diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index ecd7571ea7..f9ebdac192 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -129,20 +129,6 @@ "build_entry_point": "docs", "template_folder": "_themes" }, - { - "docset_name": "SV", - "build_source_folder": "windows/sv", - "build_output_subfolder": "SV", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, { "docset_name": "win-access-protection", "build_source_folder": "windows/access-protection", diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 4afc122348..8dbea776cc 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18919,6 +18919,11 @@ "source_path": "windows/security/threat-protection/device-control/device-control-report.md", "redirect_url": "/microsoft-365/security/defender-endpoint/device-control-report", "redirect_document_id": false - } + }, + { + "source_path": "windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md", + "redirect_url": "/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows", + "redirect_document_id": false + } ] } diff --git a/browsers/internet-explorer/TOC.yml b/browsers/internet-explorer/TOC.yml index 077879a18d..2c6602e1de 100644 --- a/browsers/internet-explorer/TOC.yml +++ b/browsers/internet-explorer/TOC.yml @@ -356,6 +356,6 @@ - name: KB Troubleshoot items: - name: Internet Explorer and Microsoft Edge FAQ for IT Pros - href: kb-support/ie-edge-faqs.md + href: kb-support/ie-edge-faqs.yml - name: Microsoft Edge and Internet Explorer troubleshooting href: /troubleshoot/browsers/welcome-browsers diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.md b/browsers/internet-explorer/kb-support/ie-edge-faqs.md deleted file mode 100644 index 3e2d6c100e..0000000000 --- a/browsers/internet-explorer/kb-support/ie-edge-faqs.md +++ /dev/null @@ -1,220 +0,0 @@ ---- -title: IE and Microsoft Edge FAQ for IT Pros -description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. -audience: ITPro -manager: msmets -author: ramakoni1 -ms.author: ramakoni -ms.reviewer: ramakoni, DEV_Triage -ms.prod: internet-explorer -ms.technology: -ms.topic: kb-support -ms.custom: CI=111020 -ms.localizationpriority: medium -ms.date: 01/23/2020 ---- -# Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros - -## Cookie-related questions - -### What is a cookie? - -An HTTP cookie (the web cookie or browser cookie) is a small piece of data that a server sends to the user's web browser. The web browser may store the cookie and return it to the server together with the next request. For example, a cookie might be used to indicate whether two requests come from the same browser in order to allow the user to remain logged-in. The cookie records stateful information for the stateless HTTP protocol. - -### How does Internet Explorer handle cookies? - -For more information about how Internet Explorer handles cookies, see the following articles: - -- [Beware Cookie Sharing in Cross-Zone Scenarios](/archive/blogs/ieinternals/beware-cookie-sharing-in-cross-zone-scenarios) -- [A Quick Look at P3P](/archive/blogs/ieinternals/a-quick-look-at-p3p) -- [Internet Explorer Cookie Internals FAQ](/archive/blogs/ieinternals/internet-explorer-cookie-internals-faq) -- [Privacy Beyond Blocking Cookies](/archive/blogs/ie/privacy-beyond-blocking-cookies-bringing-awareness-to-third-party-content) -- [Description of Cookies](https://support.microsoft.com/help/260971/description-of-cookies) - -### Where does Internet Explorer store cookies? - -To see where Internet Explorer stores its cookies, follow these steps: - -1. Start File Explorer. -2. Select **Views** \> **Change folder and search options**. -3. In the **Folder Options** dialog box, select **View**. -4. In **Advanced settings**, select **Do not show hidden files, folders, or drivers**. -5. Clear **Hide protected operation system files (Recommended)**. -6. Select **Apply**. -7. Select **OK**. - -The following are the folder locations where the cookies are stored: - -**In Windows 10** -C:\Users\username\AppData\Local\Microsoft\Windows\INetCache - -**In Windows 8 and Windows 8.1** -C:\Users\username\AppData\Local\Microsoft\Windows\INetCookies - -**In Windows 7** -C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies -C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies\Low - -### What is the per-domain cookie limit? - -Since the June 2018 cumulative updates for Internet Explorer and Microsoft Edge, the per-domain cookie limit is increased from 50 to 180 for both browsers. The cookies vary by path. So, if the same cookie is set for the same domain but for different paths, it's essentially a new cookie. - -There's still a 5 Kilobytes (KB) limit on the size of the cookie header that is sent out. This limit can cause some cookies to be lost after they exceed that value. - -The JavaScript limitation was updated to 10 KB from 4 KB. - -For more information, see [Internet Explorer Cookie Internals (FAQ)](/archive/blogs/ieinternals/internet-explorer-cookie-internals-faq). - -#### Additional information about cookie limits - -**What does the Cookie RFC allow?** -RFC 2109 defines how cookies should be implemented, and it defines minimum values that browsers support. According to the RFC, browsers would ideally have no limits on the size and number of cookies that a browser can handle. To meet the specifications, the user agent should support the following: - -- At least 300 cookies total -- At least 20 cookies per unique host or domain name - -For practicality, individual browser makers set a limit on the total number of cookies that any one domain or unique host can set. They also limit the total number of cookies that can be stored on a computer. - -### Cookie size limit per domain - -Some browsers also limit the amount of space that any one domain can use for cookies. This means that if your browser sets a limit of 4,096 bytes per domain for cookies, 4,096 bytes is the maximum available space in that domain even though you can set up to 180 cookies. - -## Proxy Auto Configuration (PAC)-related questions - -### Is an example Proxy Auto Configuration (PAC) file available? - -Here is a simple PAC file: - -```vb -function FindProxyForURL(url, host) -{ - return "PROXY proxyserver:portnumber"; -} -``` - -> [!NOTE] -> The previous PAC always returns the **proxyserver:portnumber** proxy. - -For more information about how to write a PAC file and about the different functions in a PAC file, see [the FindProxyForURL website](https://findproxyforurl.com/). - -**Third-party information disclaimer** -The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. - -### How to improve performance by using PAC scripts - -- [Browser is slow to respond when you use an automatic configuration script](https://support.microsoft.com/help/315810/browser-is-slow-to-respond-when-you-use-an-automatic-configuration-scr) -- [Optimizing performance with automatic Proxyconfiguration scripts (PAC)](https://blogs.msdn.microsoft.com/askie/2014/02/07/optimizing-performance-with-automatic-proxyconfiguration-scripts-pac/) - -## Other questions - -### How to set home and start pages in Microsoft Edge and allow user editing - -For more information, see the following blog article: - -[How do I set the home page in Microsoft Edge?](https://blogs.msdn.microsoft.com/askie/2017/10/04/how-do-i-set-the-home-page-in-edge/) - -### How to add sites to the Enterprise Mode (EMIE) site list - -For more information about how to add sites to an EMIE list, see [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](../ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md). - -### What is Content Security Policy (CSP)? - -By using [Content Security Policy](/microsoft-edge/dev-guide/security/content-security-policy), you create an allow list of sources of trusted content in the HTTP headers. You also pre-approve certain servers for content that is loaded into a webpage, and instruct the browser to execute or render only resources from those sources. You can use this technique to prevent malicious content from being injected into sites. - -Content Security Policy is supported in all versions of Microsoft Edge. It lets web developers lock down the resources that can be used by their web application. This helps prevent [cross-site scripting](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks that remain a common vulnerability on the web. However, the first version of Content Security Policy was difficult to implement on websites that used inline script elements that either pointed to script sources or contained script directly. - -CSP2 makes these scenarios easier to manage by adding support for nonces and hashes for script and style resources. A nonce is a cryptographically strong random value that is generated on each page load that appears in both the CSP policy and in the script tags on the page. Using nonces can help minimize the need to maintain a list of allowed source URL values while also allowing trusted scripts that are declared in script elements to run. - -For more information, see the following articles: - -- [Introducing support for Content Security Policy Level 2](https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/) -- [Content Security Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) - -### Where to find Internet Explorer security zones registry entries - -Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users). - -This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11. - -The default Zone Keys are stored in the following locations: - -- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones -- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones - -### Why don't HTML5 videos play in Internet Explorer 11? - -To play HTML5 videos in the Internet Zone, use the default settings or make sure that the registry key value of **2701** under **Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3** is set to **0**. - -- 0 (the default value): Allow -- 3: Disallow - -This key is read by the **URLACTION\_ALLOW\_AUDIO\_VIDEO 0x00002701** URL action flag that determines whether media elements (audio and video) are allowed in pages in a URL security zone. - -For more information, see [Unable to play HTML5 Videos in IE](/archive/blogs/askie/unable-to-play-html5-videos-in-ie). - -For Windows 10 N and Windows KN editions, you must also download the feature pack that is discussed in [Media feature pack for Windows 10 N and Windows 10 KN editions](https://support.microsoft.com/help/3010081/media-feature-pack-for-windows-10-n-and-windows-10-kn-editions). - -For more information about how to check Windows versions, see [Which version of Windows operating system am I running?](https://support.microsoft.com/help/13443/windows-which-version-am-i-running) - -### What is the Enterprise Mode Site List Portal? - -This is a new feature to add sites to your enterprise mode site list XML. For more information, see [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). - -### What is Enterprise Mode Feature? - -For more information about this topic, see [Enterprise Mode and the Enterprise Mode Site List](../ie11-deploy-guide/what-is-enterprise-mode.md). - -### Where can I obtain a list of HTTP Status codes? - -For information about this list, see [HTTP Status Codes](/windows/win32/winhttp/http-status-codes). - -### What is end of support for Internet Explorer 11? - -Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed. - -For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer). - -### How to configure TLS (SSL) for Internet Explorer - -For more information about how to configure TLS/SSL for Internet Explorer, see [Group Policy Setting to configure TLS/SSL](https://gpsearch.azurewebsites.net/#380). - -### What is Site to Zone? - -Site to Zone usually refers to one of the following: - -**Site to Zone Assignment List** -This is a Group Policy policy setting that can be used to add sites to the various security zones. - -The Site to Zone Assignment List policy setting associates sites to zones by using the following values for the Internet security zones: - -- Intranet zone -- Trusted Sites zone -- Internet zone -- Restricted Sites zone - -If you set this policy setting to **Enabled**, you can enter a list of sites and their related zone numbers. By associating a site to a zone, you can make sure that the security settings for the specified zone are applied to the site. - -**Site to Zone Mapping** -Site to Zone Mapping is stored as the name of the key. The protocol is a registry value that has a number that assigns it to the corresponding zone. Internet Explorer will read from the following registry subkeys for the sites that are deployed through the Site to Zone assignment list: - -- HKEY\_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap -- HKEY\_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey - -**Site to Zone Assignment List policy** -This policy setting is available for both Computer Configuration and User Configuration: - -- Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page -- User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page - -**References** -[How to configure Internet Explorer security zone sites using group polices](/archive/blogs/askie/how-to-configure-internet-explorer-security-zone-sites-using-group-polices) - -### What are the limits for MaxConnectionsPerServer, MaxConnectionsPer1_0Server for the current versions of Internet Explorer? - -For more information about these settings and limits, see [Connectivity Enhancements in Windows Internet Explorer 8](/previous-versions/cc304129(v=vs.85)). - -### What is the MaxConnectionsPerProxy setting, and what are the maximum allowed values for this setting? - -The **MaxConnectionsPerProxy** setting controls the number of connections that a single-user client can maintain to a given host by using a proxy server. - -For more information, see [Understanding Connection Limits and New Proxy Connection Limits in WinInet and Internet Explorer](/archive/blogs/jpsanders/understanding-connection-limits-and-new-proxy-connection-limits-in-wininet-and-internet-explorer). \ No newline at end of file diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.yml b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml new file mode 100644 index 0000000000..50862d688d --- /dev/null +++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.yml @@ -0,0 +1,245 @@ +### YamlMime:FAQ +metadata: + title: IE and Microsoft Edge FAQ for IT Pros + description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals. + audience: ITPro + manager: msmets + author: ramakoni1 + ms.author: ramakoni + ms.reviewer: ramakoni, DEV_Triage + ms.prod: internet-explorer + ms.technology: + ms.topic: kb-support + ms.custom: CI=111020 + ms.localizationpriority: medium + ms.date: 01/23/2020 + +title: Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros +summary: | + +sections: + - name: Cookie-related questions + questions: + - question: | + What is a cookie? + answer: | + An HTTP cookie (the web cookie or browser cookie) is a small piece of data that a server sends to the user's web browser. The web browser may store the cookie and return it to the server together with the next request. For example, a cookie might be used to indicate whether two requests come from the same browser in order to allow the user to remain logged-in. The cookie records stateful information for the stateless HTTP protocol. + + - question: | + How does Internet Explorer handle cookies? + answer: | + For more information about how Internet Explorer handles cookies, see the following articles: + + - [Beware Cookie Sharing in Cross-Zone Scenarios](/archive/blogs/ieinternals/beware-cookie-sharing-in-cross-zone-scenarios) + - [A Quick Look at P3P](/archive/blogs/ieinternals/a-quick-look-at-p3p) + - [Internet Explorer Cookie Internals FAQ](/archive/blogs/ieinternals/internet-explorer-cookie-internals-faq) + - [Privacy Beyond Blocking Cookies](/archive/blogs/ie/privacy-beyond-blocking-cookies-bringing-awareness-to-third-party-content) + - [Description of Cookies](https://support.microsoft.com/help/260971/description-of-cookies) + + - question: | + Where does Internet Explorer store cookies? + answer: | + To see where Internet Explorer stores its cookies, follow these steps: + + 1. Start File Explorer. + 2. Select **Views** \> **Change folder and search options**. + 3. In the **Folder Options** dialog box, select **View**. + 4. In **Advanced settings**, select **Do not show hidden files, folders, or drivers**. + 5. Clear **Hide protected operation system files (Recommended)**. + 6. Select **Apply**. + 7. Select **OK**. + + The following are the folder locations where the cookies are stored: + + **In Windows 10** + C:\Users\username\AppData\Local\Microsoft\Windows\INetCache + + **In Windows 8 and Windows 8.1** + C:\Users\username\AppData\Local\Microsoft\Windows\INetCookies + + **In Windows 7** + C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies + C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies\Low + + - question: | + What is the per-domain cookie limit? + answer: | + Since the June 2018 cumulative updates for Internet Explorer and Microsoft Edge, the per-domain cookie limit is increased from 50 to 180 for both browsers. The cookies vary by path. So, if the same cookie is set for the same domain