s>V4v-@|53rm=`o23LK(~(PCnDN~o zNy=nN#g0u>ph?IK7^I-v#EyggxKrl*$p>tJIID2LS*eVtAxQOPb|~KEeA2SWL-(l@ zt1LW(R;_a#*kYXyg6tv6RECc)1K{f}&pocZ7iLoLM;w0tx*QQ!^>LXwpM5m&n!i!+ zrcoSefwD{pS<0Es;br^p+;cjif#Jxl}A-#_!w}yhtY+ zbFuY?-gu(5^yc8g1EIxGJnMe_$#0M89x?CeL9!HmW@Ep)yaK+}rztEm7}f8{_8!!b z_ry%gHUR^yw zbUi-!h$&B)&YmAzm3rqCL#N7yD%hS$6W>7a^GdCYh|bwwXZPTzng9aNz}Fk_)P-S? zy9nji?az?1f#?~ zqB^H3xB5`ptx=%Rwy%9Zc5c1l?*`3=JV`aOg~?W$F;mwf?~xOtreWg_s=B&{gB4i& zFygwhVs$usx`Y{1!a07x_$v+RtIn#IU^u4UxkXC!h(2xT@9D~)f>>gIczcL29ZO7; zU&J>%zb6&BmUFDHNgjVBBaHr_@XPF=GHv_#*W{Q#N}Wkz?KLG=d+%T)p> zy!x`MYuA~b!A#uj3!9;qZm_lA?_9@T%vOGgVtu*%y?sUSr0g5&8%XSxBUfOpEv4ZD z4c4HU*emDj>f7_o)#Ax!NKggr6nIYSd^j=S7Q6lFadv$js(j6D!E(rzzlBf>p1*$3 zT&D2c=AhdAgPLbkXXs~u^!A=IlPi*ZV^voEgi1$PQMp3W6~nlQkXXjt7r2npsFw0$h|86|r;U zwR8KpT6gAD=L$$+#;Nf`Y?V!Z_xMl6yB`TYpHybgAjNJ%wy*{1v&Ql?JJJ&et()SA zVl_<im+0~7+I-B+VG z!i$5B7Y7I}Yj(BV=v~=+e@HR^(@*>1b$_zF4wttFN_)VPQuTaubQ|W7)rLyDnQ+~) zzALwAhbd5X zuI4U0R`R)Y)R?tECX@~i9tf@}4M~be`J9|}MYE>XZpah$(sFq5{az#`Ua)kDIlW+2 zJPX{kTK2ZE%qxn<=DbiVY1D(?jI@VGwd}kxt8*0DqU*uaxz16vIwG-5^w`%Bct2SUDu6vmE@BzjY&|C`NWBsWnrXR2gybNsmXOQw;FU72DLKT?F9rCW69oIEIHN z@K28i=E2n8X(OHL&zNCL@m2&BIXHXZ=bqtpmFxM=w&deb5|Q>uN;qK_6}YfU`Myh= z^~fVbtTT2y-^*StM7{-0R>O)nm=fl_?#Mb7`g+j8@W1vKwcayrOP>5H0zc!O_a({E z6g$?#JyoE+;om>+h*Q_g69=4@f-fUQBZ@57!{zYi_P6%Dwop8fTGwQ7DY6JXUpAjE zEk?jFfi?y;VzG(-e;TxJi#^mGAn~9#?wA)p_a>0}y^ubGuO$0<>-d*q(EN{6j2jS75?7;jUp^%-Rwr4L+nXJes0+rR_uApbC!=vQj}z}?dpm7qgx93tV~o89C)s;az?to1MJ=uhYLpsi|C76 z%nHsO!l_IeI!@1QfLLY48IC6yaiwt~jN4^h8F3SZ!^RjbA&3y#_b%lpLdzIz*EDpM z0!ripWR)gbxfDc|25P80T*X|dOC5Z?dIAmY1~IP4lCY>Yk1jp6DKo2L{t}^avyRCX zG`eT?K;p@(j4sM(#}Q`OSzyP&NcrLZm0hqbyss|~$|D&$V;8U1>^r*e>kTXW=1*Fr7K~F4 zsku(*J6g8ltifLUcm`WB+wMiRqSzb0Df9doX*5D7djBcPeL82+eo@gMJPIco-3&_2 z!QR=JP}x;9dW6k=8*l~pcNz7^eO^ZrMQANj5e`axd6~gbpy3!JO%ns(d0urn211d& zcA)JXB?==s+C2s9R(v%!+fG%g{=EJ2b07w%!J2kuJ98pB7V`Y2%<*t%iFr3P@QI=k zIm$!fU8t<#;E33>HM2l-j^NVc9*<N5nrnujuGmu_4b1I1*i|rroh3-e>D^k>7R{S=}mP7E(y4KY!TR@B})x;>BFnEsdeArdiC%m(DIqWF!nI{1JasjF^dKMOa zu2TVN%rO5JGAPUZ9QLyLRot<;K(%Z9L$jJJZOl{NMiU&$)`k^HYN-|Vf z0%_V1xk@lY6S?YbN|1(mWNrEc0M(f?ncb!28+!#~u0jKxt$fCf zTCBMy?ZBNPc|Ym+suF35M6N#`#%Dwt3VrN&*CKcVZ`#f>B(BV9L^M21!eC=ntA_~= z2<3)IhFys|eZ2mUsV)Sd26I<|=0I$W_O$Y|NGkz?2yv#!`CTcSQr`rNkvZl8Mj^uz zb)3%mg|K)H${06Rw#sGOQ!b9HU8G30b%Mxy<+ijS*JEn%+_G5W%;x=lMv8%-G2a{u z+FsGc8#|V8tPn%*FFdjlf1_8{1mXakysjtGxY%2XN7|0pNU|pZ(VO@@ifjgeKVN@A z9-ZWfamEw&9s&haibAUA>?U8;V9a zM&VtlqAl=U?KuzAEec(*j-2~!y1n_jd*=di#G!DR+~ZG{a6e_}b$r+T04aJm*O8BQ zpvGD{>vD=C{PG+NIBy|OCb-{8_ZT^^Xk(C3VYc~mR>LTSoSpIMoW zGZTA5ljZv`?uuh>PDQdogDO03Xj)hPs!0PrNc#rV9${|qq1WF0@^oN(9oK2>tghl} zN6VV0eD!6N5@L4H9#>;C#50m@=Nr-mBaxKvC@np!jFwl%D-c@s zIm0A-0@2A{jz_MBS0S)HB82pnXTJ}5W(4`Zer98AqYii)sM!h4dxm_Z#bsYz4(SlP zHF@5_OO*W1gV2TeO9N8=u4URnV=wq(D-zBBdcsLMbJjfY@^gc~*J1gH^KtwDKAt?t zGLY%Gqz`mWJ_OyeS&KL~FI;(Q*ut*HB-LqrU(jcV^ZZqCQ*^PleUJD(kVY(yrFs6;E`9v9RnBi(ip33w z7(U$|edPIojvIy=>y8%B<#plL^FKr;z!|o=xJuUf2>XzzJ#0EP_LbW?cMtxv*o>1Nh<+=LbkV8ozA=86{nqB?=2kxw*caS zn!pF7&VYS%QvYlD>~lhy1Hmo0Yc#P?p!7GR1>XvE`;dTAfJ(mlPVN zS6I+s>iLJqRri;Lo@aRO1b5C2H{xqIN9NYQ9DP|0VcE|HuJeKj-h zb~qK`>v!ipZ|Pol52aVv1yu{kEru-VgVQ zyQyYXqlP2Y*qBZvB1*kyN~UEvU-%#Usr~}k{$lX>l}*;^5YUKm!A5Ak*z!a(6cvhU zoQb&zykhNq3nd#`?tbO*JFiyRVFPl|OUuAlJn+v8!}eLq)#9h)1#oQ7D|_P>cQfzr z3=;m(f@lHybc@SgsGi{)6|soOfE)H)Gd9#x<>vbI=H;v3AiT@p1ItIShnZDe_J7tBWzH{x%%3Qwve)a|Tq`i>)8F+f$@ ziyrqkUBCm+a|1wj(DpxBDZ_OJj{#hQXSBeO0hX5}W;O&-gabmVA5Dy!L$3H)x)OC6 zeMCLLX?Be*0K?BVRWtvlGof1s~=4!i*^AN<6LZdHq@L>EBZkjqL6Y z5Pmoz+q;icDSDaGS{-H$!_tX6tdrc6wgUfx`H1j$S*8-{!@s_KhFXcyuQl7Fx0e7JnAf-2I z50vdrL3c4;`?vI2M7mm?5vP+A@a48YI$IupV&<5r-^;nm?sAVW4g&?G6p9F4!tQ9D z8Nc`LhtB886!0n=*=Nd(=!g{AO8`5-Th26s&{V{tEi>HFkawrjb4S=#+gd!c`$A72 zUqOH|f@i#ACvMvlnfN~0+eKNqn-GIiZ;2$hFI_Z-Ozcn0rKzblX&;^F9|+;QevC=w z#9h4YZZxB(zR=4dd2&0`;w*!rBQ%h(Z!eie$bE3$OLp|Pg<}VAEV0*z7k-aN;)FWe zJNk}TB$t09ZRpMpIOX?viA>+LV0+v@TxuSDZMKSdv!*BFnO$Ucl#CqLIEmH}7`aFg097z$=krQQKWUgj_(K3AEf3bn(0^ z5B-r^qM3bhJ2>4?EG7Z4Wjsbx0gZ^g5}@V?N7lV+KL05d>ziA!=YQNFyWHpM8Ax_L zaz4fJNPPZH(dd~w(tyU5{PLuQK7Pt(b$aS}_N!SL|AVH99?xdD*b~~DrWb*(VKN}N zBD{&6h@zd3@~W(S6@}hiH&b}A!0G-ombja&HG^1f1=v^)D#mK->%TWz$ME~}5|~iK z#lf_YvBOTp&czYk*5(~|*R+?b5{SLs`Gx?}b*%GsNcL_aZowba)P{^lC8ley_aLNS6AQ^Z|O` zX$vA9p1J$d#8(_0QCHD(=YfCpOu$~M+~i^qy&GW zk@ovHU{n2Dy<8*2%vg~0r_dB>Z)2V|GwxD3sUR9=ET6=nGsOLt1nbA{iLePHzo(Dd ziO_0OmY3s>0TK6a2TzwJHGVMnn@=!)yD53Sj=BC&;(1szV%M(EyU~*U%u+t@L~pb5 z_HKZh_IcOEgx9YrO=_2QG@2Ue=`>-Zl1kmGeXXSAEk=7($a zyqkVG$wY@P?}%pRxQM8oOEi?(V6XbyJ_=SO!@LJ8Ya(&>8;p7;G^^t~+y(^oyCi*6 zv`+-S47!*#y*3;sZdT}s&D-59PVwx#n|ULLkIO5=(>(Ih&cA25!2L((rbixVq&~Ya zE1gr$URkx)`&J^Zh$%>zQmfm+2jK#vZXSb>q|B3Sy%#qFcHHkvbxi`bz8B1$u+Ibx z_;leGmUB$9l{<;V>xNqzitoPNLoCLxn}*OIm`Y5XV6kPx-oiU9#^BrdVi~pHyS6@^ zv+dCJfLXAIWB2GbJ)m?m_{lP{>$U^28Gm8oYH378cAX082d@tpD(Sq)TB z11a8b#^#A$!tV9Uy5O&JPzd)*s=`|-|)XUO~@2~VWOoNQ5{u!c)H21RA5F+)tH z!(hsBS3hf`%R6|mtsv88d>~X({_vhP-NeKJ*QX(MQ`QwfSLgk?;5U)wPSHOo@%^CU zB~9bzQkXoix9wflyQhci^z(ruu_pq*gLS~7rF=-~h+^YrD$kUqdGi~t2jSJkMF6lU zrx?wiDM&ib0Lv?3plaP}6^BD!fB%=G5VNw}7s|^)XDi9ZdvPL{L}R)XS8# zK#rI&93L|ib51p>YhT{DxqatWn_O#rRfLx<%!Asba`AXYgf}5mfWyU?ANt72;S(!7 zf8QHXJclt_QC^l=>++yfHcdF%49wL{fx8?F1vV!_vAVUmoLX@>-DH}@E-E{~f!eZUo(i_#v8MBX^ES4$P?XxI?s2PA| zcuM&7!9UpadU{gAzP67(ZzQqj#y$I25C08!RunudVeu)1db=I7GUfizJmiyEH5Y=i zVf0kIpx>!iY@q-%Gi%?$YEQ?F4|>1vS)~zLd^}=50*$FPR0k~HMVFu8u;>#c_4TLy zdwbTRla@EN?Js6WRg52{b?s778tZa~%hGSOafa*VYbM$*Z^M4rcr+QXp|rs9lw)Rv z$8Os1&uv?C^)->ALudC|pwL!fQr^8h_CLk`Iw8QiO3N|BTk$_I+AuT>+FW-an&e(B zstfihd6!}cHTO)MM&lx-p5BaZ|8ruth7;68FT?I}i@?*-mTUW}DJEO4FCO-iLmikZ z#Yq^VOA+aH)FLmT&zy|dMLYBI=nFn;h*aAYkZSrGIrX{UXJ=fVZ*kL}<5%6e85^=) zhvsBonOgm$1&m4Bq~VN6^PA=Be!xCIT(%<2hBAGXBWuScK{8fehUX3wk~00$0R4iJ zhDrZ>eXzIh4XX*ll=L83rt`nNZ#p0xI z^#YKyTOdEtjtWj^hiQ8sgi)bJ-rTh{BJq%hieZLNV+Hk}MQ$8KuHs2C$~UO);XU^y z^A|=#bq z1+-33Q%O^Ji0S<5hfe$#BG?5qDyXeQokOt$ZOQr^(ZSzs($x_(<|kL`Gh(PPI_S5) z$x#0CsnY3YsQxz5Vy3lzf8Drw^q~CzEG~h*jCiZQg%*=5-O4ROYgLP|;Xjf$Kz*6x z1TdFn%yvgvD@SUWT|3qTAQLuzSZU#0`bYwkAIcV+4d5%+tJrmOMpI+TG+GwMOCW7- zIYauAb~3)ezO(#@!M`k0W^af18W)3Y)vYF*`cpF02?;1UVWsSY4rM|~is)MvowX+~ zeL7FQP$-Ut1>OPo^_Ta31YCL<+fm*Ep+N78?k;P@OndU?*Oq#qbG)=fd@Q&P(WQwt z^aZ|7=lz*(Ns%Uw$Wm%<=-AkGS5!3^p+@0)b9M#w-} zu)1xKI_<#tHD@ECre=B2W%1H+u$85b$LZtu$=-MAJ zSQ72HvFh-S+dN5kL+Cz)x$uD5&<8|A z?0-WK`{+xdYZ&b3jeVw6*_2~D6lFzPD9u3I(ZS9m8h_qUm7({gz$@N~=O6KylYlm^#_0=;l>D?X-D9bgDRR%!kSLR7{ggdIWQiB?f-J7 zjmd_%tW==de^`qk{+mRZN#B+fA4P@&`9ryS_>4V9Nb!U@XTi|)S#5(4N-a=u)YZk_ zwe|^t02K4BE4S{MZumr}k@Ne5>nMIh{|YCJ0ne5qhXrgb=ihRWJ={Z=mPm%eJ?#n5 zSW*uf67bg_LgFatlgtdRk7T-cMv-Bmgh><0Pe&hEA8e`Ux;Sa&%7_KtXaeo`%hIzi zcn7S3V*{akqYU|{A_nPb9`YiO&;iqJWvG z8(=RxQs`RDJx)hA=tinR7TveGY}^9u=TQM#n8wnT0&d*+X1;LkLihc8Ymcg>Bpl+{ zdYAb29r~2v<~f&-^c~Uhun%08=ySQReuVoEK# z06x0Zt#Yc#PLw7x{RvW-2g$XCv%1vha!GT%O;KvL_^A{{y-Z;0w%e@Ph{CQ>7M=g)e!SKx&R zs6dnQw!K{ih-cv7f@ak=cUObFF9mFNct(0>z zyRm~LsioYQpQh?;HJWwU!cQrKWn^xX!Blm!o5fR)o)@wcU2)?VG&_Xx5j&4Xs`T)R zfG>an9;WkuZ!)u%TfrCe6a{u|L!wL9-*cq%AHfbV4F-tZfU7aU z4Jo(7O;M-OrNg68w^3tA_i*{9&-km^GWpz2AC6n{R>IDs*{n&u8-29^!F|t=D?muG zXX$Ds^R&`nx@rEuUCihN(Gm$<%dd`_lt{O)bj{q$K_Wq)u?`?0G$n5zT-Hp5VL3fsnwZMWxQp# z;-0m24{0!JnvUXWfr1Ui&^_RU^_>RkZ^I+oDnTEbv9H^)>oTjBV<-J^n;o-Y=jV=U z8^XcAmC>w$VT#4XcZcOCfn}bKp~y**EK=<^<(8hiOa87qg14Z;M)nB8#2Rd%1L=SUNO;Wa z3Ebk8c4qV8KTbnyfP}vs#F{Pscp%1{BR}P3>Iac8ZHjy8qvE>}wr-G0g;-ave+Xf} zf$;R#ZRGG8#CKm^lj{ zu#u$R4^AZ!>a7<4ya_wRD3m*a60aUEMcZ?O@bAmgiTB^j0?kV}iaQa7{UgL{eKXwW z18bI!(@yzCvM|32l`AR+C`QMA8drtRb3 zB?27wG)%5q(K%-W9{S@lzT9)csoAGCs(4PJ)Th9fr+UUn;lK?Rn zeoshXY~SBbg?bxu#R5#~*1MxMK|G%e%5Xcx`XO(*&zzG}Q)W6pq(_f}w~s=%@<*C4NNDd~T3HBco~njIa| zHvBd;t4fBOo_dPkp#4QIU&B_l+`hNRAyS{U54=x(IHZt)EGVb*u+^u8sgQJnTe*`QX#e&W%kGrXb8$Q*`OXVcFo<~7N4;D++=CR0f@Z1KVj7TGUd~s@&Mx?p`uiIkpPu)rj_9~G zd%Pbrbn{u)b1FRG?y!WLn_ELrIi8o}`0MgA02tr@rSFU^c)3Z$s-WmzZFFMPdHK;< zW~nm=nO|`>3gRq5256H2x)Z}np(S*L$Z#i3kQ}77M_kZ0RLcUSS`EBl8$u_`g*xFa z-BD2w-@*LgUA;n;U!kaDH8YO=t0tI#&o305x(owAEiqLijIl3MA2ZBvJc zU4>3nPiR{ekfUM5zx4q<8R(;nHx`GfQ$|d;N37kprhuHbF!kt*CAGCPLO=f`m$Fx@ z-3|u!WJUPqOodIWon~eI)2dXm*2>F|B^#Yw0?aE!$_)rW-=fzCEC}F&ex5F=@a!}k zt)_=v@k;%rB-Xsa5Ds?;d(DP`@)zfDx@K)7cRZ*&K(3f6BMZ;O#)8x)lNiZt0iO(i z*lUDaLs9p1+0c`&zDZ41c(^-7gAf>o5H2AeMW)A$t5&W7Oo&|Z{AsKy8HB)EG!|oO zEyO9)rh&aXBN(q)>HQ+nx#H6lqM!RyjTOOt@dTTwnR!vCptZ5-2fCPttF0ovqQRlN z2Xc&g*3^M&6_2Xfk@(ZcXWj8qpC3(+sogL9*+jjE7Er57gl+vEo>oPg80Q01C>~-B zJs-19hb!uQn^cW^5Soj(5$qTIH+DGU1hUr={~P*9jXRQ3+J0HF|iAV-uAgNy*VQ?X3R*E{k zZsuAP42xx*E{P`i&k=?y_+NODDFQ4nk%2nOUseOM?~S?Rzz1HU(0tnN*OBq@5$xx2!%cuR^{?(RE6a}_`S0WYYpnXN z$;Qxcz3}!s&uWeb%Q}OX$;vC z{tGkWkXrSi2;tI|Xfcps+2DC~=RL8b?IM2`u9oc62B&e$6#ill9-m`vvx5z%3@7-3 z2&y5BS3G)f_!9d?4nEn-#&Q>-hyj(4Pn9KIt%@(qb(Mv%g>@ZB$+J&NG`FQn>R#?c zm&W`*-&~-1`xktAypd2;aFp?~{%!!NX!VFzdbKj-V%8yQ;qDRls66yX>};lJh}iGn z(*&?Vy%1+M?0zT)|tXe>|QVrihNkj9=vVm>h9PFeGR;c3PE1pNgEU(y`f1qGUu zr?O;ayVDJ2+6$&m38&f$<`<{0jyYnL=KALol**y;S?Td8Ji^)sMQw{)@0IQ)CxQk$ z0}N)0uhsoom8Lm5k6gHARy`WdLxI8947x*M)562VxpW2|Myvc?+P;H)#S7eP(GQy z6^ER5P$@7X8Odf1rfAOgICM6|7^!8BkavY`NMMdYw$8?qrSL4S>up}wDzwsx9w4r% z!#Gd2f@^<3;NB z_rY$J2Nj+3Ovi_JCz{u3A1iNuU_6b`C<&6O3ia}U98t;cBgZn>3l*_4H?6Sr1C+A( zDJgpyM%kfu*5dHbn@ejk?|($O(MIRyqK+0bCB;Z9K?4J%Mv>DFEjW0EAxorU#Ay$U zU1+{%<_oz#5=*&$JpM%zw1BlKfbjzDjR;XQ9%>F|Kgp6fY!#ZRl$F0h;Ou=jJq?{@>;R4;TL`^$s9mfelH(%Fd ztu)!yiawB^fFP*3e3gp-81EgYy~1Jeki!Kc*7yhf;yLNb(NV%j3;?5jrP?$k;!|ms z@qYRd8m42_X`m7*jpDdiOBHeqVlhxWt6S48eyEx@W8Hw~CFIet;W4q(t5V06FgVC4 zNs*^cVff5&s@XDhy|c@%kr<$*DdyK6*D5A>kKGbNat|^|-~2)#8tS z{&p$KXggY_MU@E+#`rbXqbVQ=xppm{WR)%Ps{OFfSKpTSvGSf-OSY~)_;L7-znOo1 zI*oAF`x>98{z#!dMkzBD54Mg2WAyrk`Gd(!FJVRg;O_!K)3yjzBjN4$2|v?oYR#>o z2%41*s(&Fm8uK6j2Pt`f=qRCif3c8@x-Mw{)Y+-cVi)6$O5PHUqGnvtXPr#A z-_!Rb17LZZ4-&4 znbP)#e-OA{uRR6Eb$(43&e56>$NYBe+)d6g(KjiTKs3WZ5P@5ZyP1U__RByKU}*P# z`x1Y;C0jgDi*6s0WjLaJj<36StGD%IzipjJ?4Qj#TCIt{@wG*7?3+GIVqC7gmSPV{ ze8WF+cni`2E7}YHGUMfa-kcjtI{k#p&OJ;PZ2v{6C8= z7X2?uM?E_H4;K}ki;S;NSZPwP{=7biE~334nz-%uwnuD`QA}N%=8bf{T-~tB*I-2C z!j6^+eVHaCl5l+AB@>02P@b88GJ@)t&=(MmFaTNZoBDf4VQ+?|=DdEH{ zz;`J@oR8+`ET?`-P?s>|#0}f*N^oNC>#q5VE>khu&6lG9)72N@CK$?$o8Kp?GC#bA8j7Yrvx}l7Yza zf;0`sWb7g#yyC_kGOdI$6Y>Q%-#X6UC@l&L7`cy2Wy(+v$7mvzs7H*w0!-^E3gQps znQ_K`rqC%3NZO|TteCNsHU^=}1>tjL5&F$hcdm4E3qtWY$=FcXE)`91!CoGv9sqhx zl9#D#YlT z4X3^@1mBJ1s>T|Az#qAu&QI%Iw@*WD5|$b;%sA7mtnsbmZi8-Gi&2R0AHxRSSM@n~ z_8wdp=vNhelSgvU&n6XHpFs;%M!NTT2Qo%?=z#I5z%nNl4|eSx{r-jhH}|DiMi7$h zj$2jV0TSi@J<>^^95m}aA?B}*X;J`sdxZa+jA$|9I-4rT*Lc?KmSXYx1+GAsvvs9R zglPyQ^0XlJSz%@gg(gJH2tYXs$FEg$hdi%;^`L}WJV7a*XTVmVF?quDI7>qfV{?N! ztk%;#R#0Hb7Y4LJeNJn6;&L%`TE6`*Bx$zsTeXDC{4%e;^0gW*npRp45p*1L@Mr%VH#1K~q zLM`cQ(tqY;PMkFTWc!|-cyI-b9U)r^s$bdBZRj`Ukf78H7ee0_0D3roljRnu|L~$h zUDR@^1~|)X0^EU%Bf3yMTyN=XL7jXhK(32D&^x#sV;KJ6O(O$mVXUb*E7}%Rkja4m zGd3f`Fj&1a?$Z#YjL;!P9)A8puDdqw=dVBs{GLu2+DiO$BT8~Yc0 z5h2)e4U};G82LHKLyIBpoUCxU>cRG9xT|NxMZyyrmXB}bu`-SVhCSDWWwM2cX~nwp)DM~g{MTtaQ!m!i{BnUFs5gj*Vz$*PE`@yXH6pOhvR zkBP`4e%cH_ej{4@gtKwtu)?hzCL&(E(hZx1rRMQ$$_j;3AzPm>vx4)Ul`L{P-;7cj zqGAm-eGWcz>75Zhe8*6Pdn^gif%oVj(aixSAzt))(9EOV+K3td1Ajd%3Gtl%L9BmE z-QM5nGDj+zf*C9!fvQpTe6>8XURK%H33@Ku+WHWD>&5Uo*Jw9fs=umLE!8pX+ZXCq)HfnBH3VmDM;h}d0D#-(CnI4cDj}65 zs+eNsq=z=!e~%F9zqRokkN1gOAqR~>?~)({V*T~_nI?h%i{Cp~cKDak!qFM=Vpq`H zHCl!k+t8d>&MsjoB?y~z9pG8g)*IBatnutS6gAn?JV#;-r-RLl45e3&B>BH>$OHSt zlkx9G^m{i27h_>6g-%uVSX3*tlE>1MCg{jD%h_AX!ZfS<>G=;4=HL4!+}y{MW8ko#)BI#agB{&c7~%E!<}_6)*D38ye5KzC^36ZsMy@ou23k|TYyNB^k1xvN)I^3fB!go z7%NO1wp3eQFgpjcQfQ!%2YW@ zlvxv0L^l$ht&p(;kv4##BUKE5;#{nsz?mB!PEQIY{qrdjU2yUC$s6clod2PVczx-s zx(Voilgw$nKLw7pNGSu7_(X(5au?oi&CTMC^r1>LL-Wtj5sz>jqP^Eo9UN`sG7$)z zv4-&tIl!=3;vn7npuTR1Y`b4!Zl7Y?#u(%dd^BPim}9@sE^!4B%yDwp({1Ullr9I$3tEjv&{_ z#NA6pwtP=N)Kx#&@l@%?Ta=>G4icy%<-(E@60?QajJ&Loy5&SuJBc_MhR{_IX{XCE z^y8BZJI`#WnXI9N>^3!aEYq=_Kte;QiUc*LnU^1=z2%ItsROFyW*5GVqx7~a+FB&t zoM$(R{h7VjSt=j-GMN&@f9)sr|29jB3&Lv<+?*VIurYK%9$Ib_PX;pVF^dKCfVdQ; z8d%s+n}ya35`%))hLbQ%vnDdLB-35Db;Gujlr0XHira<-vLFMUi)VOVpB1lS9W8PS zw#$%7iiEy+LEBRZ)s*3oZ9DpLB-;OBuj(l{zxY_5ddFj{@(&LbKL(1#A8`;tokxcK)YMO(UC#u zM-qVSo{gknWg*tk)ebTDAUgT?n03OCpbpQH+P6)~o} zeRW~rzl4FYMS~SnjXAMi$JANJ++{Z^OB0yfpy59N50Dj#sdd`q1gjaotbP)#h*=>W zuzC;1K6f^>w#9uH!5tYvFaMQCn9p7S?dcbH(r{#2-7kSl=F(+@W@`=tuH65kxxg1- zy^~NN>QoEte2wfczTGrztK|VRj&PM40mHD$B@vzPK<3e zyVL~sI4(#QJjACcPRWr;oT;ovw8_B&D$StO>MySz+btBcCFv>UL`dYADf}c0WJ3R# z&7bv#a4HpR7v(6ZjY9AvXcJ94IZ~ml8Bn3PfSEr5YBmy;Z=me>QUU}rMQT!ki{n#{ z9|UH!D?+8YqqQ4c=8+wi&zoBssy6V=y8)h11vYcqP0GUzfe z)ei%NgSX}H1KbpDrdKeKSG2021uvjXNd^uUxRX5b0r87)L5$lDfgcmJ*qX!}%+C~Y z@wC*9EDQ*KO%cl{QiPJ4B-4E8J_XF$DFlgxu&NbMw3P_yQm`X6pH^!kVXG1T2HdtZ zcLTovx6YoA>s*`Um#fCF)f%uY^yzZ!Gosj5*&1vbnLaFHF)zjMDRbUikk+5~$L+m;D<6}8Q&T%^?ZmLJDaI(v$L|kYByf-_xR09_)Of$4fJ>%+HPWOw6Ij_k z^;+dLJQBF2=3q5NqU*uF^Gxt!2_wb55 zdL)ABoTSKb=ext zFoh^G#3+{ax7MLL4ls(`KT!b4$vAXiegU)tgbDuy!i*|=*P>=R^D~NdzCex1&a-~G z#Aw98-~45O1bv8QX$at1WY5^n%6wUuyKk4H%~VloYL3Iez-whMXl?(CO5St;kGknO z<}=mVif=@GIT}Qxb!w$qYQ!<0B$IW{($NR`O~xj9j&_2{ArV^$zX|MNM7RXGUN5U%+Be>x50Ck3Xe+bWt@Atm1zHe zS&Q8FW$d-xJ}EUDT%UQAvzf`5laR{d);%r+;iq+6KM@ONcCz2}2OmfmPoS5kzLx7K z@*}pfG2`Uq4~C;Kk;n|avEoan-jiD1pd@@jo@~PMy%7={`b;B%-S8zZPSa3?7k_m2 z{)vWm0<^LEN#MX}kRx@mf*?bFzsh%H%ygW__ZZinfW$@+X$})`yrUaK{$M|Xadi3w zH&X~HMLT44l!uHWBS_QC&*S~T=(`AbkNXx5MTz`Z4g6Qx2`u{Db6F;xuZNEtM>9H( zj9{Fd(%O~XVliVO{$>3AH4Nb1Qnga(&6N`CXe9ba_6i}u{V-v7!8AX=;@dPdZvrC+ zm{YZIZEbDcdB8&Zwy_ngs_>x_hRf7oF3OUUr2&aZ+vdbR$BMbR=w6fIwf zq{~DU@9B&)5Y;q36p04DuN52nqoF)wm&!Gs*0Kr|`kJT_`WoDSTJkY?M3RwH`-cEs zLn_pt3`p~T_l{322F~b-1eBfY4v&szrG{ll#$l&G5v~&jBgaCy#KdC!SE(6dm5fwa z<+5Y@hPP-@J#HpumO7AE2tGBieqBR}jO37LrR!~o7NZouLT&UA=Hlayd;y5F3p6yD z^_8%2O|SAtmXQyB)5if85sJ$b1sBrl;Ku?RMxi+ zO+S#J@n}Swb)?`<#3pu$0uq5zJa=OIrm9%?S6lDQ9&l0kohlleedf8}tmC2n5XF^UtWO+25kCQ5B2tqIY zo=Bn@WOY$~ZP?C2a3+%=lXr8AQ!^}BYWxo&(s-j zv<27R%gZL_8mvkqie;)>OJS?1FyJe9Lh?PE@rfK!R29fIx@&_W_?Oy-Prbozi|pWB zgaphaLx4Ka_(P!XNFVkVKhF@~LZxoXQc~bE$uWhDytN!F0bt}M$4MzG6c1&k2plm6 zkWKfeJp_y^f%;b27A}8w(SUWwC#Cf`>ayd~O#%vd_(f4%TZ$?>!{Zqx!AUau(L7(9pENE}W{w z6>CFoHv@re4r$Gq#c5}R}uGhW2l{b`-k9oP}tA7nlY_fV^Y zm&xdy%pu=RoVt)h`}_QEzl^D`-LT&GGQPHx`CNCAD2{M^{##a3>0SQvk{;vGk{C(c z&{E>FOfe#X#5XHqI=WZ{;2_ZPk);1S43zz@TuOttLbkUJPEKEU7f;AS43bB1T-%@h z`>@DhkpkQq(#470wZIn!{`*UG;IAvg-mIwRu-jX4c}GvUg&&!RZaW98>W2<&G~o=G zY&Mmu$t8H}J!sD)hY9uOvT7%@ zpO4LJe{Ds~l&6h>lQ;~3p~oiD&(_4T@K75(qe0t&Bksu}?L|{& z2ZAa`fJHiPeOH+1g*n!CO(k~Il>~I-wRJ8HAvJqd#Ps2{_O|$5Q|az{Mahk2t`05V zk)V~ke6Om4wLFhGoKn9yOyy|nQ1`t=#B1{jb#4fhEQs#Y^Nw!2fi17Y_r;ve3IyEl zi83Gd@!XELFmR)B4=<0LL_F>Bnm8^ToV@}#9uCoN?_acaw7`@P&vJF@y=+B1FUi{O zM$GI{a>7fzn1_3j+)5ab*D=7o#9y)ah}b9XJw-VMMUyd8is8VRSdmZ}$oTfy(dh(4 z#Qhx6-yU6tscjn@v(kIHUZp>nUK4ZW{z@0b# zzao5f_V8ef2vU?{>I8Ttpelx77aTdv9~ zh5WWN(Ei_*n&q)^!c;CtIx!w9fm2^sy$|g98YoWL7xY>OW6qM%p4q*;{jO7+gY;#{S#s$b*e51+$1a zM>KU9d;_9Dch49#U8^m{9;&$vidOxkoOVV4%y?V`rhCyE&u6z6Z78j59Lfbf28L8b zlzq`S#1|=w-?jU51zkUc_F*aZLY#%Ep0%)_xHQro^Hz9`Z0wv}pT)=6MTgvh1Pl>@ zVC58_s^W}}vfpA6TCMfkdEPERPr6pP`2FCEB5vOV1&k<6Emik7X z91Pi^Ihp~{uU7CC<^mg0Jq?J-vh?6(!87FYIZz$WsfYU3$L_oNzVzRTpU!O(EPO3} z%tZ%pUkojy&9NaS$Yq}%z5igHvU5wHh1OlkF-K_U0 z74XfmpJQW%-93cU&xx<^Qn~Yf5?i8x*$uy>xw>{2%~)hFH;7)-cf;Qcn$Huq?f6r+dclokK=tp&jXSKOZw)0dfKJ?`)2|N2)x{P7&e2NS? zxL~(q^mOe_x7l}t{Wca@A5;lv#h>|pX>W1wzf~6ZYSlg(7rqK@Xzlgl?@H@}<5!-& zS@Drrdd7Lom?{EKKH~)m{%J3_faWsMWw2*2+c3%v5v)E5uzku)YR1`*>oY=%9(;RP zUxFS4?aw3N{PU4B^(^#K)KHVGXo$!$g{X2s0FnL0r=x_}4rZv&(`Y3;hx{p85*&0v zq930}XhDaN-Jc!id>ytkYvyL8)a5iiZxMQ+_(>JC&9zV1c?`5Q77Z6&y1PBr!8Fz7 zN-GYH_z|Huas`}Qr=hZe=tQV>FiIo<(o4kiJ0F<%IRp= zcrs!jq=(Z~4!8y6$By|F1S*xX7{6bjIqeY&N^tQQyi@HDjO{~cT8@yfEp(>(Vav-! z`8x5Uf?1cPZ9eAQ-mys*${!Opn~miu8rsdRzxg7_`o-hsa>Ym!vC({`w+fG^@VTfC z;bP>$}IlMyBD88`y(d*2JXxKgj*I+K>;UL2kdAW^n@gkbFn>Qbi} zZZ0Kpn%4+Sq^-dx%PZVggwxG$D<%E7}m6cnv7@ED++ieze zT)nl`T=5l}ha-dxaZi63aJR`_?5|%fy`p>?2_>>3bJp@bz4cYNC-P6l@w6u&HK^8F zA*C~OLBq$WS23@iu&&Xc$PAr|2U}q#d+& zULCy>@w_79xZoQP|G0P12AZdvw&Gnm?F7dBeoc$^zPWlxxP6KEVhaN4W+OT^d{}w% z9ICr#3NGqlrWoPR0n>b%5TLyA@H(3xJG`~0;c%s1JJ=WRo*`9B;HE}SW1z%r5T4em zI5|aV1sRqSmY+-(TpTLnxn>F0WQ&@j6&dry;nYXKMXE{r4li4_M&~H~Vr@bYFOZH$ zA@-##s#Z8@K@^vrn%!oJom=y{k>w+-UtN^PXP&S#c2mGx{nDol)fi_F9hZEBKC znKHZ-l10f<4CEaq`)@6Z)!2#N5c(FvnWhzmqB1~*rlmo#Gq`m_{?a1R35v|YZgkPN zCYbQIy4$t6X|LKXTK$G--u!C*n98T(O2(xkW?tK2$eXJ{JnxhuO-CXHPL*ZGml5-2 zs$C~YQGJ`BOq(7FNgc?UizR*Ib@{H)YVKgkJm|l&X=m*;e)%IIzG#Ly#_Z?YHs7xHvQC3vQdpHJ9(i; z{;D4ajlR+X`92@4IafBvP(Z&T%4)y!^U{Ode~x|11hLC!%dbg&`)0$4Nt_LisqFr2 zOXtCi`rnmbjQI0}|o)mgA4 zi2@v}7WViFKK~pyG$54lamnQcUBP1iw2hAVJI$ys^@)q2x7Cx0 zJ7+Ps81X%DlP%_-pBobS;O8}d zi?8G1b{l)Lo%{LA8)wz2`x2UUj;=2r7F7nr=2PKIg$HQt<>;$64NXEmqw-<#b&k@g zz~vKk>&9q*5XPM_?S?(Ky_w(6NI7BpXnE6wEXQM*GxY5wBJapSlB<2Dx)@VWY}sk=HjZ zo>q174IFY}vbNDmPTKO&TH=2n?(%4O)2I_>;z;&7KUqnZ47*7_sn{HkL1UOfffRC# z_)c*8$b(B#C`Fn%QL09Rcqo$dvrbe=Sw-6G#L=+gJQ9YSGTSy-iiVF+Y6MMBO`%yN z+%gL8@1P|gxE^rPz3QDd_3GeTemd} zqE7}vPz000Qd28GgL2%ceQb{CQG>}}_+ighPtX!+npNpS%*VrW)lsECedsn)LJnk~ zZNWF@PC|FrVbmF5ak!C3Aux{^lN2Ef99olAl{XMd4c2i5CUgPQiZEhcMsx)tAw#$> z1F2QN*tEhn#yTB;$nmcDae<_0$$|#{NEf|rN`Hku$M6XI+S+w;=NqAU%s0HL*)x0k zoS)>}ZOcBVC>cMm;(_-MTRyw^RGw%7nFE*BC-!%2!Bx@|XRD~Ao|ECh7)cx%XUaKK zloBA~5pV(?2VegACEFMIf$So`v6A-~w3ACYXGQEa_-6T%zdO0mArHgcgmB^qf~509 zuj+&EP6$PoMg4ackV~flW@pq?sH33^W=-eE;d6toS^N~Y>)lqm>DFtXU2$QVaT^JN zL}=BrRR6vNH--OIC-!0y2}2VO8jM0?EV$jhc|0v+WqT7ZOL#`Y(<1~8kES!eU(&q^ zj7WcO4G~cpe$pp9h5XXNKsLb7ItOjS@9){d(-90fW9g zZQLShMAIq+u^1$hDwL!iA+;)mG&Pn{rBQv}`EF`wB7|}*-6Pnn73o_;PAn$$uq&9` zrJ)@8$Bu)u_Vtsl{p#Fl^QAKPn`GsXdc__UtC}~XdHQv8u}XcbFHKi4&_GxyAdKJ@ z$EG*m`267L>}_Zyxuhxj1V+q_PVBYnA-~0jrMoQYZ`Tf%PidI{V2kK8d%D2gx@f1I-|KdkjS1u2cW$An= z!-kn@OM8}Quxeh&_gM=E53em{0S|QWJUXxhe-K@xWVZ>F_r0TG${CWyqJ71SIwH5f zQIz!d)^_BS4~<>X?e0>o9^E@NdtH+~_vAR7dJ%JYy9LS}xO7?68a?Avvuk-ivqSvrjNmv} zr1vD%R&RRf+4M3sW>c@@N1i)P#Wq1YkE#W$vWcR^mG5&Zg+J}`waY6A$oVxHbv|>p z+St+G03RrQI+pxNFKynI7wj#sbB=~>m1?TLOl; zUpYbAN+=Z~fcV)kbaB4dVDiW?i229UeBE{)EDSn+1wj7IAVgQBzZ+LTP{#$M)64g3 zH~wQTuo?WAonkELq_W70ilaHom%z0S0(U*jHJP)gwwINzEK1Z_s(Ws{r>u>xqL=o} zs<=WX1!oZhy%;y%PcE8bEiP@jV1kXc9+Nb*I{)~#EpCx-H)ckH)VXi_AzJL+vm-7k(p*Xw257X6k@ zUnC^mRq)>OT{oal>rv{sV@Dgl)0~@sf%cbrqFrazP z`aL<*`Z0Husa>dK0a9ikE^IRL1VZH%&HA>3thx4GH-sz5OLoEYnrO)w?oy0?1&_6{ z<+-9vQ-Z8<(J&)XP=e>N|3#Af=4jHZwr;)P2di77-OP2`lY?;zHM`Al@%k!!0(|j+ zRe{Dugx=gZ$7-{h)?Uq@f+>U4KWCO}3AIK@2PO7C>DEO!<^}zF|85u<_v$X1Fs+#I zVR&;8q;+SD1~()RhT@-@BCT(awC^12uXuc{!garPpo3jrhc?lFi0ZK-k62k)m+B;x z%w3RZdIuYzkr2p`8l{mDS%G!!1&#jko3h7^KSv%rQ|f-}kk;%K9@s^gyyud(t;m^{ z*}fjbQod@=t9l)i8tHK;FwD8-d??WJJ%v(0R4hR01k<)6ZN{qWq)Tcx(1KN6WI@5_ zgRxVPM+?1Jrr9AXl#Jt&oZdL~arby5&Sa1r@m~3^(I7rR?gvknS0xX9<(%F$rn4ZI zr^#_A%CZvp4Z)?DKg%!^NGafkW+-*6;?R+tbp8Q-iffkUrj}x)kkMo%Jo3z*%Isk5 z2FFKZxWCMqBO#bAjc{Z#u5$10;+n-qrEC-G>bM7|`Mh}RkW@Gpu1_D~%o;7v7^=_f z|FvFR$EVqIw{kCrQqF~T<0E?|QD+TNfDl1IBhi=@pO!wuM$Mva_VNLk{8%z~f>x&} z;=(Rkw>ZqDE~XfQu8@r!pN$IgZ-s%{K`vU z{>A#*2Bl;S`Ew5lJA3p5wat+J<&62XRpIng4V7vD#d!t%3o<*AJD0|SjCK>|2x)GxF;}GVa1^vD z0$TDUMh1OlTdd@sR-0P5aeWV8;C%Wu5YXO*{G;2xf5{yWhp2MWY4hg(R5EPvk@{3N zGicE^V4R=ksKxd<`E`MUXR)&Ya={R+!#pRl$-PC>h%42AnNE&6Hfjg%Ve+&zFZ2gf znFtE=pR}<}g(Ql~47lY-Vbm?{gd_+Ft6hi}feFt9h*F6rq!K4x-bDcbV5=6I zHo1TpO=HzB% zG*_3No2eS+G)%%1*=M9!U=%59#45ffc7T2*X1b0*kp1M-cEAsp&!Ebd#}_AsV$0wX zQXFCBJln97i8E(VF|#gJIst9B=oy{4$QJd*80o=qcA*(&e__qfmgXY*DT#P^?xpBe zcdT4mL|ysy_(8(mB&wOCV4zsGFFuT0$Ayz6hJ65wV5ynTsf7TZNRTPkqD0CL zBb?JlK!