but for different paths, it's essentially a new cookie. + + There's still a 5 Kilobytes (KB) limit on the size of the cookie header that is sent out. This limit can cause some cookies to be lost after they exceed that value. + + The JavaScript limitation was updated to 10 KB from 4 KB. + + For more information, see [Internet Explorer Cookie Internals (FAQ)](/archive/blogs/ieinternals/internet-explorer-cookie-internals-faq). + + - name: Additional information about cookie limits + questions: + - question: | + What does the Cookie RFC allow? + answer: | + RFC 2109 defines how cookies should be implemented, and it defines minimum values that browsers support. According to the RFC, browsers would ideally have no limits on the size and number of cookies that a browser can handle. To meet the specifications, the user agent should support the following: + + - At least 300 cookies total + - At least 20 cookies per unique host or domain name + + For practicality, individual browser makers set a limit on the total number of cookies that any one domain or unique host can set. They also limit the total number of cookies that can be stored on a computer. + + - question: | + Cookie size limit per domain + answer: | + Some browsers also limit the amount of space that any one domain can use for cookies. This means that if your browser sets a limit of 4,096 bytes per domain for cookies, 4,096 bytes is the maximum available space in that domain even though you can set up to 180 cookies. + + - name: Proxy Auto Configuration (PAC)-related questions + questions: + - question: | + Is an example Proxy Auto Configuration (PAC) file available? + answer: | + Here is a simple PAC file: + + ```vb + function FindProxyForURL(url, host) + { + return "PROXY proxyserver:portnumber"; + } + ``` + + > [!NOTE] + > The previous PAC always returns the **proxyserver:portnumber** proxy. + + For more information about how to write a PAC file and about the different functions in a PAC file, see [the FindProxyForURL website](https://findproxyforurl.com/). + + **Third-party information disclaimer** + The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. + + - question: | + How to improve performance by using PAC scripts + answer: | + - [Browser is slow to respond when you use an automatic configuration script](https://support.microsoft.com/en-us/topic/effa1aa0-8e95-543d-6606-03ac68e3f490) + - [Optimizing performance with automatic Proxyconfiguration scripts (PAC)](/troubleshoot/browsers/optimize-pac-performance) + + - name: Other questions + questions: + - question: | + How to set home and start pages in Microsoft Edge and allow user editing + answer: | + For more information, see the following blog article: + + [How do I set the home page in Microsoft Edge?](https://support.microsoft.com/en-us/microsoft-edge/change-your-browser-home-page-a531e1b8-ed54-d057-0262-cc5983a065c6) + + - question: | + How to add sites to the Enterprise Mode (EMIE) site list + answer: | + For more information about how to add sites to an EMIE list, see [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](../ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md). + + - question: | + What is Content Security Policy (CSP)? + answer: | + By using [Content Security Policy](/microsoft-edge/dev-guide/security/content-security-policy), you create an allow list of sources of trusted content in the HTTP headers. You also pre-approve certain servers for content that is loaded into a webpage, and instruct the browser to execute or render only resources from those sources. You can use this technique to prevent malicious content from being injected into sites. + + Content Security Policy is supported in all versions of Microsoft Edge. It lets web developers lock down the resources that can be used by their web application. This helps prevent [cross-site scripting](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks that remain a common vulnerability on the web. However, the first version of Content Security Policy was difficult to implement on websites that used inline script elements that either pointed to script sources or contained script directly. + + CSP2 makes these scenarios easier to manage by adding support for nonces and hashes for script and style resources. A nonce is a cryptographically strong random value that is generated on each page load that appears in both the CSP policy and in the script tags on the page. Using nonces can help minimize the need to maintain a list of allowed source URL values while also allowing trusted scripts that are declared in script elements to run. + + For more information, see the following articles: + + - [Introducing support for Content Security Policy Level 2](https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/) + - [Content Security Policy](https://en.wikipedia.org/wiki/Content_Security_Policy) + + - question: | + Where to find Internet Explorer security zones registry entries + answer: | + Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users). + + This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11. + + The default Zone Keys are stored in the following locations: + + - HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones + - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones + + - question: | + Why don't HTML5 videos play in Internet Explorer 11? + answer: | + To play HTML5 videos in the Internet Zone, use the default settings or make sure that the registry key value of **2701** under **Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3** is set to **0**. + + - 0 (the default value): Allow + - 3: Disallow + + This key is read by the **URLACTION\_ALLOW\_AUDIO\_VIDEO 0x00002701** URL action flag that determines whether media elements (audio and video) are allowed in pages in a URL security zone. + + For more information, see [Unable to play HTML5 Videos in IE](/archive/blogs/askie/unable-to-play-html5-videos-in-ie). + + For Windows 10 N and Windows KN editions, you must also download the feature pack that is discussed in [Media feature pack for Windows 10 N and Windows 10 KN editions](https://support.microsoft.com/help/3010081/media-feature-pack-for-windows-10-n-and-windows-10-kn-editions). + + For more information about how to check Windows versions, see [Which version of Windows operating system am I running?](https://support.microsoft.com/help/13443/windows-which-version-am-i-running) + + - question: | + What is the Enterprise Mode Site List Portal? + answer: | + This is a new feature to add sites to your enterprise mode site list XML. For more information, see [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal). + + - question: | + What is Enterprise Mode Feature? + answer: | + For more information about this topic, see [Enterprise Mode and the Enterprise Mode Site List](../ie11-deploy-guide/what-is-enterprise-mode.md). + + - question: | + Where can I obtain a list of HTTP Status codes? + answer: | + For information about this list, see [HTTP Status Codes](/windows/win32/winhttp/http-status-codes). + + - question: | + What is end of support for Internet Explorer 11? + answer: | + Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed. + + For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer). + + - question: | + How to configure TLS (SSL) for Internet Explorer + answer: | + For more information about how to configure TLS/SSL for Internet Explorer, see [Group Policy Setting to configure TLS/SSL](https://gpsearch.azurewebsites.net/#380). + + - question: | + What is Site to Zone? + answer: | + Site to Zone usually refers to one of the following: + + **Site to Zone Assignment List** + This is a Group Policy policy setting that can be used to add sites to the various security zones. + + The Site to Zone Assignment List policy setting associates sites to zones by using the following values for the Internet security zones: + + - Intranet zone + - Trusted Sites zone + - Internet zone + - Restricted Sites zone + + If you set this policy setting to **Enabled**, you can enter a list of sites and their related zone numbers. By associating a site to a zone, you can make sure that the security settings for the specified zone are applied to the site. + + **Site to Zone Mapping** + Site to Zone Mapping is stored as the name of the key. The protocol is a registry value that has a number that assigns it to the corresponding zone. Internet Explorer will read from the following registry subkeys for the sites that are deployed through the Site to Zone assignment list: + + - HKEY\_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap + - HKEY\_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey + + **Site to Zone Assignment List policy** + This policy setting is available for both Computer Configuration and User Configuration: + + - Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page + - User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page + + **References** + [How to configure Internet Explorer security zone sites using group polices](/archive/blogs/askie/how-to-configure-internet-explorer-security-zone-sites-using-group-polices) + + - question: | + What are the limits for MaxConnectionsPerServer, MaxConnectionsPer1_0Server for the current versions of Internet Explorer? + answer: | + For more information about these settings and limits, see [Connectivity Enhancements in Windows Internet Explorer 8](/previous-versions/cc304129(v=vs.85)). + + - question: | + What is the MaxConnectionsPerProxy setting, and what are the maximum allowed values for this setting? + answer: | + The **MaxConnectionsPerProxy** setting controls the number of connections that a single-user client can maintain to a given host by using a proxy server. + + For more information, see [Understanding Connection Limits and New Proxy Connection Limits in WinInet and Internet Explorer](/archive/blogs/jpsanders/understanding-connection-limits-and-new-proxy-connection-limits-in-wininet-and-internet-explorer). diff --git a/store-for-business/add-unsigned-app-to-code-integrity-policy.md b/store-for-business/add-unsigned-app-to-code-integrity-policy.md index b269d9356a..454b74a767 100644 --- a/store-for-business/add-unsigned-app-to-code-integrity-policy.md +++ b/store-for-business/add-unsigned-app-to-code-integrity-policy.md @@ -18,12 +18,12 @@ ms.date: 03/10/2021 # Add unsigned app to code integrity policy > [!IMPORTANT] -> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until June 9, 2021 to transition to DGSS v2. On June 9, 2021, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by June 9, 2021. > > Following are the major changes we are making to the service: > - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. > - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). -> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired, you will no longer be able to download the leaf certificates used to sign your files. > > The following functionality will be available via these PowerShell cmdlets: > - Get a CI policy @@ -117,4 +117,4 @@ Catalog signing is a vital step to adding your unsigned apps to your code integr When you use the Device Guard signing portal to sign a catalog file, the signing certificate is added to the default policy. When you download the signed catalog file, you should also download the default policy and merge this code integrity policy with your existing code integrity policies to protect machines running the catalog file. You need to do this step to trust and run your catalog files. For more information, see the Merging code integrity policies in the [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). 6. Open the root certificate that you downloaded, and follow the steps in **Certificate Import wizard** to install the certificate in your machine's certificate store. -7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with Microsoft Endpoint Manager in the [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). \ No newline at end of file +7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with Microsoft Endpoint Manager in the [Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). diff --git a/store-for-business/device-guard-signing-portal.md b/store-for-business/device-guard-signing-portal.md index 19b24783d0..6ad01e0f88 100644 --- a/store-for-business/device-guard-signing-portal.md +++ b/store-for-business/device-guard-signing-portal.md @@ -18,12 +18,12 @@ ms.date: 10/17/2017 # Device Guard signing > [!IMPORTANT] -> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until June 9, 2021 to transition to DGSS v2. On June 9, 2021, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by June 9, 2021. > > Following are the major changes we are making to the service: > - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. > - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). -> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired, you will no longer be able to download the leaf certificates used to sign your files. > > The following functionality will be available via these PowerShell cmdlets: > - Get a CI policy @@ -32,7 +32,7 @@ ms.date: 10/17/2017 > - Download root cert > - Download history of your signing operations > -> For any questions, please contact us at DGSSMigration@microsoft.com. +> For any questions, please contact us at DGSSMigration@microsoft.com. **Applies to** @@ -72,4 +72,4 @@ Catalog and policy files have required files types. Signing code integrity policies and access to Device Guard portal requires the Device Guard signer role. ## Device Guard signing certificates -All certificates generated by the Device Guard signing service are unique per customer and are independent of the Microsoft production code signing certificate authorities. All Certification Authority (CA) keys are stored within the cryptographic boundary of Federal Information Processing Standards (FIPS) publication 140-2 compliant hardware security modules. After initial generation, root certificate keys and top level CA keys are removed from the online signing service, encrypted, and stored offline. \ No newline at end of file +All certificates generated by the Device Guard signing service are unique per customer and are independent of the Microsoft production code signing certificate authorities. All Certification Authority (CA) keys are stored within the cryptographic boundary of Federal Information Processing Standards (FIPS) publication 140-2 compliant hardware security modules. After initial generation, root certificate keys and top level CA keys are removed from the online signing service, encrypted, and stored offline. diff --git a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md index ef38349ddd..ffdff3f7c1 100644 --- a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md +++ b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md @@ -18,12 +18,12 @@ ms.date: 10/17/2017 # Sign code integrity policy with Device Guard signing > [!IMPORTANT] -> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until the end of December 2020 to transition to DGSS v2. At the end of December 2020, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by the end of December 2020. +> We are introducing a new version of the Device Guard Signing Service (DGSS) to be more automation friendly. The new version of the service (DGSS v2) is now available. As announced earlier, you will have until June 9, 2021 to transition to DGSS v2. On June 9, 2021, the existing web-based mechanisms for the current version of the DGSS service will be retired and will no longer be available for use. Please make plans to migrate to the new version of the service by June 9, 2021. > > Following are the major changes we are making to the service: > - The method for consuming the service will change to a more automation-friendly method based on PowerShell cmdlets. These cmdlets are available as a NuGet download, https://www.nuget.org/packages/Microsoft.Acs.Dgss.Client/. > - In order to achieve desired isolation, you will be required to get a new CI policy from DGSS v2 (and optionally sign it). -> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired at the end of December 2020, you will no longer be able to download the leaf certificates used to sign your files. +> - DGSS v2 will not have support for downloading leaf certificates used to sign your files (however, the root certificate will still be available to download). Note that the certificate used to sign a file can be easily extracted from the signed file itself. As a result, after DGSS v1 is retired, you will no longer be able to download the leaf certificates used to sign your files. > > The following functionality will be available via these PowerShell cmdlets: > - Get a CI policy @@ -58,4 +58,4 @@ Before you get started, be sure to review these best practices: 4. After the files are uploaded, click **Sign** to sign the code integrity policy. 5. Click **Download** to download the signed code integrity policy. - When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then resign the policy. \ No newline at end of file + When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then resign the policy. diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index dc786fd289..d3a95df0d0 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -5,7 +5,7 @@ summary: Learn about managing applications in Windows client, including how to r metadata: title: Windows application management # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about managing applications in Windows 10 and Windows Sun Valley. # Required; article description that is displayed in search results. < 160 chars. + description: Learn about managing applications in Windows 10 and Windows 11. # Required; article description that is displayed in search results. < 160 chars. services: windows-10 ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. ms.subservice: subservice diff --git a/windows/client-management/mdm/Language-pack-management-csp.md b/windows/client-management/mdm/Language-pack-management-csp.md new file mode 100644 index 0000000000..0a1e9f72a4 --- /dev/null +++ b/windows/client-management/mdm/Language-pack-management-csp.md @@ -0,0 +1,53 @@ +--- +title: Language Pack Management CSP +description: Language Pack Management CSP allows a direct way to provision language packs remotely in Windows 10. +ms.reviewer: +manager: dansimp +ms.author: v-nsatapathy +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: nimishasatapathy +ms.date: 06/22/2021 +--- + +# Language Pack Management CSP + + +The Language Pack Management CSP allows a direct way to provision language packs remotely in Windows 10 and Windows 10 X. A separate CSP exists to allow provisioning of "optional FODs" (Handwriting recognition, Text-to-speech, and so on) associated with a language. MDMs like Intune can use management commands remotely to devices to configure language related settings. + +1. Enumerate installed languages with GET command on the "InstalledLanguages" node + + **GET./Device/Vendor/MSFT/LanguagePackManagement/InstalledLanguages** + **GET./Device/Vendor/MSFT/LanguagePackManagement/InstalledLanguages/zh-CN/Providers** + **GET./Device/Vendor/MSFT/LanguagePackManagement/InstalledLanguages/ja-JP/Providers** + + The nodes under **InstalledLanguages** are the language tags of the installed languages. The **providers** node under language tag is the bit map representation of either "language pack (feature)" or [LXPs](https://www.microsoft.com/store/collections/localexperiencepacks?cat0=devices&rtc=1). + - Indicates the language pack installed is a System Language Pack (non-LXP) + - Indicates that the LXP is installed. + - Indicates that both are installed. + +2. Install language pack features with the EXECUTE command on the **StartInstall** node of the language. For example, + + **ADD./Device/Vendor/MSFT/LanguagePackManagement/Install/fr-FR/** + **EXECUTE./Device/Vendor/MSFT/LanguagePackManagement/Install/fr-FR/StartInstallation** + + The installation is an asynchronous operation. You can query the **Status** node by using the following commands: + + **GET./Device/Vendor/MSFT/LanguagePackManagement/Install/fr-FR/Status** + **GET./Device/Vendor/MSFT/LanguagePackManagement/Install/fr-FR/ErrorCode** + + Status: 0 – not started; 1 – in process; 2 – succeeded; 3 – failed. ErrorCode is a HRESULT that could help diagnosis if the installation failed. + + > [!NOTE] + > If IT admin has NOT set the policy of blocking cleanup of unused language packs, this command will fail. + +3. Delete installed Language with the DELETE command on the installed language tag. The delete command is a fire and forget operation. The deletion will run in background. IT admin can query the installed language later and resend the command if needed. + + + **DELETE./Device/Vendor/MSFT/LanguagePackManagement/InstalledLanguages/zh-CN(Delete command)** + +4. Get/Set System Preferred UI Language with GET or REPLACE command on the "SystemPreferredUILanguages" Node + + + **./Device/Vendor/MSFT/LanguagePackManagement/LanguageSettings/SystemPreferredUILanguages** diff --git a/windows/client-management/mdm/certificate-authentication-device-enrollment.md b/windows/client-management/mdm/certificate-authentication-device-enrollment.md index f01490c427..1d2eebc12f 100644 --- a/windows/client-management/mdm/certificate-authentication-device-enrollment.md +++ b/windows/client-management/mdm/certificate-authentication-device-enrollment.md @@ -14,7 +14,7 @@ ms.date: 06/26/2017 # Certificate authentication device enrollment -This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2]( https://go.microsoft.com/fwlink/p/?LinkId=619347). +This section provides an example of the mobile device enrollment protocol using certificate authentication policy. For details about the Microsoft mobile device enrollment protocol for Windows 10, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://go.microsoft.com/fwlink/p/?LinkId=619347). > [!Note] > To set up devices to use certificate authentication for enrollment, you should create a provisioning package. For more information about provisioning packages, see [Build and apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-create-package). @@ -31,7 +31,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The following example shows the discovery service request. -``` syntax +```xml POST /EnrollmentServer/Discovery.svc HTTP/1.1 Content-Type: application/soap+xml; charset=utf-8 User-Agent: Windows Enrollment Client @@ -60,7 +60,7 @@ Cache-Control: no-cache user@contoso.com 101 10.0.0.0 - 3.0 + 3.0 10.0.0.0 Certificate @@ -71,7 +71,7 @@ Cache-Control: no-cache The following example shows the discovery service response. -``` +```xml HTTP/1.1 200 OK Content-Length: 865 Content-Type: application/soap+xml; charset=utf-8 @@ -111,7 +111,7 @@ http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoverySer The following example shows the policy web service request. -``` +```xml POST /ENROLLMENTSERVER/DEVICEENROLLMENTWEBSERVICE.SVC HTTP/1.1 Content-Type: application/soap+xml; charset=utf-8 User-Agent: Windows Enrollment Client @@ -183,7 +183,7 @@ Cache-Control: no-cache The following snippet shows the policy web service response. -``` +```xml HTTP/1.1 200 OK Date: Fri, 03 Aug 2012 20:00:00 GMT Server: @@ -261,7 +261,7 @@ Content-Length: xxxx The following example shows the enrollment web service request. -``` +```xml POST /EnrollmentServer/DeviceEnrollmentWebService.svc HTTP/1.1 Content-Type: application/soap+xml; charset=utf-8 User-Agent: Windows Enrollment Client @@ -369,7 +369,7 @@ http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrol The following example shows the enrollment web service response. -``` +```xml HTTP/1.1 200 OK Cache-Control: private Content-Length: 10231 @@ -422,7 +422,7 @@ Date: Fri, 03 Aug 2012 00:32:59 GMT The following example shows the encoded provisioning XML. -``` +```xml diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 90f132759c..4f9dd3d9da 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -71,7 +71,7 @@ Additional lists: cross mark check mark4 - cross mark + check mark4 check mark4 check mark4 cross mark @@ -97,7 +97,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -123,7 +123,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark cross mark @@ -149,7 +149,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -201,7 +201,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -227,7 +227,7 @@ Additional lists: cross mark check mark3 - + check mark check mark check mark cross mark @@ -253,7 +253,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -305,7 +305,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark cross mark @@ -331,7 +331,7 @@ Additional lists: check mark3 check mark3 - + check mark3 check mark3 check mark3 check mark @@ -358,7 +358,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark1 @@ -384,7 +384,7 @@ Additional lists: check mark2 check mark2 - + check mark2 check mark2 check mark2 check mark @@ -410,7 +410,7 @@ Additional lists: check mark3 check mark3 - + check mark3 check mark3 check mark3 check mark @@ -436,7 +436,7 @@ Additional lists: check mark2 check mark2 - + check mark2 check mark2 check mark2 check mark @@ -462,7 +462,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -514,7 +514,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -540,7 +540,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark cross mark @@ -566,7 +566,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -592,7 +592,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -618,7 +618,7 @@ Additional lists: check mark check mark - + check mark check mark check mark cross mark @@ -644,7 +644,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -670,7 +670,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -722,7 +722,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -748,7 +748,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -774,7 +774,6 @@ Additional lists: check mark check mark - check mark check mark check mark @@ -802,7 +801,6 @@ Additional lists: check mark check mark - check mark check mark check mark @@ -829,7 +827,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -882,7 +880,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -934,7 +932,7 @@ Additional lists: check mark2 check mark2 - + check mark2 check mark2 check mark2 check mark @@ -960,7 +958,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1012,7 +1010,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1037,9 +1035,9 @@ Additional lists: check mark -Only for mobile application management (MAM) +Only for mobile application management (MAM) + check mark check mark - check mark check mark check mark @@ -1065,10 +1063,9 @@ Additional lists: cross mark check mark - check mark check mark - cross mark + check mark cross mark @@ -1092,7 +1089,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1118,7 +1115,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1144,7 +1141,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1168,7 +1165,7 @@ Additional lists: Mobile - + cross mark check mark3 check mark3 check mark3 @@ -1196,10 +1193,10 @@ Additional lists: cross mark cross mark - cross mark cross mark - check mark (Provisioning only) + cross mark + check markB @@ -1248,7 +1245,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1274,7 +1271,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1284,6 +1281,33 @@ Additional lists: + +[LanguagePackManagement CSP](language-pack-management-csp.md) + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
check markcheck markcross markcheck markcheck markcross markcross mark
+ + + [Maps CSP](maps-csp.md) @@ -1300,7 +1324,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1378,7 +1402,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -1404,7 +1428,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -1482,7 +1506,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1534,7 +1558,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1560,7 +1584,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -1586,7 +1610,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1638,7 +1662,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1664,7 +1688,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1688,12 +1712,12 @@ Additional lists: Mobile - check mark (Provisioning only) - check mark (Provisioning only) - - check mark (Provisioning only) - check mark (Provisioning only) - check mark (Provisioning only) + check markB + check markB + check markB + check markB + check markB + check markB @@ -1716,7 +1740,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -1742,7 +1766,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1768,7 +1792,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -1794,7 +1818,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1820,7 +1844,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -1846,7 +1870,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1872,7 +1896,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1898,7 +1922,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -1924,7 +1948,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -1950,7 +1974,7 @@ Additional lists: cross mark check mark1 - + check mark1 check mark1 check mark1 cross mark @@ -1976,7 +2000,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -2002,7 +2026,7 @@ Additional lists: cross mark check mark1 - + check mark1 check mark1 check mark1 cross mark @@ -2028,7 +2052,7 @@ Additional lists: cross mark check mark - + check mark check mark check mark check mark @@ -2159,7 +2183,7 @@ Additional lists: cross mark cross mark - + check mark check mark check mark cross mark @@ -2185,7 +2209,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -2211,7 +2235,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -2237,7 +2261,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -2290,7 +2314,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -2316,7 +2340,7 @@ Additional lists: cross mark check mark1 - + check mark1 check mark1 check mark1 cross mark @@ -2368,7 +2392,7 @@ Additional lists: cross mark check mark1 - + check mark1 check mark1 check mark1 cross mark @@ -2421,7 +2445,7 @@ Additional lists: check mark check mark - + check mark check mark check mark check mark @@ -2447,7 +2471,7 @@ Additional lists: cross mark cross mark - + cross mark cross mark cross mark check mark @@ -2503,7 +2527,6 @@ Additional lists: check mark - @@ -2555,7 +2578,7 @@ The following list shows the CSPs supported in HoloLens devices: [PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | | [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | | [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | | [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | @@ -2627,6 +2650,8 @@ The following list shows the CSPs supported in HoloLens devices:
Footnotes: +- A - Only for mobile application management (MAM). +- B - Provisioning only. - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. @@ -2636,4 +2661,5 @@ The following list shows the CSPs supported in HoloLens devices: - 7 - Added in Windows 10, version 1909. - 8 - Added in Windows 10, version 2004. - 9 - Added in Windows 10 Team 2020 Update -- 10 - Added in [Windows Holographic, version 20H2](/hololens/hololens-release-notes#windows-holographic-version-20h2) \ No newline at end of file +- 10 - Added in [Windows Holographic, version 20H2](/hololens/hololens-release-notes#windows-holographic-version-20h2) + diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index fbdd7913a0..97561119e4 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -8,9 +8,9 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman +author: dansimp ms.localizationpriority: medium -ms.date: 08/11/2020 +ms.date: 06/23/2021 --- # Defender CSP @@ -56,9 +56,12 @@ Defender --------TamperProtectionEnabled (Added in Windows 10, version 1903) --------IsVirtualMachine (Added in Windows 10, version 1903) ----Configuration (Added in Windows 10, version 1903) ---------TamperProetection (Added in Windows 10, version 1903) ---------EnableFileHashcomputation (Added in Windows 10, version 1903) +--------TamperProtection (Added in Windows 10, version 1903) +--------EnableFileHashComputation (Added in Windows 10, version 1903) --------SupportLogLocation (Added in the next major release of Windows 10) +--------PlatformUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) +--------EngineUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) +--------SignaturesUpdatesChannel (Added with the 4.18.2106.5 Defender platform release) ----Scan ----UpdateSignature ----OfflineScan (Added in Windows 10 version 1803) @@ -94,11 +97,11 @@ The data type is integer. The following list shows the supported values: -- 0 = Unknown -- 1 = Low -- 2 = Moderate -- 4 = High -- 5 = Severe +- 0 = Unknown +- 1 = Low +- 2 = Moderate +- 4 = High +- 5 = Severe Supported operation is Get. @@ -171,17 +174,17 @@ The data type is integer. The following list shows the supported values: -- 0 = Active -- 1 = Action failed -- 2 = Manual steps required -- 3 = Full scan required -- 4 = Reboot required -- 5 = Remediated with noncritical failures -- 6 = Quarantined -- 7 = Removed -- 8 = Cleaned -- 9 = Allowed -- 10 = No Status ( Cleared) +- 0 = Active +- 1 = Action failed +- 2 = Manual steps required +- 3 = Full scan required +- 4 = Reboot required +- 5 = Remediated with noncritical failures +- 6 = Quarantined +- 7 = Removed +- 8 = Cleaned +- 9 = Allowed +- 10 = No Status ( Cleared) Supported operation is Get. @@ -491,7 +494,7 @@ Supported operations are Add, Delete, Get, Replace. **Configuration/EnableFileHashComputation** Enables or disables file hash computation feature. -When this feature is enabled Windows defender will compute hashes for files it scans. +When this feature is enabled Windows Defender will compute hashes for files it scans. The data type is integer. @@ -518,9 +521,75 @@ When enabled or disabled exists on the client and admin moves the setting to not More details: -- [Microsoft Defender AV diagnostic data](/microsoft-365/security/defender-endpoint/collect-diagnostic-data) +- [Microsoft Defender Antivirus diagnostic data](/microsoft-365/security/defender-endpoint/collect-diagnostic-data) - [Collect investigation package from devices](/microsoft-365/security/defender-endpoint/respond-machine-alerts#collect-investigation-package-from-devices) +**Configuration/PlatformUpdatesChannel** + +Enable this policy to specify when devices receive Microsoft Defender platform updates during the monthly gradual