_ooK9Q<#0r0Fr@-F-Bd7W>2m7Q2%$5+YHuGQiGf??|uw_p42gX62zIT zcKphzf7?dr#jsKrqqJKif4|2cP$k;)!NYM^9o>vg+#&~ty)f5DY{3c^5* z9c-bli~&`q|N9qT)lOf!o{Qb9zovLth2wF14LAZ?BPeS!fSB^AS?A@~_ z=U1zAX=8_(yqm6UNZlOWg39rf4Q4)o&fT*F7yDY)v9?N3=?xvour-@SL<2gUQHy(m zq&^_^Gi4FOs-?VkzO1yizH9-}<3!(mpa zUTm(-_oi5NeEWQyb<@GeE66-Q2yPkX@~)(KO4d%K!;!lyYhL#5TgbG2P_ZS#wligV z2bp(838i$)ylt3})u786YM@=y&r8*~J;cO)XoA+?G_h;c%kB|X!F0P1jmWB>GLj4? z-}$*{RtgT}f?#bH|B|vj2#n?kN%F9*bAU?|>^P2(ga5zooQkUt>vD zX>*AT929F4`1d@T(xSX>B@L5?T0GFktpO8$RhSbKu7EbZyH!vXVDBt9+($(e?#??e zTCs~cG({0VfLvopk>`OF0n~m>QPPjJhuc2bijmXCM?yY+=w1w!DVJl{%$XtFNf}LO z+~9T{0VU}#*Th7Z(do4+X7;nrYI#>+HX3(EDbYtQqfT%ki2yrqzH8luzAK}OH^71QV$gWDYfJvTY> ztZ^R_xcp3~RPe$9eU7hs@`^fK^9*cMjBR+9Lc9g8wx&roRICnlYfYRB_ z%Ed_&d_epmhW+uGetU2 z%#;tk%t*^yuP~LVMS~|TyQ*M%p&z~dVap=KlNs4ld*IBlwbNaqF&E`GMXD>rhF6zx zE?uuPKHWW$-rPRDFb`_|%|k?CVMDF%b5XBL9BR=^ROO7;cJaG&r`z+Hw%$9mi;9yq z?2&WOls4Ig*bR=@Ll@Gn*s}i|Jox?;!$q0T?MOmolXUFJ@BuyM{(i>oXqQQMx5aOI zUpnVklXoys?g_eW%20A$Emv|NGG9G#{+K4ybU8TPuJ>o>a?k-qxiAb#4=e09HhhT) z&G45|ocbtg^e)a;@VID&?rQh@zPR$RwjX*OZ!-eg$mS9Lr9d|Xm+CcEw@x!e5AY%O z`=ygL!nAH7wQLcR+{gl6}BHVN3!?xMrz;@msQN4b^RSW5LWY znmZwqVib=S{=r04g%mmpII7Sdf8%0@8lK@I4K@ffIALb(wd@_kE-u8Hge5?i16Nt; zXk;=8dW!vB6Pt5;%-+pDWUTcT(TsHSd&b`S=^D023%+g)%9yL3A&?YLO+UF)!bj`7 z;S>--cUyD=2Mzo_?=;|%vf~7=I76S)|2R03fDGedp7%qhfuzRBn9;R_8+02 zu?g;5?;UCpO$$HMI^7)KVqb9qra;YQiOz&OGSqK0dVy8=L*oObc11jKOC@98&=>8x zKR3chzSD&>E*{;t&QgmL;Nz9xJ|EU(W0j@i)kL!Xf)x~qKo+TK9!ZiQygsiU3aWgm z9U;EaGl*Ug29EC15jp;7FoJy;RTVaNtCQ^HUA+S_wlY$MVe$4l(H~3Ehtnl_yRC_W z?WN4SD~o=BRy&{QH3|btP!YtsXa8+(Ynj;tS=PjmIon{{3y_)FW@u3L_=iaQP#XKpWSSVc6+BrG#x)4X z-M-!vbv+oV!u-kHZr%^2058%xHEZs4eW4W0)fA>&ZEP6CfhB)nm?6}SQb4FhqGh7j zSwy;NQCcq{?x0+RO&D|mw`$U5539? z`V4j6w9`zr7VNdJYlGuV=!@ZROPXM6O}Rgx?Ief8H_oetso)K)znv;tae9;19{! zb zN)cUmqUK7`4kdi;2CblD)2@ylLEw(y)MPeY^JcNNoaYsETS8J^C{IpDxt|RgVE_iKjKXz zT!YOwzn@)ji7y?XR<1Ol{!M_&2jEI5uT0!L#~%5Xxuw{r0Q${te?(Zug#Qr4hyDrF zR#L(1cIQY*U%w+aN2f2E($Ud}WumpIqJr+5rW>dqUR>-vs&q=qrdcB8j1(E(m2{hF z`~05Mp$E^S05OWFe#Ag9JxiB8mvt#dAurU{&hJY-6}GL=x6*`40go&6i-Sej+?rJR ze9!xq$RTa=^!(k?+#F|QZMIOMaKTv}_Mg9`A~oGrQ*}%{bJ55`ao+&NT{E?naXvqu}XRUb5m{E5qq>}^LXL6B%QGgb7o%cFS;CK^$eFn378`D_%{LVcp_w%5CV?yyPeb_&-GzKWt};plkKX$o-S54v?rj z^ZRCT^)m{`6iUk|5{5~C$6r;;G&$Z=5)InYRTGkRQ_v!9+2X}6bIu+&kvFoMWUn_B zF4%gsajz8K3sPyZ05ds>RG2@%VcpE0u>^V{dpy1szL>xDr>FV6!$)$0;gJirT;tIy z*2|u;V7`;VeZJ5@Yn%!|VF1!DVteAye{yh^ot$TS#O0>{7Vq5~cG8xHo2nC|otAl$ zkgGQ;>pF1q-|w*EfRh9Dzd2lpl&vrX)DL9Oc84z>u`;7QO-AbdFJnEMNBj(t@{j-f zNyy`uG5`l0P>!ujQR`+Zv$0Ii_V?O_PvPq z1Kjp)N7{_YuDx?Qg4bY(54IFLn^KG`kQm}Ckh~coU765waB0K~?1_YCM*`C4fyhjx z!6v#V$9Lar#D~k98@I+PwA96rp|7MQ zUEpDUQT9l+;=E>FV z`2naL{MoDE?4Pn=(jCWWTa; zDoswuk~9SL>~ua2r%f5k)ffgpb!y+Kp?hD5Igm<6c-FZWlciZow~Lkg)-FqzCHoC) z=$It&wj#w=x$yD z!ra-PUrAc=c5UDph&`nRMYaFI?pWvTB6TtP!L|l8hm>lDOzm}KsG-4TkdkyFHi3rv zmgm6@pvt%WxWyyvYa#dj;aQC94o{EP;8@8z4%!TB0zNe`b+m%|KhBTQRFA~HS}=aB z3(gNFzR2dz>i8!Qg!<1@n#OZMbx9*lpL#8!FRZD#=KIe9NoIPd@q*m!W=~HrafLKd zq6hWN32vt(*Xwea@E1QG%7A$j^6rbjs*=a@&1-~{ z6*t%Jv0HR$2pw4F+e>?5=DfH&>;<~L8bC2{d7K%bplt5ilsuB8QT91m={Z?c$l8&j z{4#R!6d%c&PusE#e;kxIw!>Mh$C$TMV>q*4DDehTv74YS5r;Q;<`Eos85zTHoBF>b zUy}w~&<2|u7zv;uMgS2Z5I{_`v;{p<=P{O-e4UmSJ1Q=eJdKt{0KJ&2SKUHWKG!g8 zXz%$ku=`D)LT&%&WI(uBlZN!@U0b}`{$isl^6c)#e|G?no9Ds*FOU)JZ(%n9t*6Qj zKDcU^+p&wpsu#I5>I^3x{GoZJYr|Zw_};8So4LRSV@|&NLZ3fHpMQNB@NuX5ch0-K zgn)XQ%**EIxhi<2OX%rpugIyuDFcQTnz;$eUDjL>Ek+idU~D;~II!jj>KApBuem7N z@5{#joO6B|{hl_)MHMrCaNdKrMmgevldXZBd$g0?h(1Tp5J;VaKtnJ<`B@}h`hVV$ zQ*sy$`%Moywj)_~EDeMD6Z|%+awR^2A0IeVIDjApNqr63aDuuzpvO<5v@D`FT_Nfg z;KMu_X4%w`J0;z2@r{3wYeWidjgI0Ux*IrL+viVaPi`-iCB}{zv}l6$hPw=2&=Q=9H|G$Cs>U+$P269I%DVm&|0M7^fb1etM$`1Tcg9=SL{6xdwGSUg|H7CRwEx)>| zfX>R%^OcI7BSUqpzzM%tkVNM5CsiXrIYm^Y-W5-?6qTZw6t(IDIwfp~E)^zHqgP0z z&zlY*JJ01=E%JGkA^lZ61d1#Q?w)Z{;>L~vIG89_saK^;O$Gm8(z-%AS2IX_MY3f| zwjo)HE+t^nBxJ-;qC%tdeV)HHoxkEa0iVkB`dPLL2Ud1O*4tt*)9;?Qy>UFg@ZwrrT;L%<@SXzv_HQtMt9QU=fwWGEzKj+r6K)$jfm;EVq?ij-e}DVGf^n$-|G^KoP8#fH z=0B~-A{hqnwvQ=J<|u&yXi;i}$De|(zLuY&Bn>20G@_~%Kbu}V_h^CEXh`$xU5|2V zMO;y`e2}2s`P6TL1(;7`?#bemy1XKX8?ez8Y4h1n?HGtqM3~5K;h=5R%6$3g+((#) z^{IyP&yGiwX>qVx9b_=frd8)Y8jxyFHr#5Ls+1GO4sUR#vvoUJr&4uI(wR?NJdK6P?hXvBwcrnts=G zF!-o1L@aJyL{FEEPEdp{VoPI9LaLC+%n-<~&5xBc$NJ?Xla`HYB{06%C#dTsJrWoh zg8%g`xpbi9R}L)s0-$|M3^r;m!5i0OLI+HJ^MjP)cUV)eD^YDrV{dATmXtk#+VUVC zk!gzoH5Eq8D-mpxrwg{ih7;&?6-15=*x`mAU_A*9kr=}wW@%gOq{(oe2)r6cj7?b{ zR$Xx~1}Z>@N0$&um-rIGSj)xYQ@^;@5R&^6{BbwfcRtqWUUzEnP+$aI4!SkUc>I4( zKo%@?61BK1vTO1k<#C4NidZG{B-Nzci9ECzHTd3SZ(1!?bs;aWL#7siLV6=C zASM8MYaXQ5UpT+s>Ba9iW!vdL%IuTSH9JYsErO(YBR8Je8qibJwb~FXTOe7YEWg-_ z;sT?ZyxKia1kVRpx2KQlby_z_(C@TzbSMA7dx516rMjp{5uF*uXg%RKDgM7f6 z9d3wWiX@Y80(CfI3DgI=3aTt3VCQ-E^QpSVXrFvvfW43?I+_$`GR}7$uP8#WuTm;0 zDF<%WM|TjW>`KL4LayT+lp@`OBs&(*Y?IW!elb)IBGAMM(fYUu~C|nC}7D@ZhVsnx+Nn(B*jdE|KqouNF3pej858#yQb#-!kDu?)n(>>ol@!S62)LL1->4d! z6g30^9lLO4GTBV^u5*2c8gJZGkxZ7)yowA#Qq1RZ&`Z!8*q7@*-QhExWXhiu{2f6q zyN>U1#(P}Df{kXBKtS#cGs+uTFy`*Ct|b~ON$5M7Qxp^x)?-avZI3Z8KvOY(UVtJh(Iz!?FKxtRo=-(>8e;rzG&8*M+3~$}nH1olEc?Pl zM$|DiuaK?VLv}r^o_I{|XA8m3>Od8njMwLaH6EdK4!h@||B-%Wa+ed!*Rs(8Ku+vY zz?9wY?Y4nmC$5|@n0Vv6boN*h5O)QHEqp}vcrhY2%*rN%lOd0Jj?~}0p8%8cuj&l{ zZw&swa1eJe@oN>inxiz5gC4GImUdi&wjqBeQxbj243@Jd&gpemQ*dhw6&~8wDe5wL zk3{si{e^tSx0a?B7VgZ~i7bkG90+jBi8;eE?XbpHU4sVAurXLDBTG5d`(*rHkySW# zB(d1wVJoyPnYLVk*fqgs$K__(Huct5jLJYHg;~9U{r5XXIC0^icI8y)*lwYCyFG79 zx&->1+CRLCTXh6Ns6z@HdgUyHL$qU~`bx&+CsKiUXbPyo^ch}VR|wFz`L-xhn*o*) zTifFnlrah6COvD_GkQcG{aR_*%&5B=yfG=0 zfMr0rn{Mzhg#vWZG6dox>XHTwaDM6#S<7Y=$(Q4t+Z(rv;@qX_+W)w=tBMAjc+xh8 zmVQJzJ-I0`ou>aFkF>bWlxBF%qr#9pXehefXq68;#|4<%P$u^8_wU=KmE>Z4x0G z+rxYWm+KBa&MO|V4&L88KiB!}e^esW@z4HhBY-SkkX05bft%^;C$6-#3<*0Y+O3)n zeb=t1(JX=eW`qv2*s?)^w)MLPmn{w(Sc0s-Atv;wfgn2AR8&L+)>e!UUeqXZZvXa4 z5@)^6czWszC)vu$^$KRaLn2p%5_uMBC}!A`byTK%hnqhn*M_JXU9TKX09oSDk2c(WBwg~95Z zK{~zxJgEq{O|l|#U_Vn9Kp;-fLdD8tuN5VNsNTZdWi9~YAnVol5eAx~0D=ji9Ofyf zi=UbD%-vi2>+WEtKiVg~6x^HJx!}|*<;skV9Ws4W^nxqBUj=6a9la9g7vf0qH#c#u zEoUvpgya4`8~Yn5BdHbouZ7UfS7g{|g`bD&Ezf%zdvl_}ze*YY)Cm1*K|oEfEfk0C z+viwM0tH4p0okU-4(kQNNx8Kn^oS!xYdyjSFN8%~()ShVBc`P51IVSe%7Veac6jZd zWdweOWGGi?_vnwy6s5^kxa2L+#Do|&l?Mfpa3vqkdhGr0F|&N?Y+a;&VSru8jUQ3!2g@Q{63GL6%eiiX~*O`9CVr+f9G~>5;({dZhsL zocwLi6FH9fb~@7g7^CQj>i<8K7B|&?EJk$yoAYD7R17 z7t>o(x)Li(tgMo?sMeAc^km&2r!^F zY>eFlq#mzBfaGV;UTyM-EH^Bc3#^zoM4uBU5VHQ%f#L$qoKH(3({j-TtL2_-=9LP2 zYRK}Y9REA%XIiqp<8r)CVUD@}bMn(KdLA<+kxmnSjH-@M^KpMw_Lx=U=%eou*|CiS z@;{gNnb%%WoPsbfRVydeWLF$-R7z{Qo5ijN4?na!GQs2s=6^iZAD}VK>Gb+3 z$4nr}{O)=bWET{>_peC%`#U90Tx5{JsfT`DvH=%G)>LM$24Uy>F$k!-!`iizFtXF4 z3PLhwC`Ls`joH3)P8&CnqcPlR>D>9XikAAEj^tI&6nW@HL%0NExMLCWWD#YGWQ4v@ z7-1j^e*rPRFS1ZPA-nREs%^!eP8dmdh>|x5qoaKGL)q2b78TT3%}Pka{LjCob9pS{ zvYJvELNT8Qa{Y+rRJeK-)S}c498w#8WWo=|lS~3>F4`pF8gEwmFKD0ICn?Clok${3 z9r$z?M*+qa^7pL+beX+h)>xEIAii!36>b$V>O6`fi70Ng9@I!Em?xogU=-iyZpJt8 zT{`hQ_n$1}!II^{qicSPCjPocfg>CKM;lDoYR}7lIo?hZlt3GECK8fu16(dZ&()sl zrdv8({&^|_{M_!ZzS3xsG|{3M5qhig^aofJS`k|~A7S?Y%zxg)d+-0VRUH<*b5KF( zCvXp@-W)O69H&3WoJ5+V*cUn7*`sItjj!zE&F0@0hL#VCtqay&b;{nj*!pRq=%>7t z$GMi**2R@G?Z4mrtYw@32{Y&bLxldb43l*e)?U51e*480*Cyyc7wA@f@UddT`Y9JA z{Q|w8Kip10; zpJ4P(S&UP8?*5-Oz=eh4;3k0dnXkUzl{WpoQKWhM;9bA^?x#hHMy^|91cFR|`R!iV zI$_n*SI8WvhJBnb z)39GHW#d(`+gtZl+O_QAuhc5tS@rs`8^=v6NOQ%?#NMRIzRBes|VV!+jB?qdEWXK@VG(ybGL%JT?as`lIA;U6qKWn z+k)2~%?2&&6|n#oQ7t)2csgmLijljlLpL-|tOxFko>9L1Zr)0X1qBXE)j~ znJ3+wTea6N%WU@IpEY*7_U%gp%>uOD?D(_l_S=8PZnjP(k|2RZGnF6d|Lrfw=59Ky SW4w?72s~Z=T-G@yGywo=u<@z@ literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md new file mode 100644 index 0000000000..1ff0c69942 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md @@ -0,0 +1,40 @@ +--- +title: All devices report—historical +description: Provides a visual representation of the update status trend for all devices over the last 90 days. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# All devices report—historical + +The historical All devices report provides a visual representation of the update status trend for all devices over the last 90 days. + +**To view the historical All devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **All devices report—historical**. + +:::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: + +> [!TIP] +> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. | + +For a description of the displayed device status trends, see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md new file mode 100644 index 0000000000..dd3286efc7 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md @@ -0,0 +1,56 @@ +--- +title: All devices report +description: Provides a per device view of the current update status for all Windows Autopatch enrolled devices. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# All devices report + +The All devices report provides a per device view of the current update status for all Windows Autopatch enrolled devices. + +**To view the All devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **All devices report**. + +:::image type="content" source="../media/windows-autopatch-all-devices-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-report.png"::: + +> [!NOTE] +> The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. + +## Report information + +The following information is available in the All devices report: + +| Column name | Description | +| ----- | ----- | +| Device name | The name of the device. | +| Azure Active Directory (AD) device ID | The current Azure AD recorded device ID for the device. | +| Serial number | The current Intune recorded serial number for the device. | +| Deployment ring | The currently assigned Windows Autopatch deployment ring for the device. | +| Update status | The current update status for the device (see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses)). | +| Update sub status | The current update sub status for the device (see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses)) | +| OS version | The current version of Windows installed on the device. | +| OS revision | The current revision of Windows installed on the device. | +| Intune last check in time | The last time the device checked in to Intune. | + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Search | Use to search by device name, Azure AD device ID or serial number | +| Sort | Select the **column headings** to sort the report data in ascending and descending order. | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate report**. | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md new file mode 100644 index 0000000000..31970aad9f --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md @@ -0,0 +1,40 @@ +--- +title: Eligible devices report—historical +description: Provides a visual representation of the update status trend for all eligible devices to receive quality updates over the last 90 days. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Eligible devices report—historical + +The historical Eligible devices report provides a visual representation of the update status trend for all eligible devices to receive quality updates over the last 90 days. + +**To view the historical Eligible devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **Eligible devices report—historical**. + +:::image type="content" source="../media/windows-autopatch-eligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-eligible-devices-historical-report.png"::: + +> [!NOTE] +> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. | + +For a description of the displayed device status trends, see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md new file mode 100644 index 0000000000..a0d5691f1c --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md @@ -0,0 +1,43 @@ +--- +title: Ineligible devices report—historical +description: Provides a visual representation of why devices have been ineligible to receive quality updates over the last 90 days. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Ineligible devices report—historical + +The historical Ineligible devices report provides a visual representation of why devices have been ineligible to receive quality updates over the last 90 days. + +> [!NOTE] +> Devices must have at least six hours of usage, with at least two hours being continuous. You may see an increase in the number of ineligible devices when the widget refreshes every second Tuesday of each month. + +**To view the historical Ineligible devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **Ineligible devices report—historical**. + +:::image type="content" source="../media/windows-autopatch-ineligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-ineligible-devices-historical-report.png"::: + +> [!NOTE] +> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. | + +For a description of the displayed device status trends, see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md new file mode 100644 index 0000000000..91b8c2d547 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -0,0 +1,110 @@ +--- +title: Windows quality update reports +description: This article details the types of reports available and info about update device eligibility, device update health, device update trends in Windows Autopatch +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Windows quality update reports + +The Windows quality update reports provide you information about: + +- Quality update device eligibility +- Device update health +- Device update trends + +Together, these reports provide insight into the quality update state and compliance of Windows devices that are enrolled into Windows Autopatch. + +The report types are organized into the following focus areas: + +| Focus area | Description | +| ----- | ----- | +| Operational detail |

    | +| Device trends |
    • [All devices report – historical](windows-autopatch-wqu-all-devices-historical-report.md): Provides the update status trend of all devices over the last 90 days.
    • [Eligible devices report – historical](windows-autopatch-wqu-eligible-devices-historical-report.md): Provides the update status trend of all eligible devices to receive quality updates over the last 90 days.
    • [Ineligible devices report – historical](windows-autopatch-wqu-ineligible-devices-historical-report.md): Provides a trending view of why ineligible devices haven’t received quality updates over the last 90 days.
    | + +## Who can access the reports? + +Users with the following permissions can access the reports: + +- Global Administrator +- Intune Service Administrator +- Administrators assigned to an Intune role with read permissions + +## About data latency + +The data source for these reports is the [Windows diagnostic data](../references/windows-autopatch-privacy.md#microsoft-windows-1011-diagnostic-data). The data typically uploads from enrolled devices once per day. Then, the data is processed in batches before being made available in Windows Autopatch. The maximum end-to-end latency is approximately 24 hours. + +## Windows quality update statuses + +The following statuses are used throughout the Windows Autopatch reporting suite to describe the quality update status for devices: + +- [Healthy devices](#healthy-devices) +- [Not Up to Date (Microsoft Action)](#not-up-to-date-microsoft-action) +- [Ineligible Devices (Customer Action)](#ineligible-devices-customer-action) + +Each status has its own set of sub statuses to further describe the status. + +### Healthy devices + +Healthy Devices are devices that meet all of the following prerequisites: + +- [Prerequisites](../prepare/windows-autopatch-prerequisites.md) +- [Prerequisites for device registration](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) +- [Windows quality update device eligibility](../operate/windows-autopatch-wqu-overview.md#device-eligibility) + +> [!NOTE] +> Healthy devices will remain with the **In Progress** status for the 21-day service level objective period. Devices which are **Paused** are also considered healthy. + +| Sub status | Description | +| ----- | ----- | +| Up to Date | Devices are up to date with the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | +| In Progress | Devices are currently installing the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | +| Paused | Devices that are currently paused due to a Windows Autopatch or customer-initiated Release Management pause. For more information, see [Pausing and resuming a release](../operate/windows-autopatch-wqu-overview.md#pausing-and-resuming-a-release). | + +### Not Up to Date (Microsoft Action) + +Not Up to Date means a device isn’t up to date when the: + +- Quality update is more than a month out of date, or the device is on last month’s quality update +- Device is more than 21 days overdue from the last release. + +> [!NOTE] +> Microsoft Action refers to the responsibility of the Windows Autopatch Service Engineering Team to carry out the appropriate action to resolve the reported device state. Windows Autopatch aims to keep at least [95% of eligible devices on the latest Windows quality update 21 days after release](../operate/windows-autopatch-wqu-overview.md#service-level-objective). + +| Sub status | Description | +| ----- | ----- | +| No Heartbeat | The Windows Update service hasn’t been able to connect to this device. The service can’t offer the update to that device. | +| Not Offered | The Windows Update service hasn’t offered the update to that device. | +| Policy Blocking Update | This device has a policy that is blocking the update, such as a deferral or pause policy. Devices are only in this state after the 21-day threshold. | +| In Progress—Stuck | This device has downloaded the update but is getting stuck in a loop during the install process. The update isn’t complete. | +| Other | This device isn't up to date and isn’t reporting back data from the client. | + +### Ineligible Devices (Customer Action) + +Customer Action refers to the responsibility of the designated customer IT administrator to carry out the appropriate action to resolve the reported device sub status. + +Within each 24-hour reporting period, devices that are ineligible are updated with one of the following sub statuses. + +| Sub status | Description | +| ----- | ----- | +| Insufficient Usage | Devices must have at least six hours of usage, with at least two hours being continuous. | +| Low Connectivity | Devices must have a steady internet connection, and access to [Windows update endpoints](../prepare/windows-autopatch-configure-network.md). | +| Out of Disk Space | Devices must have more than one GB (GigaBytes) of free storage space. | +| Not Deployed | Windows Autopatch doesn't update devices that haven't yet been deployed. | +| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Intune Sync Older Than 5 Days | Devices must have checked with Intune within the last five days. | + +## Data export + +Select **Export devices** to export data for each report type. + +> [!NOTE] +> Note You can’t export Windows Autopatch report data using Microsoft Graph RESTful web API. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md new file mode 100644 index 0000000000..646fe1f3c3 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md @@ -0,0 +1,44 @@ +--- +title: Summary dashboard +description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Summary dashboard + +The Summary dashboard provides a summary view of the current update status for all devices enrolled into Windows Autopatch. + +**To view the current update status for all your enrolled devices:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. + +:::image type="content" source="../media/windows-autopatch-summary-dashboard.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-summary-dashboard.png"::: + +> [!NOTE] +> The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. + +## Report information + +The following information is available in the Summary dashboard: + +| Column name | Description | +| ----- | ----- | +| Windows quality update status | The device update state. For more information, see [Windows quality update status](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). | +| Devices | The number of devices showing as applicable for the state. | + +## Report options + +The following option is available: + +| Option | Description | +| ----- | ----- | +| Refresh | The option to **Refresh** the Summary dashboard is available at the top of the page. This process will ensure that the Summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | From b2460f2b3da428111685e690d80dc18bb628cb33 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:03:23 -0800 Subject: [PATCH 091/324] Update windows-autopatch-wqu-reports-overview.md --- .../operate/windows-autopatch-wqu-reports-overview.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md index 91b8c2d547..24dad31605 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -53,7 +53,7 @@ Each status has its own set of sub statuses to further describe the status. ### Healthy devices -Healthy Devices are devices that meet all of the following prerequisites: +Healthy devices are devices that meet all of the following prerequisites: - [Prerequisites](../prepare/windows-autopatch-prerequisites.md) - [Prerequisites for device registration](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) @@ -98,8 +98,8 @@ Within each 24-hour reporting period, devices that are ineligible are updated wi | Low Connectivity | Devices must have a steady internet connection, and access to [Windows update endpoints](../prepare/windows-autopatch-configure-network.md). | | Out of Disk Space | Devices must have more than one GB (GigaBytes) of free storage space. | | Not Deployed | Windows Autopatch doesn't update devices that haven't yet been deployed. | -| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | -| Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | | Intune Sync Older Than 5 Days | Devices must have checked with Intune within the last five days. | ## Data export @@ -107,4 +107,4 @@ Within each 24-hour reporting period, devices that are ineligible are updated wi Select **Export devices** to export data for each report type. > [!NOTE] -> Note You can’t export Windows Autopatch report data using Microsoft Graph RESTful web API. +> You can’t export Windows Autopatch report data using Microsoft Graph RESTful web API. From 5b8300d4e898370cd2a1e6354d7875d5610a5a4f Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:04:04 -0800 Subject: [PATCH 092/324] Update windows-autopatch-wqu-all-devices-historical-report.md --- .../windows-autopatch-wqu-all-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md index 1ff0c69942..aba6d03509 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md @@ -23,7 +23,7 @@ The historical All devices report provides a visual representation of the update 1. Select the **Reports** tab. 1. Select **All devices report—historical**. -:::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: +:::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="All devices—historical report" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: > [!TIP] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. From 3b198c327013bcb0fe6823c8cfc7c36bfaf712dc Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:04:24 -0800 Subject: [PATCH 093/324] Update windows-autopatch-wqu-all-devices-report.md --- .../operate/windows-autopatch-wqu-all-devices-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md index dd3286efc7..5536a42c04 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md @@ -23,7 +23,7 @@ The All devices report provides a per device view of the current update status f 1. Select the **Reports** tab. 1. Select **All devices report**. -:::image type="content" source="../media/windows-autopatch-all-devices-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-report.png"::: +:::image type="content" source="../media/windows-autopatch-all-devices-report.png" alt-text="All devices report" lightbox="../media/windows-autopatch-all-devices-report.png"::: > [!NOTE] > The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. From 3f73d2107aa13c538b5784d25750be131cf9c455 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:04:46 -0800 Subject: [PATCH 094/324] Update windows-autopatch-wqu-eligible-devices-historical-report.md --- .../windows-autopatch-wqu-eligible-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md index 31970aad9f..4e4e383213 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md @@ -23,7 +23,7 @@ The historical Eligible devices report provides a visual representation of the u 1. Select the **Reports** tab. 1. Select **Eligible devices report—historical**. -:::image type="content" source="../media/windows-autopatch-eligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-eligible-devices-historical-report.png"::: +:::image type="content" source="../media/windows-autopatch-eligible-devices-historical-report.png" alt-text="Eligible devices—historical report" lightbox="../media/windows-autopatch-eligible-devices-historical-report.png"::: > [!NOTE] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. From 1f1e717b28925db5c0e1533a191aeeb26ab6b030 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:05:23 -0800 Subject: [PATCH 095/324] Update windows-autopatch-wqu-ineligible-devices-historical-report.md --- ...indows-autopatch-wqu-ineligible-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md index a0d5691f1c..733ee98e88 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md @@ -26,7 +26,7 @@ The historical Ineligible devices report provides a visual representation of why 1. Select the **Reports** tab. 1. Select **Ineligible devices report—historical**. -:::image type="content" source="../media/windows-autopatch-ineligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-ineligible-devices-historical-report.png"::: +:::image type="content" source="../media/windows-autopatch-ineligible-devices-historical-report.png" alt-text="Ineligible devices—historical report" lightbox="../media/windows-autopatch-ineligible-devices-historical-report.png"::: > [!NOTE] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. From a2a8afbb15602aae3d6ac5678ec97cb727500840 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:06:04 -0800 Subject: [PATCH 096/324] Update windows-autopatch-wqu-summary-dashboard.md --- .../operate/windows-autopatch-wqu-summary-dashboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md index 646fe1f3c3..735136be22 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md @@ -21,7 +21,7 @@ The Summary dashboard provides a summary view of the current update status for a 1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. -:::image type="content" source="../media/windows-autopatch-summary-dashboard.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-summary-dashboard.png"::: +:::image type="content" source="../media/windows-autopatch-summary-dashboard.png" alt-text="Summary dashboard" lightbox="../media/windows-autopatch-summary-dashboard.png"::: > [!NOTE] > The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. From b16794754b98c4b20776091acea0b022ddd4ef95 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Wed, 30 Nov 2022 16:20:40 -0800 Subject: [PATCH 097/324] added prerequisites --- windows/deployment/do/mcc-isp-signup.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index 352d4402b4..d411757f8e 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -22,9 +22,17 @@ ms.topic: article This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). +## Prerequisites + +Before you begin sign up, ensure you have the following components: +1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a completely free-of-charge service hosted in Azure. You will need to have a Pay-As-You-Go subscription in order to onboard to our service. To create a subscription, [visit this page](https://azure.microsoft.com/en-us/offers/ms-azr-0003p/). +1. **Access to Azure portal**: Ensure you have the credentials needed to access your organization's Azure portal. +1. **Peering DB**: Ensure your organization's [Peering DB](https://www.peeringdb.com/) page is up-to-date and active. Check that the NOC email listed is accurate, and that you have access to this email. +1. **Server**: Ensure the server you wish to install Microsoft Connected Cache on is ready, and that the server is installed Ubuntu 20.04 LTS. + ## Resource creation and sign up process -1. Navigate to the [Azure portal](https://www.portal.azure.com). In the top search bar, search for **Microsoft Connected Cache**. +1. Navigate to the [Azure portal](https://www.portal.azure.com). Select **Create a Resource**. Then, search for **Microsoft Connected Cache**. :::image type="content" source="./images/mcc-isp-search.png" alt-text="Screenshot of the Azure portal that shows the Microsoft Connected Cache resource in Azure marketplace."::: From 7a5ef481ae0e7789c43b13c032ecd9ba8cca30a6 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 16:35:21 -0800 Subject: [PATCH 098/324] Addressed a few draft comments - Moved "symptoms" above "affected devices" - Added "when CG is running" explicitly to end of "symptoms" section - Added security reasoning to "Why this is happening" section - Explicitly specified that supplied credentials are allowed for MSCHAP, NTLMv1 and WDigest - Added note about MDM management alongside GP management --- .../credential-guard-known-issues.