rollout. + +Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. + +Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. + +Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). + +Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + +If you disable or do not configure this policy, the device will stay up to date automatically during the gradual release cycle. Suitable for most devices. + +The data type is integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +- 0: Not configured (Default) +- 1: Beta Channel - Prerelease +- 2: Current Channel (Preview) +- 3: Current Channel (Staged) +- 4: Current Channel (Broad) + +**Configuration/EngineUpdatesChannel** + +Enable this policy to specify when devices receive Microsoft Defender engine updates during the monthly gradual rollout. + +Beta Channel: Devices set to this channel will be the first to receive new updates. Select Beta Channel to participate in identifying and reporting issues to Microsoft. Devices in the Windows Insider Program are subscribed to this channel by default. For use in (manual) test environments only and a limited number of devices. + +Current Channel (Preview): Devices set to this channel will be offered updates earliest during the monthly gradual release cycle. Suggested for pre-production/validation environments. + +Current Channel (Staged): Devices will be offered updates after the monthly gradual release cycle. Suggested to apply to a small, representative part of your production population (~10%). + +Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + +If you disable or do not configure this policy, the device will stay up to date automatically during the gradual release cycle. Suitable for most devices. + +The data type is integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +- 0 - Not configured (Default) +- 1 - Beta Channel - Prerelease +- 2 - Current Channel (Preview) +- 3 - Current Channel (Staged) +- 4 - Current Channel (Broad) + +**Configuration/SignaturesUpdatesChannel** + +Enable this policy to specify when devices receive daily Microsoft Defender definition updates during the daily gradual rollout. + +Current Channel (Broad): Devices will be offered updates only after the gradual release cycle completes. Suggested to apply to a broad set of devices in your production population (~10-100%). + +If you disable or do not configure this policy, the device will stay up to date automatically during the daily release cycle. Suitable for most devices. + +The data type is integer. +Supported operations are Add, Delete, Get, Replace. + +Valid Values are: +- 0: Not configured (Default) +- 3: Current Channel (Staged) +- 4: Current Channel (Broad) + **Scan** Node that can be used to start a Windows Defender scan on a device. @@ -542,4 +611,4 @@ Supported operations are Get and Execute. ## Related topics -[Configuration service provider reference](configuration-service-provider-reference.md) +[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index a63f4dec92..7aa0520e15 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -10,7 +10,6 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 08/11/2020 --- # Defender DDF file @@ -757,6 +756,7 @@ The XML below is the current version for this CSP. + Scan diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index 717e018b44..de26ad8620 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -189,7 +189,7 @@ The XML below is the current version for this CSP. text/plain - + HwV diff --git a/windows/client-management/mdm/devicestatus-csp.md b/windows/client-management/mdm/devicestatus-csp.md index 0dd72c26d2..f861b2d2e4 100644 --- a/windows/client-management/mdm/devicestatus-csp.md +++ b/windows/client-management/mdm/devicestatus-csp.md @@ -9,7 +9,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 04/30/2019 +ms.date: 06/25/2021 --- # DeviceStatus CSP @@ -150,8 +150,8 @@ Node for the compliance query. **DeviceStatus/Compliance/EncryptionCompliance** Boolean value that indicates compliance with the enterprise encryption policy for OS (system) drives. The value is one of the following: -- 0 - not encrypted -- 1 - encrypted +- 0 - Not encrypted +- 1 - Encrypted Supported operation is Get. @@ -179,8 +179,8 @@ Supported operation is Get. Added in Windows, version 1803. Read only node that specifies the device mode. Valid values: -- 0 - the device is in standard configuration -- 1 - the device is in S mode configuration +- 0 - The device is in standard configuration +- 1 - The device is in S mode configuration Supported operation is Get. @@ -211,10 +211,10 @@ Added in Windows, version 1607. Integer that specifies the status of the antivi Valid values: -- 0 – Antivirus is on and monitoring -- 1 – Antivirus is disabled -- 2 – Antivirus is not monitoring the device/PC or some options have been turned off -- 3 (default) – Antivirus is temporarily not completely monitoring the device/PC +- 0 – Antivirus is on and monitoring. +- 1 – Antivirus is disabled. +- 2 – Antivirus is not monitoring the device/PC or some options have been turned off. +- 3 (default) – Antivirus is temporarily not completely monitoring the device/PC. - 4 – Antivirus not applicable for this device. This is returned for devices like the phone that do not have an antivirus (where the API doesn’t exist.) Supported operation is Get. @@ -263,10 +263,10 @@ Added in Windows, version 1607. Integer that specifies the status of the firewa Valid values: -- 0 – Firewall is on and monitoring -- 1 – Firewall has been disabled -- 2 – Firewall is not monitoring all networks or some rules have been turned off -- 3 (default) – Firewall is temporarily not monitoring all networks +- 0 – Firewall is on and monitoring. +- 1 – Firewall has been disabled. +- 2 – Firewall is not monitoring all networks or some rules have been turned off. +- 3 (default) – Firewall is temporarily not monitoring all networks. - 4 – Not applicable. This is returned for devices like the phone that do not have an antivirus (where the API doesn’t exist.) Supported operation is Get. @@ -331,8 +331,8 @@ Added in Windows, version 1709. Virtualization-based security status. Value is - 0 - Running - 1 - Reboot required - 2 - 64 bit architecture required -- 3 - not licensed -- 4 - not configured +- 3 - Not licensed +- 4 - Not configured - 5 - System doesn't meet hardware requirements - 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details @@ -349,4 +349,4 @@ Added in Windows, version 1709. Local System Authority (LSA) credential guard s - 4 - VBS not running -Supported operation is Get. \ No newline at end of file +Supported operation is Get. diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index ef43f3c484..b8ffe15b74 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -136,45 +136,45 @@ The SasUrl value is the target URI to which the CSP uploads the zip file contain - Expected input value: The full command line including path and any arguments, such as `%windir%\\system32\\ipconfig.exe /all`. - Output format: Console text output from the command is captured in a text file and included in the overall output archive. For commands which may generate file output rather than console output, a subsequent FolderFiles directive would be used to capture that output. The example XML above demonstrates this pattern with mdmdiagnosticstool.exe's -out parameter. - Privacy guardrails: To enable diagnostic data capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, only the following commands are allowed: - - %windir%\\system32\\certutil.exe - - %windir%\\system32\\dxdiag.exe - - %windir%\\system32\\gpresult.exe - - %windir%\\system32\\msinfo32.exe - - %windir%\\system32\\netsh.exe - - %windir%\\system32\\nltest.exe - - %windir%\\system32\\ping.exe - - %windir%\\system32\\powercfg.exe - - %windir%\\system32\\w32tm.exe - - %windir%\\system32\\wpr.exe - - %windir%\\system32\\dsregcmd.exe - - %windir%\\system32\\dispdiag.exe - - %windir%\\system32\\ipconfig.exe - - %windir%\\system32\\logman.exe - - %windir%\\system32\\tracelog.exe - - %programfiles%\\windows defender\\mpcmdrun.exe - - %windir%\\system32\\MdmDiagnosticsTool.exe - - %windir%\\system32\\pnputil.exe + - %windir%\\system32\\certutil.exe + - %windir%\\system32\\dxdiag.exe + - %windir%\\system32\\gpresult.exe + - %windir%\\system32\\msinfo32.exe + - %windir%\\system32\\netsh.exe + - %windir%\\system32\\nltest.exe + - %windir%\\system32\\ping.exe + - %windir%\\system32\\powercfg.exe + - %windir%\\system32\\w32tm.exe + - %windir%\\system32\\wpr.exe + - %windir%\\system32\\dsregcmd.exe + - %windir%\\system32\\dispdiag.exe + - %windir%\\system32\\ipconfig.exe + - %windir%\\system32\\logman.exe + - %windir%\\system32\\tracelog.exe + - %programfiles%\\windows defender\\mpcmdrun.exe + - %windir%\\system32\\MdmDiagnosticsTool.exe + - %windir%\\system32\\pnputil.exe - **FoldersFiles** - Captures log files from a given path (without recursion). - Expected input value: File path with or without wildcards, such as "%windir%\\System32", or "%programfiles%\\*.log". - Privacy guardrails: To enable diagnostic log capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, only paths under the following roots are allowed: - - %PROGRAMFILES% - - %PROGRAMDATA% - - %PUBLIC% - - %WINDIR% - - %TEMP% - - %TMP% + - %PROGRAMFILES% + - %PROGRAMDATA% + - %PUBLIC% + - %WINDIR% + - %TEMP% + - %TMP% - Additionally, only files with the following extensions are captured: - - .log - - .txt - - .dmp - - .cab - - .zip - - .xml - - .html - - .evtx - - .etl + - .log + - .txt + - .dmp + - .cab + - .zip + - .xml + - .html + - .evtx + - .etl **DiagnosticArchive/ArchiveResults** Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run. diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 75c2d3f601..775e72cacd 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: +ms.date: 06/02/2021 ms.reviewer: manager: dansimp --- @@ -18,9 +18,9 @@ Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. Requirements: -- AD-joined PC running Windows 10, version 1709 or later +- Active Directory-joined PC running Windows 10, version 1709 or later - The enterprise has configured a mobile device management (MDM) service -- The on-premises AD must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad) +- The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) - The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. @@ -128,7 +128,7 @@ Requirements: > In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have installed Windows 10, version 1903 or later. > > The default behavior for older releases is to revert to **User Credential**. - > **Device Credential** is not supported for enrollment type when you have a ConfigMgr Agent on your device. + > **Device Credential** is only supported for Microsoft Intune enrollment in scenarios with Co-management or Azure Virtual Desktop. When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." @@ -195,6 +195,8 @@ Requirements: - 20H2 --> [Administrative Templates (.admx) for Windows 10 October 2020 Update (20H2)](https://www.microsoft.com/download/details.aspx?id=102157) + - 21H1 --> [Administrative Templates (.admx) for Windows 10 May 2021 Update (21H1)](https://www.microsoft.com/download/details.aspx?id=103124) + 2. Install the package on the Domain Controller. 3. Navigate, depending on the version to the folder: @@ -211,6 +213,8 @@ Requirements: - 20H2 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2020 Update (20H2)** + - 21H1 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2021 Update (21H1)** + 4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. 5. Copy PolicyDefinitions folder to **\\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions**. @@ -294,7 +298,7 @@ To collect Event Viewer logs: - [Group Policy Central Store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) ### Useful Links - +- [Windows 10 Administrative Templates for Windows 10 May 2021 Update 21H1](https://www.microsoft.com/download/details.aspx?id=103124) - [Windows 10 Administrative Templates for Windows 10 November 2019 Update 1909](https://www.microsoft.com/download/details.aspx?id=100591) - [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495) - [Windows 10 Administrative Templates for Windows 10 October 2018 Update 1809](https://www.microsoft.com/download/details.aspx?id=57576) diff --git a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md index 60cff29616..78f0b5cb28 100644 --- a/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisedesktopappmanagement-csp.md @@ -20,6 +20,7 @@ The EnterpriseDesktopAppManagement configuration service provider is used to han Application installations can take some time to complete, hence they are done asynchronously. When the Exec command is completed, the client can send a generic alert to the management server with a status, whether it's a failure or success. For a SyncML example, see [Alert example](#alert-example). The following shows the EnterpriseDesktopAppManagement CSP in tree format. + ``` ./Device/Vendor/MSFT EnterpriseDesktopAppManagement @@ -37,6 +38,7 @@ EnterpriseDesktopAppManagement --------UpgradeCode ------------Guid ``` + **./Device/Vendor/MSFT/EnterpriseDesktopAppManagement** The root node for the EnterpriseDesktopAppManagement configuration service provider. @@ -194,15 +196,15 @@ The following table describes the fields in the previous sample: The following table describes the fields in the previous sample: -| Name | Description | -|--------|------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Get | Operation being performed. The Get operation is a request to report the status of the specified MSI installed application. | -| CmdID | Input value used to reference the request. Responses will include this value which can be used to match request and response. | +| Name | Description | +|--------|-----------------------| +| Get | Operation being performed. The Get operation is a request to report the status of the specified MSI installed application.| +| CmdID | Input value used to reference the request. Responses will include this value which can be used to match request and response. | | LocURI | Path to Win32 CSP command processor, including the Product ID (in this example, 1803A630-3C38-4D2B-9B9A-0CB37243539C) property escaped for XML formatting. | -**SyncML to perform MSI install operations for an application targeted to a specific user on the device. The Add command is required to preceed the Exec command.** +**SyncML to perform MSI install operations for an application targeted to a specific user on the device. The Add command is required to precede the Exec command.** ```xml @@ -292,7 +294,8 @@ The following table describes the fields in the previous sample: -> **Note**  Information status on the MSI job will be reported using standard OMA-DM notification mechanism. The status reported is represented using standard MSIEXEC return codes as HRESULT as defined in the MSIEXEC topic on Microsoft TechNet at . +> [!Note] +> Information status on the MSI job will be reported using standard OMA-DM notification mechanism. The status reported is represented using standard MSIEXEC return codes as HRESULT as defined in the MSIEXEC topic on Microsoft TechNet at [Msiexec (command-line options)](https://technet.microsoft.com/library/cc759262%28v=ws.10%29.aspx). @@ -401,7 +404,7 @@ The following table MsiInstallJob describes the schema elements. Command-line options to be used when calling MSIEXEC.exe -Timeout +TimeOut Amount of time, in minutes that the installation process can run before the installer considers the installation may have failed and no longer monitors the installation operation. @@ -550,21 +553,18 @@ Here's a list of references: ```xml - 4 - 1224 - - - ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/{AF9257BA-6BBD-4624-AA9B-0182D50292C3}/DownloadInstall - - - Reversed-Domain-Name:com.microsoft.mdm.win32csp_install - int - informational - - 0 - + 4 + 1224 + + + ./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/{AF9257BA-6BBD-4624-AA9B-0182D50292C3}/DownloadInstall + + + Reversed-Domain-Name:com.microsoft.mdm.win32csp_install + int + informational + + 0 + ``` - - - diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 3463de078b..9f691cab8c 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -502,8 +502,8 @@ The following list of data points are verified by the DHA-Service in DHA-Report - [HealthStatusMismatchFlags](#healthstatusmismatchflags) \* TPM 2.0 only -** Reports if Bitlocker was enabled during initial boot. -*** The “Hybrid Resume” must be disabled on the device. Reports 1st party ELAM “Defender” was loaded during boot. +\*\* Reports if BitLocker was enabled during initial boot. +\*\*\* The “Hybrid Resume” must be disabled on the device. Reports 1st party ELAM “Defender” was loaded during boot. Each of these are described in further detail in the following sections, along with the recommended actions to take. @@ -547,8 +547,8 @@ Each of these are described in further detail in the following sections, along w - Allow conditional access based on other data points that are present at evaluation time. For example, other attributes on the health certificate, or a devices past activities and trust history. - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. -**BitlockerStatus** (at boot time) -

When Bitlocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.

+**BitLockerStatus** (at boot time) +

When BitLocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.

Windows BitLocker Drive Encryption, encrypts all data stored on the Windows operating system volume. BitLocker uses the TPM to help protect the Windows operating system and user data and helps to ensure that a computer is not tampered with, even if it is left unattended, lost, or stolen.

@@ -614,7 +614,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI assets - Place the device in a watch list to monitor the device more closely for potential risks. -- Trigger a corrective action, such as enabling VSM using WMI or a Powershell script. +- Trigger a corrective action, such as enabling VSM using WMI or a PowerShell script. **OSKernelDebuggingEnabled**

OSKernelDebuggingEnabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: they may run unstable code, or be configured with fewer security restrictions required for testing and development.

@@ -659,7 +659,7 @@ Each of these are described in further detail in the following sections, along w - Disallow all access - Disallow access to HBI and MBI assets - Place the device in a watch list to monitor the device more closely for potential risks. -- Trigger a corrective action, such as enabling test signing using WMI or a Powershell script. +- Trigger a corrective action, such as enabling test signing using WMI or a PowerShell script. **SafeMode**

Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. Only the basic files and drivers necessary to run Windows are started.

@@ -1176,4 +1176,3 @@ xmlns="http://schemas.microsoft.com/windows/security/healthcertificate/validatio [Configuration service provider reference](configuration-service-provider-reference.md) - diff --git a/windows/client-management/mdm/images/edit-row.png b/windows/client-management/mdm/images/edit-row.png new file mode 100644 index 0000000000..95be3d8a0d Binary files /dev/null and b/windows/client-management/mdm/images/edit-row.png differ diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index fbe229c166..329281e328 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1371,6 +1371,7 @@ The following diagram shows the Policy configuration service provider in tree fo + ## ADMX_ICM policies
@@ -6781,6 +6782,14 @@ The following diagram shows the Policy configuration service provider in tree fo
+### Language Pack Management CSP policies + +
+
+ LanmanWorkstation/EnableInsecureGuestLogons +
+
+ ### Licensing policies
diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index c831b4a527..0781ec7432 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -1838,15 +1838,15 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Announces the presence of shared printers to print browse master servers for the domain. +Available in the latest Windows 10 Insider Preview Build. Announces the presence of shared printers to print browse main servers for the domain. On domains with Active Directory, shared printer resources are available in Active Directory and are not announced. -If you enable this setting, the print spooler announces shared printers to the print browse master servers. +If you enable this setting, the print spooler announces shared printers to the print browse main servers. -If you disable this setting, shared printers are not announced to print browse master servers, even if Active Directory is not available. +If you disable this setting, shared printers are not announced to print browse main servers, even if Active Directory is not available. -If you do not configure this setting, shared printers are announced to browse master servers only when Active Directory is not available. +If you do not configure this setting, shared printers are announced to browse main servers only when Active Directory is not available. > [!NOTE] > A client license is used each time a client computer announces a printer to a print browse master on the domain. diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 234f5f9d6c..352dd76846 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -4521,7 +4521,7 @@ ADMX Info: Available in the latest Windows 10 Insider Preview Build. Prevents users from using My Computer to gain access to the content of selected drives. -If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents. Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. +If you enable this setting, users can browse the directory structure of the selected drives in My Computer or File Explorer, but they cannot open folders and access the contents (open the files in the folders or see the files in the folders). Also, they cannot use the Run dialog box or the Map Network Drive dialog box to view the directories on these drives. To use this setting, select a drive or combination of drives from the drop-down list. To allow access to all drive directories, disable this setting or select the "Do not restrict drives" option from the drop-down list. @@ -5356,4 +5356,4 @@ ADMX Info: > [!NOTE] > These policies are currently only available as part of a Windows Insider release. - \ No newline at end of file + diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index d62b5b232d..1b75bd9a6b 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -542,7 +542,7 @@ Value type is integer. Supported values: > [!Warning] > This policy is in preview mode only and therefore not meant or recommended for production purposes. -"Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for non-ADFS federated providers (e.g. SAML). +"Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for new Azure AD credentials, like Temporary Access Pass. > [!Note] > Web Sign-in is only supported on Azure AD Joined PCs. diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md index 60d4832fae..35190895c9 100644 --- a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -51,7 +51,7 @@ manager: dansimp Pro - cross mark + check mark6 Business @@ -115,7 +115,7 @@ The following list shows the supported values: Pro - cross mark + check mark6 Business @@ -178,7 +178,7 @@ IT Pros do not need to set this policy. Instead, Microsoft Intune is expected to Pro - cross mark + check mark6 Business diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index ac14df7d98..62ce04adc6 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -30,6 +30,9 @@ ms.localizationpriority: medium
DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
+
+ DeviceInstallation/EnableInstallationPolicyLayering +
DeviceInstallation/PreventDeviceMetadataFromNetwork
@@ -94,12 +97,22 @@ ms.localizationpriority: medium -This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is allowed to install. +This policy setting allows you to specify a list of plug-and-play hardware IDs and compatible IDs for devices that Windows is allowed to install. > [!TIP] -> Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. +> This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. -If you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. +When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play hardware ID or compatible ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: +- Prevent installation of devices that match these device IDs +- Prevent installation of devices that match any of these device instance IDs + +If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. + +Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). + +If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. @@ -203,17 +216,31 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and > [!div class = "checklist"] > * Device - +Added in Windows 10, version 1903. Also available in Windows 10, version 1809.
-Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. +This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. -If you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. +> [!TIP] +> This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. + +When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: +- Prevent installation of devices that match any of these device instance IDs + +If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. + +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. + +Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). + +If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. + Peripherals can be specified by their [device instance ID](/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. @@ -315,20 +342,30 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i -This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is allowed to install. +This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is allowed to install. > [!TIP] -> Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. +> This policy setting is intended to be used only when the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is enabled, however it may also be used with the "Prevent installation of devices not described by other policy settings" policy setting for legacy policy definitions. -If you enable this policy setting, Windows is allowed to install or update device drivers whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. +When this policy setting is enabled together with the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting at the same or higher layer in the hierarchy specifically prevents that installation, such as the following policy settings: -This setting allows device installation based on the serial number of a removable device if that number is in the hardware ID. +- Prevent installation of devices for these device classes +- Prevent installation of devices that match these device IDs +- Prevent installation of devices that match any of these device instance IDs + +If the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting is not enabled with this policy setting, then any other policy settings specifically preventing installation will take precedence. + +> [!NOTE] +> The "Prevent installation of devices not described by other policy settings" policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting for supported target Windows 10 versions. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting when possible. + +Alternatively, if this policy setting is enabled together with the "Prevent installation of devices not described by other policy settings" policy setting, Windows is allowed to install or update driver packages whose device setup class GUIDs appear in the list you create, unless another policy setting specifically prevents installation (for example, the "Prevent installation of devices that match these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). + +If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. Peripherals can be specified by their [hardware identity](/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -394,6 +431,133 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and
+ +## DeviceInstallation/EnableInstallationPolicyLayering + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark5
Businesscheck mark5
Enterprisecheck mark5
Educationcheck mark5
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device +Added in Windows 10, Version 2106 +
+ + + +This policy setting will change the evaluation order in which Allow and Prevent policy settings are applied when more than one install policy setting is applicable for a given device. Enable this policy setting to ensure that overlapping device match criteria is applied based on an established hierarchy where more specific match criteria supersedes less specific match criteria. The hierarchical order of evaluation for policy settings that specify device match criteria is as follows: + +Device instance IDs > Device IDs > Device setup class > Removable devices + +**Device instance IDs** +- Prevent installation of devices using drivers that match these device instance IDs. +- Allow installation of devices using drivers that match these device instance IDs. + +**Device IDs** +- Prevent installation of devices using drivers that match these device IDs. +- Allow installation of devices using drivers that match these device IDs. + +**Device setup class** +- Prevent installation of devices using drivers that match these device setup classes. +- Allow installation of devices using drivers that match these device setup classes. + +**Removable devices** +- Prevent installation of removable devices. + +> [!NOTE] +> This policy setting provides more granular control than the "Prevent installation of devices not described by other policy settings" policy setting. If these conflicting policy settings are enabled at the same time, the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting will be enabled and the other policy setting will be ignored. + +If you disable or do not configure this policy setting, the default evaluation is used. By default, all "Prevent installation..." policy settings have precedence over any other policy setting that allows Windows to install a device. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria* +- GP name: *DeviceInstall_Allow_Deny_Layered* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + +```xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/EnableInstallationPolicyLayering + + + string + + ; + + + + +``` + +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: + + +```txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` +You can also change the evaluation order of device installation policy settings by using a custom profile in Intune. + +:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image"::: + + + + + + +
+ ## DeviceInstallation/PreventDeviceMetadataFromNetwork @@ -519,9 +683,12 @@ ADMX Info: This policy setting allows you to prevent the installation of devices that are not specifically described by any other policy setting. -If you enable this policy setting, Windows is prevented from installing or updating the device driver for any device that is not described by either the "Allow installation of devices that match any of these device IDs" or the "Allow installation of devices for these device classes" policy setting. +> [!NOTE] +> This policy setting has been replaced by the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting to provide more granular control. It is recommended that you use the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting instead of this policy setting. -If you disable or do not configure this policy setting, Windows is allowed to install or update the device driver for any device that is not described by the "Prevent installation of devices that match any of these device IDs," "Prevent installation of devices for these device classes," or "Prevent installation of removable devices" policy setting. +If you enable this policy setting, Windows is prevented from installing or updating the driver package for any device that is not described by either the "Allow installation of devices that match any of these device IDs", the "Allow installation of devices for these device classes", or the "Allow installation of devices that match any of these device instance IDs" policy setting. + +If you disable or do not configure this policy setting, Windows is allowed to install or update the driver package for any device that is not described by the "Prevent installation of devices that match any of these device IDs", "Prevent installation of devices for these device classes" policy setting, "Prevent installation of devices that match any of these device instance IDs", or "Prevent installation of removable devices" policy setting. > [!TIP] @@ -629,7 +796,10 @@ You can also block installation by using a custom profile in Intune. -This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. +This policy setting allows you to specify a list of Plug and Play hardware IDs and compatible IDs for devices that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. + +> [!NOTE] +> To enable the "Allow installation of devices that match any of these device instance IDs" policy setting to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. If you enable this policy setting, Windows is prevented from installing a device whose hardware ID or compatible ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. @@ -873,9 +1043,12 @@ with -This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for device drivers that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. +This policy setting allows you to specify a list of device setup class globally unique identifiers (GUIDs) for driver packages that Windows is prevented from installing. By default, this policy setting takes precedence over any other policy setting that allows Windows to install a device. -If you enable this policy setting, Windows is prevented from installing or updating device drivers whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. +> [!NOTE] +> To enable the "Allow installation of devices that match any of these device IDs" and "Allow installation of devices that match any of these device instance IDs" policy settings to supersede this policy setting for applicable devices, enable the "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria" policy setting. + +If you enable this policy setting, Windows is prevented from installing or updating driver packages whose device setup class GUIDs appear in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index a0b1076deb..0d4580ee4b 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 09/27/2019 +ms.date: 05/02/2021 ms.reviewer: manager: dansimp --- @@ -1045,9 +1045,7 @@ GP Info: -Valid values: -- 0 - disabled -- 1 - enabled (session will lock after amount of inactive time exceeds the inactivity limit) +Valid values: From 0 to 599940, where the value is the amount of inactivity time (in seconds) after which the session will be locked. If it is set to zero (0), the setting is disabled. @@ -1243,7 +1241,8 @@ If you click Force Logoff in the Properties dialog box for this policy, the user If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. -Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. +> [!NOTE] +> Remote Desktop Services was called Terminal Services in previous versions of Windows Server. Default: This policy is not defined, which means that the system treats it as No action. @@ -2459,7 +2458,8 @@ If you select "Enable auditing for all accounts", the server will log events for This policy is supported on at least Windows 7 or Windows Server 2008 R2. -Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. +> [!NOTE] +> Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2537,7 +2537,8 @@ If you select "Deny all accounts," the server will deny NTLM authentication requ This policy is supported on at least Windows 7 or Windows Server 2008 R2. -Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. +> [!NOTE] +> Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2615,7 +2616,8 @@ If you select "Deny all," the client computer cannot authenticate identities to This policy is supported on at least Windows 7 or Windows Server 2008 R2. -Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. +> [!NOTE] +> Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. @@ -2899,7 +2901,9 @@ This policy setting controls the behavior of the elevation prompt for administra The options are: -- 0 - Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. +- 0 - Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. + > [!NOTE] + > Use this option only in the most constrained environments. - 1 - Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. @@ -3170,11 +3174,12 @@ User Account Control: Only elevate UIAccess applications that are installed in s This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: -- …\Program Files\, including subfolders -- …\Windows\system32\ -- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows +- .