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index d863d5b342..7d7195e1e0 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -24,6 +24,9 @@ Windows Defender Credential Guard has certain application requirements. Windows ## Known Issue: Single Sign-On (SSO) for Network services breaks after upgrading to **Windows 11, version 22H2** +### Symptoms of the issue: +Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication will be unable to use SSO to login and will be forced to manually re-authenticate in every new Windows session when Windows Defender Credential Guard is running. + ### Affected devices: Any device that enables Windows Defender Credential Guard may encounter this issue. As part of the Windows 11, version 22H2 update, eligible devices which had not previously explicitly disabled Windows Defender Credential Guard had it enabled by default. This affected all devices on Enterprise (E3 and E5) and Education licenses, as well as some Pro licenses*, as long as they met the [minimum hardware requirements](credential-guard-requirements.md#hardware-and-software-requirements). @@ -33,16 +36,15 @@ Any device that enables Windows Defender Credential Guard may encounter this iss > To determine if your Pro device will receive default enablement when upgraded to **Windows 11, version 22H2**, do the following **before** upgrading: > Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage#disable-windows-defender-credential-guard). -### Symptoms of the issue: -Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication will be unable to use SSO to login and will be forced to manually re-authenticate in every new Windows session. - ### Why this is happening: -Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. Affected procols include: +Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. These protocols are considered insecure because they can lead to password disclosure on the client and the server, which is in direct contradiction to the goals of Windows Defender Credential Guard. Affected procols include: - Kerberos unconstrained delegation (both SSO and supplied credentials are blocked) - Kerberos when PKINIT uses RSA encryption instead of Diffie-Hellman (both SSO and supplied credentials are blocked) - - WDigest (only SSO is blocked) - - NTLM v1 (only SSO is blocked) - MS-CHAP (only SSO is blocked) + - WDigest (only SSO is blocked) + - NTLM v1 (only SSO is blocked) + +Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials. ### Options to fix the issue: @@ -51,7 +53,7 @@ Microsoft recommends that organizations move away from MSCHAPv2-based connection For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. > [!TIP] -> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. This process can also be done via Mobile Device Management (MDM) policy rather than Group Policy if the devices are currently being managed by MDM. > [!NOTE] > MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: From bcdc8052bb8de80b1997aecc68e90224677f4b52 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Wed, 30 Nov 2022 16:38:55 -0800 Subject: [PATCH 099/324] Enterprise doc changes, added VMWare, endpoints --- .../do/delivery-optimization-endpoints.md | 2 +- .../deployment/do/mcc-enterprise-appendix.md | 44 +++++++++++-------- .../do/mcc-enterprise-prerequisites.md | 3 ++ 3 files changed, 29 insertions(+), 20 deletions(-) diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md index 8de2e95ad4..43856f97ce 100644 --- a/windows/deployment/do/delivery-optimization-endpoints.md +++ b/windows/deployment/do/delivery-optimization-endpoints.md @@ -34,4 +34,4 @@ This article lists the endpoints that need to be allowed through the firewall to | *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Microsoft Configuration Manager Distribution Point | | *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Microsoft Configuration Manager Distribution Point | | *.do.dsp.mp.microsoft.com | HTTP / 80
    HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Microsoft Connected Cache Managed in Azure | -| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com | AMQP / 5671
    MQTT / 8883
    HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | +| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, *.github.com | AMQP / 5671
    MQTT / 8883
    HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | diff --git a/windows/deployment/do/mcc-enterprise-appendix.md b/windows/deployment/do/mcc-enterprise-appendix.md index 83d2df61da..400beb744f 100644 --- a/windows/deployment/do/mcc-enterprise-appendix.md +++ b/windows/deployment/do/mcc-enterprise-appendix.md @@ -12,6 +12,24 @@ ms.topic: article # Appendix +## Steps to obtain an Azure Subscription ID + + +[!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] + +### Troubleshooting + +If you're not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). + +Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). + +## Installing on VMWare + +We have seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMWare. To do so, there are a couple of additional configurations to be made: + +1. Ensure that you are using ESX. In the VM settings, turn on the option **"Expose hardware assisted virtualization to the guest OS".** +1. Using the HyperV Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to "Yes". + ## Diagnostics Script If you're having issues with your MCC, we included a diagnostics script. The script collects all your logs and zips them into a single file. You can then send us these logs via email for the MCC team to debug. @@ -33,17 +51,6 @@ To run this script: 1. [Email the MCC team](mailto:mccforenterprise@microsoft.com?subject=Debugging%20Help%20Needed%20for%20MCC%20for%20Enterprise) and attach this file asking for debugging support. Screenshots of the error along with any other warnings you saw will be helpful during out debugging process. -## Steps to obtain an Azure Subscription ID - - -[!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] - -## Troubleshooting - -If you're not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). - -Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). - ## IoT Edge runtime The Azure IoT Edge runtime enables custom and cloud logic on IoT Edge devices. @@ -58,14 +65,6 @@ communication operations. The runtime performs several functions: For more information on Azure IoT Edge, see the [Azure IoT Edge documentation](/azure/iot-edge/about-iot-edge). -## EFLOW - -- [What is Azure IoT Edge for Linux on Windows](/azure/iot-edge/iot-edge-for-linux-on-windows) -- [Install Azure IoT Edge for Linux on Windows](/azure/iot-edge/how-to-provision-single-device-linux-on-windows-symmetric#install-iot-edge) -- [PowerShell functions for Azure IoT Edge for Linux on Windows](/azure/iot-edge/reference-iot-edge-for-linux-on-windows-functions) -- EFLOW FAQ and Support: [Support · Azure/iotedge-eflow Wiki (github.com)](https://github.com/Azure/iotedge-eflow/wiki/Support#how-can-i-apply-updates-to-eflow) -- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) - ## Routing local Windows Clients to an MCC ### Get the IP address of your MCC using ifconfig @@ -115,3 +114,10 @@ To verify that the Delivery Optimization client can download content using MCC, :::image type="content" source="./images/ent-mcc-delivery-optimization-activity.png" alt-text="Screenshot of the Delivery Optimization Activity Monitor."::: +## EFLOW + +- [What is Azure IoT Edge for Linux on Windows](/azure/iot-edge/iot-edge-for-linux-on-windows) +- [Install Azure IoT Edge for Linux on Windows](/azure/iot-edge/how-to-provision-single-device-linux-on-windows-symmetric#install-iot-edge) +- [PowerShell functions for Azure IoT Edge for Linux on Windows](/azure/iot-edge/reference-iot-edge-for-linux-on-windows-functions) +- EFLOW FAQ and Support: [Support · Azure/iotedge-eflow Wiki (github.com)](https://github.com/Azure/iotedge-eflow/wiki/Support#how-can-i-apply-updates-to-eflow) +- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) \ No newline at end of file diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index 705448742b..84faf8d670 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -26,6 +26,9 @@ ms.topic: article The resources used for the preview and in the future when this product is ready for production will be free to you, like other caching solutions. 2. **Hardware to host MCC**: The recommended configuration will serve approximately 35000 managed devices, downloading a 2 GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps. + + > [!NOTE] + > Azure VMs are not currently supported. If you'd like to install your cache node on VMWare, see the [Appendix](mcc-enterprise-appendix.md) for a few additional configurations. **EFLOW Requires Hyper-V support** - On Windows client, enable the Hyper-V feature From c771eb2abd8a28d99bd7700333284d273d7d87f0 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Wed, 30 Nov 2022 16:46:01 -0800 Subject: [PATCH 100/324] edit github endpoint --- windows/deployment/do/delivery-optimization-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md index 43856f97ce..49b08e601c 100644 --- a/windows/deployment/do/delivery-optimization-endpoints.md +++ b/windows/deployment/do/delivery-optimization-endpoints.md @@ -34,4 +34,4 @@ This article lists the endpoints that need to be allowed through the firewall to | *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Microsoft Configuration Manager Distribution Point | | *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Microsoft Configuration Manager Distribution Point | | *.do.dsp.mp.microsoft.com | HTTP / 80
    HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Microsoft Connected Cache Managed in Azure | -| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, *.github.com | AMQP / 5671
    MQTT / 8883
    HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | +| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | AMQP / 5671
    MQTT / 8883
    HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | From 4ccee6c3cb1f4189af1d56b1ae226e3ef4765221 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:00:01 -0800 Subject: [PATCH 101/324] Fixed links and updated NTLM event - Fixed the broken credential-guard-manage.md links - Moved the Event Viewer events and added the event path --- .../credential-guard-known-issues.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 7d7195e1e0..68d5b6cc09 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -34,7 +34,7 @@ Any device that enables Windows Defender Credential Guard may encounter this iss > [!TIP] > To determine if your Pro device will receive default enablement when upgraded to **Windows 11, version 22H2**, do the following **before** upgrading: -> Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage#disable-windows-defender-credential-guard). +> Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage.md#disable-windows-defender-credential-guard). ### Why this is happening: Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. These protocols are considered insecure because they can lead to password disclosure on the client and the server, which is in direct contradiction to the goals of Windows Defender Credential Guard. Affected procols include: @@ -44,19 +44,10 @@ Applications and services are affected by this issue when they rely on insecure - WDigest (only SSO is blocked) - NTLM v1 (only SSO is blocked) -Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials. - -### Options to fix the issue: - -Microsoft recommends that organizations move away from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. Windows Defender Credential Guard will not block certificate-based authentication. - -For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. - -> [!TIP] -> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. This process can also be done via Mobile Device Management (MDM) policy rather than Group Policy if the devices are currently being managed by MDM. +Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials. > [!NOTE] -> MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: +> MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs in Event Viewer at `Application and Services Logs\Microsoft\Windows\NTLM\Operational` for the following warning and/or error: > > **Event ID 4013** (Warning) > ``` @@ -75,6 +66,15 @@ For a more immediate but less secure fix, simply [disable Windows Defender Crede > /> > ``` +### Options to fix the issue: + +Microsoft recommends that organizations move away from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. Windows Defender Credential Guard will not block certificate-based authentication. + +For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage.md#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. + +> [!TIP] +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage.md#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. This process can also be done via Mobile Device Management (MDM) policy rather than Group Policy if the devices are currently being managed by MDM. + ## Known issues involving third-party applications The following issue affects MSCHAPv2: From ff9f6bcff0512074e781ab8c53d3270a497b7a6e Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:17:09 -0800 Subject: [PATCH 102/324] Updated CredGuard root - Added default enablement announcement and link - Added link to Known Issues - Changed article author --- .../identity-protection/credential-guard/credential-guard.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 950eb3a95c..aa1ffc29b1 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: - M365-identity-device-management @@ -31,6 +31,9 @@ By enabling Windows Defender Credential Guard, the following features and soluti - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. - **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate other security strategies and architectures. +> [!NOTE] +> As of Windows 11, version 22H2, Windows Defender Credential Guard has been enabled by default on all devices which meet the minimum requirements as specified in the [Default Enablement](credential-guard-manage.md#default-enablement) section. For information about known issues related to default enablement, see [Credential Guard: Known Issues](credential-guard-known-issues.md#known-issue-single-sign-on-sso-for-network-services-breaks-after-upgrading-to-windows-11-version-22h2). +   ## Related topics From 3b01ef45ad357a74a5c5a78254473186112074e6 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:21:02 -0800 Subject: [PATCH 103/324] Added link to Known Issues --- .../credential-guard/credential-guard-manage.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 33cab5403d..f7d645071d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -26,7 +26,9 @@ ms.technology: itpro-security ## Default Enablement -Starting in **Windows 11 Enterprise, version 22H2** and **Windows 11 Education, version 22H2**, compatible systems have Windows Defender Credential Guard turned on by default. This feature changes the default state of the feature in Windows, though system administrators can still modify this enablement state. Windows Defender Credential Guard can still be manually [enabled](#enable-windows-defender-credential-guard) or [disabled](#disable-windows-defender-credential-guard) via the methods documented below. +Starting in **Windows 11 Enterprise, version 22H2** and **Windows 11 Education, version 22H2**, compatible systems have Windows Defender Credential Guard turned on by default. This feature changes the default state of the feature in Windows, though system administrators can still modify this enablement state. Windows Defender Credential Guard can still be manually [enabled](#enable-windows-defender-credential-guard) or [disabled](#disable-windows-defender-credential-guard) via the methods documented below. + +Known issues arising from default enablement are documented in [Windows Defender Credential Guard: Known issues](credential-guard-known-issues.md#known-issue-single-sign-on-sso-for-network-services-breaks-after-upgrading-to-windows-11-version-22h2). ### Requirements for automatic enablement From 7fe332cd9148e4206147aa2e3a37dfe793a80b1d Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:22:09 -0800 Subject: [PATCH 104/324] Updated feature owner --- .../credential-guard/credential-guard-scripts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index 8b39b99573..11caa36d86 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From a2c8a6d9426a267b9487daf128614b05b6144686 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:23:25 -0800 Subject: [PATCH 105/324] Updated feature owner --- .../credential-guard/credential-guard-protection-limits.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 6444af7ea5..ef9f6a2bce 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From d188996f9d0b74e2f86ee853d55088674bf9f34a Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:24:05 -0800 Subject: [PATCH 106/324] Updated feature owner --- .../credential-guard-not-protected-scenarios.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 5ff4d5dadc..0f780be28b 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -4,7 +4,7 @@ description: Scenarios not protected by Windows Defender Credential Guard in Win ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo -ms.author: paoloma +ms.author: zwhittington ms.reviewer: erikdau manager: aaroncz ms.collection: M365-identity-device-management @@ -644,4 +644,4 @@ write-host $tmp -Foreground Red **Deep Dive into Windows Defender Credential Guard: Related videos** -[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) \ No newline at end of file +[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) From b0908439e5864151bd969c2d9765636a28bb3026 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:25:03 -0800 Subject: [PATCH 107/324] Fixed mistake updating feature owner --- .../credential-guard-not-protected-scenarios.