\Program Files\, including subfolders +- .\Windows\system32\ +- .\Program Files (x86)\, including subfolders for 64-bit versions of Windows -Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. +> [!NOTE] +> Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. The options are: - 0 - Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. @@ -3242,7 +3247,9 @@ User Account Control: Turn on Admin Approval Mode This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. The options are: -- 0 - Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. +- 0 - Disabled: Admin Approval Mode and all related UAC policy settings are disabled. + > [!NOTE] + > If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. - 1 - Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. @@ -3467,4 +3474,4 @@ Footnotes: - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. - \ No newline at end of file + diff --git a/windows/client-management/mdm/policy-csp-localusersandgroups.md b/windows/client-management/mdm/policy-csp-localusersandgroups.md index 68938fa3b7..5f21ba8658 100644 --- a/windows/client-management/mdm/policy-csp-localusersandgroups.md +++ b/windows/client-management/mdm/policy-csp-localusersandgroups.md @@ -14,9 +14,6 @@ manager: dansimp # Policy CSP - LocalUsersAndGroups -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index a3d2099a3e..e55afed42c 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -719,7 +719,7 @@ ADMX Info: Example for setting the device custom OMA-URI setting to enable this policy: -To deny write access to removable storage within Intune’s custom profile, set OMA-URI to ```.\[device|user]\vendor\msft\policy\[config|result]\Storage/RemovableDiskDenyWriteAccess```, Data type to Integer, and Value to 1. +To deny write access to removable storage within Intune’s custom profile, set OMA-URI to ```./Device/Vendor/MSFT/Policy/Config/Storage/RemovableDiskDenyWriteAccess```, Data type to Integer, and Value to 1. See [Use custom settings for Windows 10 devices in Intune](/intune/custom-settings-windows-10) for information on how to create custom profiles. @@ -740,4 +740,4 @@ Footnotes: - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. - \ No newline at end of file + diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 3615cb2e3f..4d1e1393b7 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -49,6 +49,9 @@ manager: dansimp
System/AllowTelemetry
+
+ System/AllowUpdateComplianceProcessing +
System/AllowUserToResetPhone
@@ -736,12 +739,17 @@ The following list shows the supported values for Windows 8.1: --> -In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. The following list shows the supported values for Windows 10: -- 0 – (**Security**) Sends information that is required to help keep Windows more secure, including data about the Connected User Experience and Telemetry component settings, the Malicious Software Removal Tool, and Microsoft Defender. - **Note:** This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), Hololens 2, and Windows Server 2016. Using this setting on other devices is equivalent to setting the value of 1. -- 1 – (**Basic**) Sends the same data as a value of 0, plus additional basic device info, including quality-related data, app compatibility, and app usage data. -- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows, Windows Server, System Center, and apps are used, how they perform, and advanced reliability data. -- 3 – (**Full**) Sends the same data as a value of 2, plus all data necessary to identify and fix problems with devices. +In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. + +The following list shows the supported values for Windows 10 version 1809 and older, choose the value that is applicable to your OS version (older OS values are displayed in the brackets): +- 0 – **Off (Security)** This turns Windows diagnostic data off. + **Note**: This value is only applicable to Windows 10 Enterprise, Windows 10 Education, Windows 10 IoT Core (IoT Core), HoloLens 2, and Windows Server 2016 (and later versions). Using this setting on other devices editions of Windows is equivalent to setting the value of 1. +- 1 – **Required (Basic)** Sends basic device info, including quality-related data, app compatibility, and other similar data to keep the device secure and up-to-date. +- 2 – (**Enhanced**) Sends the same data as a value of 1, plus additional insights, including how Windows apps are used, how they perform, and advanced reliability data, such as limited crash dumps. + **Note**: **Enhanced** is no longer an option for Windows Holographic, version 21H1. +- 3 – **Optional (Full)** Sends the same data as a value of 2, plus additional data necessary to identify and fix problems with devices such as enhanced error logs. + +Most restrictive value is 0. - -> [!IMPORTANT] -> If you are using Windows 8.1 MDM server and set a value of 0 using the legacy AllowTelemetry policy on a Windows 10 Mobile device, then the value is not respected and the telemetry level is silently set to level 1. - - -Most restricted value is 0. - ADMX Info: @@ -791,6 +792,77 @@ ADMX Info: +
+ + +**System/AllowUpdateComplianceProcessing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procheck mark6
Businesscheck mark6
Enterprisecheck mark6
Educationcheck mark6
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Allows IT admins to enable diagnostic data from this device to be processed by Update Compliance. + +If you enable this setting, it enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. + +If you disable or do not configure this policy setting, diagnostic data from this device will not be processed by Update Compliance. + + + +ADMX Info: +- GP English name: *Allow Update Compliance Processing* +- GP name: *AllowUpdateComplianceProcessing* +- GP element: *AllowUpdateComplianceProcessing* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +The following list shows the supported values: + +- 0 - Disabled. +- 16 - Enabled. + + + +
@@ -852,6 +924,7 @@ The following list shows the supported values:
+ **System/BootStartDriverInitialization** @@ -1607,14 +1680,16 @@ This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior, you must complete two steps: -
    -
  • Enable this policy setting
    • -
  • Set Allow Telemetry to level 2 (Enhanced)
    • -
+ +- Enable this policy setting +- Set the **AllowTelemetry** level: + - For Windows 10 version 1809 and older: set **AllowTelemetry** to Enhanced. (**Note**: **Enhanced** is no longer an option for Windows Holographic, version 21H1) + - For Windows 10 version 19H1 and later: set **AllowTelemetry** to Optional (Full) + When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics. -Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. +Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send Required (Basic) or Optional (Full) diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. @@ -1778,5 +1853,7 @@ Footnotes: - 6 - Available in Windows 10, version 1903. - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. +- 10 - Available in Windows 10, version 21H1. - \ No newline at end of file + diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index de9a8618a9..dde8b3089c 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -32,84519 +32,3 @@ You can view various Policy DDF files by clicking the following links: - [View the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) You can download DDF files for various CSPs from [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). - -The XML below is the DDF for Windows 10, version 20H2. - -```xml - -]> - - 1.2 - - Policy - ./User/Vendor/MSFT - - - - - - - - - - - - - - - com.microsoft/10.0/MDM/Policy - - - - Config - - - - - - - - - - - - - - - - - - - - - ApplicationManagement - - - - - - - - - - - - - - - - - - - - - MSIAlwaysInstallWithElevatedPrivileges - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequirePrivateStoreOnly - - - - - - - - - - - - - - - - - - - text/plain - - - - - - AttachmentManager - - - - - - - - - - - - - - - - - - - - - DoNotPreserveZoneInformation - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideZoneInfoMechanism - - - - - - - - - - - - - - - - - - - text/plain - - - - - NotifyAntivirusPrograms - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Authentication - - - - - - - - - - - - - - - - - - - - - AllowEAPCertSSO - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Autoplay - - - - - - - - - - - - - - - - - - - - - DisallowAutoplayForNonVolumeDevices - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetDefaultAutoRunBehavior - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOffAutoPlay - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Browser - - - - - - - - - - - - - - - - - - - - - AllowAddressBarDropdown - - - - - - - - This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. - - - - - - - - - - - text/plain - - - - - AllowAutofill - - - - - - - - This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowBrowser - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowConfigurationUpdateForBooksLibrary - - - - - - - - This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. - - - - - - - - - - - text/plain - - - - - AllowCookies - - - - - - - - This setting lets you configure how your company deals with cookies. - - - - - - - - - - - text/plain - - - - - AllowDeveloperTools - - - - - - - - This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowDoNotTrack - - - - - - - - This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. - - - - - - - - - - - text/plain - - - - - AllowExtensions - - - - - - - - This setting lets you decide whether employees can load extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowFlash - - - - - - - - This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowFlashClickToRun - - - - - - - - Configure the Adobe Flash Click-to-Run setting. - - - - - - - - - - - text/plain - - - - - AllowFullScreenMode - - - - - - - - With this policy, you can specify whether to allow full-screen mode, which shows only the web content and hides the Microsoft Edge UI. - -If enabled or not configured, full-screen mode is available for use in Microsoft Edge. Your users and extensions must have the proper permissions. - -If disabled, full-screen mode is unavailable for use in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowInPrivate - - - - - - - - This setting lets you decide whether employees can browse using InPrivate website browsing. - - - - - - - - - - - text/plain - - - - - AllowMicrosoftCompatibilityList - - - - - - - - This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. - -If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. - -If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. - - - - - - - - - - - text/plain - - - - - AllowPasswordManager - - - - - - - - This setting lets you decide whether employees can save their passwords locally, using Password Manager. - - - - - - - - - - - text/plain - - - - - AllowPopups - - - - - - - - This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. - - - - - - - - - - - text/plain - - - - - AllowPrelaunch - - - - - - - - Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - - - AllowPrinting - - - - - - - - With this policy, you can restrict whether printing web content in Microsoft Edge is allowed. - -If enabled, printing is allowed. - -If disabled, printing is not allowed. - - - - - - - - - - - text/plain - - - - - AllowSavingHistory - - - - - - - - Microsoft Edge saves your user's browsing history, which is made up of info about the websites they visit, on their devices. - -If enabled or not configured, the browsing history is saved and visible in the History pane. - -If disabled, the browsing history stops saving and is not visible in the History pane. If browsing history exists before this policy was disabled, the previous browsing history remains visible in the History pane. This policy, when disabled, does not stop roaming of existing history or history coming from other roamed devices. - - - - - - - - - - - text/plain - - - - - AllowSearchEngineCustomization - - - - - - - - Allow search engine customization for MDM enrolled devices. Users can change their default search engine. - -If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. -If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. - -This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). - - - - - - - - - - - text/plain - - - - - AllowSearchSuggestionsinAddressBar - - - - - - - - This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowSideloadingOfExtensions - - - - - - - - This setting lets you decide whether employees can sideload extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowSmartScreen - - - - - - - - This setting lets you decide whether to turn on Windows Defender SmartScreen. - - - - - - - - - - - text/plain - - - - - AllowTabPreloading - - - - - - - - Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - - - AllowWebContentOnNewTabPage - - - - - - - - This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. - -If you enable this setting, Microsoft Edge opens a new tab with the New Tab page. - -If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it. - -If you don't configure this setting, employees can choose how new tabs appears. - - - - - - - - - - - text/plain - - - - - AlwaysEnableBooksLibrary - - - - - - - - Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. - - - - - - - - - - - text/plain - - - - - ClearBrowsingDataOnExit - - - - - - - - Specifies whether to always clear browsing history on exiting Microsoft Edge. - - - - - - - - - - - text/plain - - - - - ConfigureAdditionalSearchEngines - - - - - - - - Allows you to add up to 5 additional search engines for MDM-enrolled devices. - -If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. - -If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - ConfigureFavoritesBar - - - - - - - - The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. - -If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. - -If disabled, the favorites bar is hidden, and the favorites bar toggle resets to Off, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. - -If not configured, the favorites bar is hidden but is visible on the Start and New Tab pages, and the favorites bar toggle in Settings sets to Off but is enabled allowing the user to make changes. - - - - - - - - - - - text/plain - - - - - ConfigureHomeButton - - - - - - - - The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. - -By default, this policy is disabled or not configured and clicking the home button loads the default Start page. - -When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. - -If Enabled AND: -- Show home button & set to Start page is selected, clicking the home button loads the Start page. -- Show home button & set to New tab page is selected, clicking the home button loads a New tab page. -- Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. -- Hide home button is selected, the home button is hidden in Microsoft Edge. - -Default setting: Disabled or not configured -Related policies: -- Set Home Button URL -- Unlock Home Button - - - - - - - - - - - text/plain - - - - - ConfigureKioskMode - - - - - - - - Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. - -You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw). - -If enabled and set to 0 (Default or not configured): -- If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. -- If it’s one of many apps, Microsoft Edge runs as normal. -If enabled and set to 1: -- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. -- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge. - - - - - - - - - - - text/plain - - - - - ConfigureKioskResetAfterIdleTimeout - - - - - - - - You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user’s browsing data. - -If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. - -If you set this policy to 0, Microsoft Edge does not use an idle timer. - -If disabled or not configured, the default value is 5 minutes. - -If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. - - - - - - - - - - - text/plain - - - - - ConfigureOpenMicrosoftEdgeWith - - - - - - - - You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. - -If enabled, you can choose one of the following options: -- Start page: the Start page loads ignoring the Configure Start Pages policy. -- New tab page: the New tab page loads ignoring the Configure Start Pages