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 0f780be28b..51ecf3c661 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -4,8 +4,8 @@ description: Scenarios not protected by Windows Defender Credential Guard in Win ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo -ms.author: zwhittington -ms.reviewer: erikdau +ms.author: paoloma +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From 9da8123b5eceda801b7ff8aeedd3cde304d4be07 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:25:44 -0800 Subject: [PATCH 108/324] Updated feature owner --- .../credential-guard/credential-guard-how-it-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 55fe9628bb..48360ee775 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From 322dc1ed748302397ed21975237792565926501a Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:26:32 -0800 Subject: [PATCH 109/324] Updated feature owner --- .../credential-guard/credential-guard-considerations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 69d69300a1..b041c61076 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article @@ -97,4 +97,4 @@ When data protected with user DPAPI is unusable, then the user loses access to a **Related videos** -[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) \ No newline at end of file +[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) From ca0405658bd8c35c244506381b0a78b1d9edb2a7 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:27:29 -0800 Subject: [PATCH 110/324] Updated feature owner --- .../credential-guard/additional-mitigations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 92b3296a71..3fd8405edf 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article @@ -607,4 +607,4 @@ write-host $tmp -Foreground Red ``` > [!NOTE] -> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. \ No newline at end of file +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. From 8aa47d58c2c167fe21b942c17b9d1621fc472513 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Thu, 1 Dec 2022 08:04:19 -0800 Subject: [PATCH 111/324] Update windows-autopatch-wqu-all-devices-historical-report.md --- .../windows-autopatch-wqu-all-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md index aba6d03509..3808dd45a7 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md @@ -25,7 +25,7 @@ The historical All devices report provides a visual representation of the update :::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="All devices—historical report" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: -> [!TIP] +> [!NOTE] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. ## Report options From 5eb226ad1ba351b3c087f7a7aecdd6e05661e2ce Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 1 Dec 2022 13:12:22 -0800 Subject: [PATCH 112/324] minor edits --- windows/deployment/do/mcc-enterprise-appendix.md | 12 ++++++------ windows/deployment/do/mcc-isp-signup.md | 8 ++++---- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-appendix.md b/windows/deployment/do/mcc-enterprise-appendix.md index 400beb744f..ef710a3929 100644 --- a/windows/deployment/do/mcc-enterprise-appendix.md +++ b/windows/deployment/do/mcc-enterprise-appendix.md @@ -19,16 +19,16 @@ ms.topic: article ### Troubleshooting -If you're not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). - -Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). +If you're not able to sign up for a Microsoft Azure subscription with the **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** error, see the following articles: +- [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). +- [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). ## Installing on VMWare -We have seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMWare. To do so, there are a couple of additional configurations to be made: +We've seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMWare. To do so, there are a couple of additional configurations to be made: -1. Ensure that you are using ESX. In the VM settings, turn on the option **"Expose hardware assisted virtualization to the guest OS".** -1. Using the HyperV Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to "Yes". +1. Ensure that you're using ESX. In the VM settings, turn on the option **Expose hardware assisted virtualization to the guest OS**. +1. Using the HyperV Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to **Yes**. ## Diagnostics Script diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index d411757f8e..291a69a7ab 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -25,10 +25,10 @@ This article details the process of signing up for Microsoft Connected Cache for ## Prerequisites Before you begin sign up, ensure you have the following components: -1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a completely free-of-charge service hosted in Azure. You will need to have a Pay-As-You-Go subscription in order to onboard to our service. To create a subscription, [visit this page](https://azure.microsoft.com/en-us/offers/ms-azr-0003p/). -1. **Access to Azure portal**: Ensure you have the credentials needed to access your organization's Azure portal. -1. **Peering DB**: Ensure your organization's [Peering DB](https://www.peeringdb.com/) page is up-to-date and active. Check that the NOC email listed is accurate, and that you have access to this email. -1. **Server**: Ensure the server you wish to install Microsoft Connected Cache on is ready, and that the server is installed Ubuntu 20.04 LTS. +- **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a completely free-of-charge service hosted in Azure. You will need to have a Pay-As-You-Go subscription in order to onboard to our service. To create a subscription, [visit this page](https://azure.microsoft.com/offers/ms-azr-0003p/). +- **Access to Azure portal**: Ensure you have the credentials needed to access your organization's Azure portal. +- **Peering DB**: Ensure your organization's [Peering DB](https://www.peeringdb.com/) page is up-to-date and active. Check that the NOC email listed is accurate, and that you have access to this email. +- **Server**: Ensure the server you wish to install Microsoft Connected Cache on is ready, and that the server is installed Ubuntu 20.04 LTS. ## Resource creation and sign up process From c0b678f43a316f5718c481b2e14dbddbe2f03fee Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 1 Dec 2022 13:54:39 -0800 Subject: [PATCH 113/324] What's new article. --- windows/deployment/windows-autopatch/TOC.yml | 7 +- .../windows-autopatch-wqu-reports-overview.md | 4 +- .../windows-autopatch-whats-new-2022.md | 98 +++++++++++++++++++ 3 files changed, 106 insertions(+), 3 deletions(-) create mode 100644 windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index 5d31d988ca..5d1978ac7a 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -99,4 +99,9 @@ - name: Privacy href: references/windows-autopatch-privacy.md - name: Windows Autopatch preview addendum - href: references/windows-autopatch-preview-addendum.md \ No newline at end of file + href: references/windows-autopatch-preview-addendum.md + - name: What's new + href: + items: + - name: What's new 2022 + href: whats-new/windows-autopatch-whats-new-2022.md \ No newline at end of file diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md index 24dad31605..739953b809 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -64,8 +64,8 @@ Healthy devices are devices that meet all of the following prerequisites: | Sub status | Description | | ----- | ----- | -| Up to Date | Devices are up to date with the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | -| In Progress | Devices are currently installing the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | +| Up to Date | Devices are up to date with the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases). | +| In Progress | Devices are currently installing the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases). | | Paused | Devices that are currently paused due to a Windows Autopatch or customer-initiated Release Management pause. For more information, see [Pausing and resuming a release](../operate/windows-autopatch-wqu-overview.md#pausing-and-resuming-a-release). | ### Not Up to Date (Microsoft Action) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md new file mode 100644 index 0000000000..b4a98ff888 --- /dev/null +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md @@ -0,0 +1,98 @@ +--- +title: What's new +description: This article lists the new feature releases and any corresponding Message center post numbers. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: hathind +--- + +# What's new + +This article lists new and updated feature releases, and service releases, with their corresponding Message center post numbers (if applicable). + +Minor corrections such as typos, style, or formatting issues aren't listed. + +## December 2022 + +### December feature release + +| Article | Description | +| ----- | ----- | +| [What's new](../whats-new/windows-autopatch-whats-new-2022.md) | Added the What's new article | + +## November 2022 + +### November feature releases + +| Article | Description | +| ----- | ----- | +| [Privacy](../references/windows-autopatch-privacy.md) | Updated data center locations