policy. -- Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. -- A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. - -When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. - -If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. - -Default setting: A specific page or pages (default) -Related policies: --Disable Lockdown of Start Pages --Configure Start Pages - - - - - - - - - - - text/plain - - - - - ConfigureTelemetryForMicrosoft365Analytics - - - - - - - - Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization. - - - - - - - - - - - text/plain - - - - - DisableLockdownOfStartPages - - - - - - - - You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. - -If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Start Pages -- Configure Open Microsoft Edge With - - - - - - - - - - - text/plain - - - - - EnableExtendedBooksTelemetry - - - - - - - - This setting allows organizations to send extended telemetry on book usage from the Books Library. - - - - - - - - - - - text/plain - - - - - EnterpriseModeSiteList - - - - - - - - This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. - - - - - - - - - - - text/plain - - - - - EnterpriseSiteListServiceUrl - - - - - - - - - - - - - - - - - - - text/plain - - - - - FirstRunURL - - - - - - - - Configure first run URL. - - - - - - - - - - - text/plain - - - - - HomePages - - - - - - - - When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. - -If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - - <support.contoso.com><support.microsoft.com> - -If disabled or not configured, the webpages specified in App settings loads as the default Start pages. - -Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. - -Version 1809: -If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Open Microsoft Edge With -- Disable Lockdown of Start Pages - - - - - - - - - - - text/plain - - - - - LockdownFavorites - - - - - - - - This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. - -If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. - - - - - - - - - - - text/plain - - - - - PreventAccessToAboutFlagsInMicrosoftEdge - - - - - - - - Prevent access to the about:flags page in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - PreventCertErrorOverrides - - - - - - - - Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors. - -If enabled, overriding certificate errors are not allowed. - -If disabled or not configured, overriding certificate errors are allowed. - - - - - - - - - - - text/plain - - - - - PreventFirstRunPage - - - - - - - - Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - PreventLiveTileDataCollection - - - - - - - - This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - PreventSmartScreenPromptOverride - - - - - - - - Don't allow Windows Defender SmartScreen warning overrides - - - - - - - - - - - text/plain - - - - - PreventSmartScreenPromptOverrideForFiles - - - - - - - - Don't allow Windows Defender SmartScreen warning overrides for unverified files. - - - - - - - - - - - text/plain - - - - - PreventTurningOffRequiredExtensions - - - - - - - - You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. - -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. - -When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. - -If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. - -If disabled or not configured, extensions defined as part of this policy get ignored. - -Default setting: Disabled or not configured -Related policies: Allow Developer Tools -Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) - - - - - - - - - - - text/plain - - - - - PreventUsingLocalHostIPAddressForWebRTC - - - - - - - - Prevent using localhost IP address for WebRTC - - - - - - - - - - - text/plain - - - - - ProvisionFavorites - - - - - - - - This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. - -If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. - - - - - - - - - - - text/plain - - - - - SendIntranetTraffictoInternetExplorer - - - - - - - - Sends all intranet traffic over to Internet Explorer. - - - - - - - - - - - text/plain - - - - - SetDefaultSearchEngine - - - - - - - - Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. - -If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. - -If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - SetHomeButtonURL - - - - - - - - The home button can be configured to load a custom URL when your user clicks the home button. - -If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. - -Default setting: Blank or not configured -Related policy: Configure Home Button - - - - - - - - - - - text/plain - - - - - SetNewTabPageURL - - - - - - - - You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. - -If enabled, you can set the default New Tab page URL. - -If disabled or not configured, the default Microsoft Edge new tab page is used. - -Default setting: Disabled or not configured -Related policy: Allow web content on New Tab page - - - - - - - - - - - text/plain - - - - - ShowMessageWhenOpeningSitesInInternetExplorer - - - - - - - - You can configure Microsoft Edge to open a site automatically in Internet Explorer 11 and choose to display a notification before the site opens. If you want to display a notification, you must enable Configure the Enterprise Mode Site List or Send all intranets sites to Internet Explorer 11 or both. - -If enabled, the notification appears on a new page. If you want users to continue in Microsoft Edge, select the Show Keep going in Microsoft Edge option from the drop-down list under Options. - -If disabled or not configured, the default app behavior occurs and no additional page displays. - -Default setting: Disabled or not configured -Related policies: --Configure the Enterprise Mode Site List --Send all intranet sites to Internet Explorer 11 - - - - - - - - - - - text/plain - - - - - SyncFavoritesBetweenIEAndMicrosoftEdge - - - - - - - - Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. - - - - - - - - - - - text/plain - - - - - UnlockHomeButton - - - - - - - - By default, when enabling Configure Home Button or Set Home Button URL, the home button is locked down to prevent your users from changing what page loads when clicking the home button. Use this policy to let users change the home button even when Configure Home Button or Set Home Button URL are enabled. - -If enabled, the UI settings for the home button are enabled allowing your users to make changes, including hiding and showing the home button as well as configuring a custom URL. - -If disabled or not configured, the UI settings for the home button are disabled preventing your users from making changes. - -Default setting: Disabled or not configured -Related policy: --Configure Home Button --Set Home Button URL - - - - - - - - - - - text/plain - - - - - UseSharedFolderForBooks - - - - - - - - This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. - - - - - - - - - - - text/plain - - - - - - CredentialsUI - - - - - - - - - - - - - - - - - - - - - DisablePasswordReveal - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Desktop - - - - - - - - - - - - - - - - - - - - - PreventUserRedirectionOfProfileFolders - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Display - - - - - - - - - - - - - - - - - - - - - EnablePerProcessDpi - - - - - - - - Enable or disable Per-Process System DPI for all applications. - - - - - - - - - - - text/plain - - - - - - Education - - - - - - - - - - - - - - - - - - - - - AllowGraphingCalculator - - - - - - - - This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. - - - - - - - - - - - text/plain - - - - - DefaultPrinterName - - - - - - - - This policy sets user's default printer - - - - - - - - - - - text/plain - - - - - PreventAddingNewPrinters - - - - - - - - Boolean that specifies whether or not to prevent user to install new printers - - - - - - - - - - - text/plain - - - - - PrinterNames - - - - - - - - This policy provisions per-user network printers - - - - - - - - - - - text/plain - - - - - - EnterpriseCloudPrint - - - - - - - - - - - - - - - - - - - - - CloudPrinterDiscoveryEndPoint - - - - - - - - This policy provisions per-user discovery end point to discover cloud printers - - - - - - - - - - - text/plain - - - - - CloudPrintOAuthAuthority - - - - - - - - Authentication endpoint for acquiring OAuth tokens - - - - - - - - - - - text/plain - - - - - CloudPrintOAuthClientId - - - - - - - - A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority - - - - - - - - - - - text/plain - - - - - CloudPrintResourceId - - - - - - - - Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication - - - - - - - - - - - text/plain - - - - - DiscoveryMaxPrinterLimit - - - - - - - - Defines the maximum number of printers that should be queried from discovery end point - - - - - - - - - - - text/plain - - - - - MopriaDiscoveryResourceId - - - - - - - - Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication - - - - - - - - - - - text/plain - - - - - - Experience - - - - - - - - - - - - - - - - - - - - - AllowTailoredExperiencesWithDiagnosticData - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowThirdPartySuggestionsInWindowsSpotlight - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsSpotlight - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsSpotlightOnActionCenter - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsSpotlightOnSettings - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsSpotlightWindowsWelcomeExperience - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureWindowsSpotlightOnLockScreen - - - - - - - - - - - - - - - - - - - text/plain - - - - - - InternetExplorer - - - - - - - - - - - - - - - - - - - - - AddSearchProvider - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowActiveXFiltering - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowAddOnList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowAutoComplete - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCertificateAddressMismatchWarning - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDeletingBrowsingHistoryOnExit - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnhancedProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnhancedSuggestionsInAddressBar - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnterpriseModeFromToolsMenu - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnterpriseModeSiteList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetExplorer7PolicyList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetExplorerStandardsMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowIntranetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownInternetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownIntranetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowOneWordEntry - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSiteToZoneAssignmentList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowsLockedDownTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSoftwareWhenSignatureIsInvalid - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowsRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSuggestedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - CheckServerCertificateRevocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - CheckSignaturesOnDownloadedPrograms - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConsistentMimeHandlingInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableAdobeFlash - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableBypassOfSmartScreenWarnings - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableBypassOfSmartScreenWarningsAboutUncommonFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCompatView - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableConfiguringHistory - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCrashDetection - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCustomerExperienceImprovementProgramParticipation - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDeletingUserVisitedWebsites - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableEnclosureDownloading - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableEncryptionSupport - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFeedsBackgroundSync - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFirstRunWizard - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFlipAheadFeature - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableGeolocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableHomePageChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableIgnoringCertificateErrors - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableInPrivateBrowsing - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableProcessesInEnhancedProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableProxyChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableSearchProviderChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableSecondaryHomePageChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableSecuritySettingsCheck - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableWebAddressAutoComplete - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotAllowActiveXControlsInProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotBlockOutdatedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotBlockOutdatedActiveXControlsOnSpecificDomains - - - - - - - - - - - - - - - - - - - text/plain - - - - - IncludeAllLocalSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - IncludeAllNetworkPaths - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneLogonOptions - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneUsePopupBlocker - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - MimeSniffingSafetyFeatureInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - MKProtocolSecurityRestrictionInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - NewTabDefaultPage - - - - - - - - - - - - - - - - - - - text/plain - - - - - NotificationBarInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventManagingSmartScreenFilter - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventPerUserInstallationOfActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - ProtectionFromZoneElevationInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - RemoveRunThisTimeButtonForOutdatedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictActiveXInstallInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowActiveScripting - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowBinaryAndScriptBehaviors - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowMETAREFRESH - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneLogonOptions - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneRunActiveXControlsAndPlugins - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneScriptingOfJavaApplets - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneTurnOnProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneUsePopupBlocker - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictFileDownloadInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScriptedWindowSecurityRestrictionsInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - SearchProviderList - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyUseOfActiveXInstallerService - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - - KioskBrowser - - - - - - - - - - - - - - - - - - - - - BlockedUrlExceptions - - - - - - - - List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. - - - - - - - - - - - text/plain - - - - - BlockedUrls - - - - - - - - List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. - - - - - - - - - - - text/plain - - - - - DefaultURL - - - - - - - - Configures the default URL kiosk browsers to navigate on launch and restart. - - - - - - - - - - - text/plain - - - - - EnableEndSessionButton - - - - - - - - Enable/disable kiosk browser's end session button. - - - - - - - - - - - text/plain - - - - - EnableHomeButton - - - - - - - - Enable/disable kiosk browser's home button. - - - - - - - - - - - text/plain - - - - - EnableNavigationButtons - - - - - - - - Enable/disable kiosk browser's navigation buttons (forward/back). - - - - - - - - - - - text/plain - - - - - RestartOnIdleTime - - - - - - - - Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. - - - - - - - - - - - text/plain - - - - - - Multitasking - - - - - - - - - - - - - - - - - - - - - BrowserAltTabBlowout - - - - - - - - Configures the inclusion of Edge tabs into Alt-Tab. - - - - - - - - - - - text/plain - - - - - - Notifications - - - - - - - - - - - - - - - - - - - - - DisallowNotificationMirroring - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowTileNotification - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Printers - - - - - - - - - - - - - - - - - - - - - PointAndPrintRestrictions_User - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Privacy - - - - - - - - - - - - - - - - - - - - - DisablePrivacyExperience - - - - - - - - Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. - - - - - - - - - - - text/plain - - - - - - Security - - - - - - - - - - - - - - - - - - - - - RecoveryEnvironmentAuthentication - - - - - - - - This policy controls the requirement of Admin Authentication in RecoveryEnvironment. - - - - - - - - - - - text/plain - - - - - - Settings - - - - - - - - - - - - - - - - - - - - - ConfigureTaskbarCalendar - - - - - - - - - - - - - - - - - - - text/plain - - - - - PageVisibilityList - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Start - - - - - - - - - - - - - - - - - - - - - DisableContextMenus - - - - - - - - Enabling this policy prevents context menus from being invoked in the Start Menu. - - - - - - - - - - - text/plain - - - - - ForceStartSize - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideAppList - - - - - - - - Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HideFrequentlyUsedApps - - - - - - - - Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HidePeopleBar - - - - - - - - Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. - - - - - - - - - - - text/plain - - - - - HideRecentJumplists - - - - - - - - Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HideRecentlyAddedApps - - - - - - - - Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - StartLayout - - - - - - - - - - - - - - - - - - - text/plain - - - - - - System - - - - - - - - - - - - - - - - - - - - - AllowTelemetry - - - - - - - - - - - - - - - - - - - text/plain - - - - - - WindowsPowerShell - - - - - - - - - - - - - - - - - - - - - TurnOnPowerShellScriptBlockLogging - - - - - - - - - - - - - - - - - - - text/plain - - - - - - - Result - - - - - - - - - - - - - - - - - - - ApplicationManagement - - - - - - - - - - - - - - - - - - - MSIAlwaysInstallWithElevatedPrivileges - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - MSI.admx - MSI~AT~WindowsComponents~MSI - AlwaysInstallElevated - HighestValueMostSecure - - - - RequirePrivateStoreOnly - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsStore.admx - WindowsStore~AT~WindowsComponents~WindowsStore - RequirePrivateStoreOnly - HighestValueMostSecure - - - - - AttachmentManager - - - - - - - - - - - - - - - - - - - DoNotPreserveZoneInformation - - - - - - - - - - - - - - - - - text/plain - - phone - AttachmentManager.admx - AttachmentManager~AT~WindowsComponents~AM_AM - AM_MarkZoneOnSavedAtttachments - LastWrite - - - - HideZoneInfoMechanism - - - - - - - - - - - - - - - - - text/plain - - phone - AttachmentManager.admx - AttachmentManager~AT~WindowsComponents~AM_AM - AM_RemoveZoneInfo - LastWrite - - - - NotifyAntivirusPrograms - - - - - - - - - - - - - - - - - text/plain - - phone - AttachmentManager.admx - AttachmentManager~AT~WindowsComponents~AM_AM - AM_CallIOfficeAntiVirus - LastWrite - - - - - Authentication - - - - - - - - - - - - - - - - - - - AllowEAPCertSSO - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - - Autoplay - - - - - - - - - - - - - - - - - - - DisallowAutoplayForNonVolumeDevices - - - - - - - - - - - - - - - - - text/plain - - phone - AutoPlay.admx - AutoPlay~AT~WindowsComponents~AutoPlay - NoAutoplayfornonVolume - LastWrite - - - - SetDefaultAutoRunBehavior - - - - - - - - - - - - - - - - - text/plain - - phone - AutoPlay.admx - AutoPlay~AT~WindowsComponents~AutoPlay - NoAutorun - LastWrite - - - - TurnOffAutoPlay - - - - - - - - - - - - - - - - - text/plain - - phone - AutoPlay.admx - AutoPlay~AT~WindowsComponents~AutoPlay - Autorun - LastWrite - - - - - Browser - - - - - - - - - - - - - - - - - - - AllowAddressBarDropdown - - - - - 1 - This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowAddressBarDropdown - LowestValueMostSecure - - - - AllowAutofill - - - - - 0 - This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowAutofill - LowestValueMostSecure - - - - AllowBrowser - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowConfigurationUpdateForBooksLibrary - - - - - 1 - This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowCookies - - - - - 2 - This setting lets you configure how your company deals with cookies. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - CookiesListBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - Cookies - LowestValueMostSecure - - - - AllowDeveloperTools - - - - - 1 - This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowDeveloperTools - LowestValueMostSecure - - - - AllowDoNotTrack - - - - - 0 - This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowDoNotTrack - LowestValueMostSecure - - - - AllowExtensions - - - - - 1 - This setting lets you decide whether employees can load extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowExtensions - LowestValueMostSecure - - - - AllowFlash - - - - - 1 - This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowFlash - HighestValueMostSecure - - - - AllowFlashClickToRun - - - - - 1 - Configure the Adobe Flash Click-to-Run setting. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowFlashClickToRun - HighestValueMostSecure - - - - AllowFullScreenMode - - - - - 1 - With this policy, you can specify whether to allow full-screen mode, which shows only the web content and hides the Microsoft Edge UI. - -If enabled or not configured, full-screen mode is available for use in Microsoft Edge. Your users and extensions must have the proper permissions. - -If disabled, full-screen mode is unavailable for use in Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowFullScreenMode - LowestValueMostSecure - - - - AllowInPrivate - - - - - 1 - This setting lets you decide whether employees can browse using InPrivate website browsing. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowInPrivate - LowestValueMostSecure - - - - AllowMicrosoftCompatibilityList - - - - - 1 - This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. - -If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. - -If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowCVList - LowestValueMostSecure - - - - AllowPasswordManager - - - - - 1 - This setting lets you decide whether employees can save their passwords locally, using Password Manager. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPasswordManager - LowestValueMostSecure - - - - AllowPopups - - - - - 0 - This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPopups - LowestValueMostSecure - - - - AllowPrelaunch - - - - - 1 - Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPrelaunch - LowestValueMostSecure - - - - AllowPrinting - - - - - 1 - With this policy, you can restrict whether printing web content in Microsoft Edge is allowed. - -If enabled, printing is allowed. - -If disabled, printing is not allowed. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPrinting - LowestValueMostSecure - - - - AllowSavingHistory - - - - - 1 - Microsoft Edge saves your user's browsing history, which is made up of info about the websites they visit, on their devices. - -If enabled or not configured, the browsing history is saved and visible in the History pane. - -If disabled, the browsing history stops saving and is not visible in the History pane. If browsing history exists before this policy was disabled, the previous browsing history remains visible in the History pane. This policy, when disabled, does not stop roaming of existing history or history coming from other roamed devices. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSavingHistory - LowestValueMostSecure - - - - AllowSearchEngineCustomization - - - - - 1 - Allow search engine customization for MDM enrolled devices. Users can change their default search engine. - -If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. -If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. - -This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSearchEngineCustomization - LowestValueMostSecure - - - - AllowSearchSuggestionsinAddressBar - - - - - 1 - This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSearchSuggestionsinAddressBar - LowestValueMostSecure - - - - AllowSideloadingOfExtensions - - - - - 1 - This setting lets you decide whether employees can sideload extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSideloadingOfExtensions - LowestValueMostSecure - - - - AllowSmartScreen - - - - - 1 - This setting lets you decide whether to turn on Windows Defender SmartScreen. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSmartScreen - LowestValueMostSecure - - - - AllowTabPreloading - - - - - 1 - Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowTabPreloading - LowestValueMostSecure - - - - AllowWebContentOnNewTabPage - - - - - 1 - This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. - -If you enable this setting, Microsoft Edge opens a new tab with the New Tab page. - -If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it. - -If you don't configure this setting, employees can choose how new tabs appears. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowWebContentOnNewTabPage - LowestValueMostSecure - - - - AlwaysEnableBooksLibrary - - - - - 0 - Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AlwaysEnableBooksLibrary - LowestValueMostSecure - - - - ClearBrowsingDataOnExit - - - - - 0 - Specifies whether to always clear browsing history on exiting Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowClearingBrowsingDataOnExit - LowestValueMostSecure - - - - ConfigureAdditionalSearchEngines - - - - - - Allows you to add up to 5 additional search engines for MDM-enrolled devices. - -If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. - -If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - MicrosoftEdge.admx - ConfigureAdditionalSearchEngines_Prompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureAdditionalSearchEngines - LastWrite - - - - ConfigureFavoritesBar - - - - - 0 - The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. - -If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. - -If disabled, the favorites bar is hidden, and the favorites bar toggle resets to Off, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. - -If not configured, the favorites bar is hidden but is visible on the Start and New Tab pages, and the favorites bar toggle in Settings sets to Off but is enabled allowing the user to make changes. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureFavoritesBar - LowestValueMostSecure - - - - ConfigureHomeButton - - - - - 0 - The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. - -By default, this policy is disabled or not configured and clicking the home button loads the default Start page. - -When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. - -If Enabled AND: -- Show home button & set to Start page is selected, clicking the home button loads the Start page. -- Show home button & set to New tab page is selected, clicking the home button loads a New tab page. -- Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. -- Hide home button is selected, the home button is hidden in Microsoft Edge. - -Default setting: Disabled or not configured -Related policies: -- Set Home Button URL -- Unlock Home Button - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureHomeButtonDropdown - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureHomeButton - LastWrite - - - - ConfigureKioskMode - - - - - 0 - Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. - -You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw). - -If enabled and set to 0 (Default or not configured): -- If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. -- If it’s one of many apps, Microsoft Edge runs as normal. -If enabled and set to 1: -- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. -- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureKioskMode_TextBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureKioskMode - LastWrite - - - - ConfigureKioskResetAfterIdleTimeout - - - - - 5 - You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user’s browsing data. - -If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. - -If you set this policy to 0, Microsoft Edge does not use an idle timer. - -If disabled or not configured, the default value is 5 minutes. - -If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureKioskResetAfterIdleTimeout_TextBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureKioskResetAfterIdleTimeout - LastWrite - - - - ConfigureOpenMicrosoftEdgeWith - - - - - 3 - You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. - -If enabled, you can choose one of the following options: -- Start page: the Start page loads ignoring the Configure Start Pages policy. -- New tab page: the New tab page loads ignoring the Configure Start Pages policy. -- Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. -- A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. - -When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. - -If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. - -Default setting: A specific page or pages (default) -Related policies: --Disable Lockdown of Start Pages --Configure Start Pages - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureOpenEdgeWithListBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureOpenEdgeWith - LastWrite - - - - ConfigureTelemetryForMicrosoft365Analytics - - - - - 0 - Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - ZonesListBox - MicrosoftEdge~AT~WindowsComponents~DataCollectionAndPreviewBuilds - ConfigureTelemetryForMicrosoft365Analytics - LowestValueMostSecure - - - - DisableLockdownOfStartPages - - - - - 0 - You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. - -If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Start Pages -- Configure Open Microsoft Edge With - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - DisableLockdownOfStartPagesListBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - DisableLockdownOfStartPages - LowestValueMostSecure - - - - EnableExtendedBooksTelemetry - - - - - 0 - This setting allows organizations to send extended telemetry on book usage from the Books Library. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - EnableExtendedBooksTelemetry - LowestValueMostSecure - - - - EnterpriseModeSiteList - - - - - - This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - EnterSiteListPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - EnterpriseModeSiteList - LastWrite - - - - EnterpriseSiteListServiceUrl - - - - - - - - - - - - - - - - - text/plain - - phone - LastWrite - - - - FirstRunURL - - - - - - Configure first run URL. - - - - - - - - - - - text/plain - - desktop - LastWrite - - - - HomePages - - - - - - When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. - -If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - - <support.contoso.com><support.microsoft.com> - -If disabled or not configured, the webpages specified in App settings loads as the default Start pages. - -Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. - -Version 1809: -If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Open Microsoft Edge With -- Disable Lockdown of Start Pages - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - HomePagesPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - HomePages - LastWrite - - - - LockdownFavorites - - - - - 0 - This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. - -If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - LockdownFavorites - LowestValueMostSecure - - - - PreventAccessToAboutFlagsInMicrosoftEdge - - - - - 0 - Prevent access to the about:flags page in Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventAccessToAboutFlagsInMicrosoftEdge - HighestValueMostSecure - - - - PreventCertErrorOverrides - - - - - 0 - Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors. - -If enabled, overriding certificate errors are not allowed. - -If disabled or not configured, overriding certificate errors are allowed. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventCertErrorOverrides - HighestValueMostSecure - - - - PreventFirstRunPage - - - - - 0 - Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventFirstRunPage - HighestValueMostSecure - - - - PreventLiveTileDataCollection - - - - - 0 - This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventLiveTileDataCollection - HighestValueMostSecure - - - - PreventSmartScreenPromptOverride - - - - - 0 - Don't allow Windows Defender SmartScreen warning overrides - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventSmartScreenPromptOverride - HighestValueMostSecure - - - - PreventSmartScreenPromptOverrideForFiles - - - - - 0 - Don't allow Windows Defender SmartScreen warning overrides for unverified files. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventSmartScreenPromptOverrideForFiles - HighestValueMostSecure - - - - PreventTurningOffRequiredExtensions - - - - - - You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. - -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. - -When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. - -If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. - -If disabled or not configured, extensions defined as part of this policy get ignored. - -Default setting: Disabled or not configured -Related policies: Allow Developer Tools -Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - PreventTurningOffRequiredExtensions_Prompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventTurningOffRequiredExtensions - LastWrite - - - - PreventUsingLocalHostIPAddressForWebRTC - - - - - 0 - Prevent using localhost IP address for WebRTC - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - HideLocalHostIPAddress - HighestValueMostSecure - - - - ProvisionFavorites - - - - - - This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. - -If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. - - - - - - - - - - - text/plain - - MicrosoftEdge.admx - ConfiguredFavoritesPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfiguredFavorites - LastWrite - - - - SendIntranetTraffictoInternetExplorer - - - - - 0 - Sends all intranet traffic over to Internet Explorer. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SendIntranetTraffictoInternetExplorer - HighestValueMostSecure - - - - SetDefaultSearchEngine - - - - - - Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. - -If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. - -If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - MicrosoftEdge.admx - SetDefaultSearchEngine_Prompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SetDefaultSearchEngine - LastWrite - - - - SetHomeButtonURL - - - - - - The home button can be configured to load a custom URL when your user clicks the home button. - -If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. - -Default setting: Blank or not configured -Related policy: Configure Home Button - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - SetHomeButtonURLPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SetHomeButtonURL - LastWrite - - - - SetNewTabPageURL - - - - - - You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. - -If enabled, you can set the default New Tab page URL. - -If disabled or not configured, the default Microsoft Edge new tab page is used. - -Default setting: Disabled or not configured -Related policy: Allow web content on New Tab page - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - SetNewTabPageURLPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SetNewTabPageURL - LastWrite - - - - ShowMessageWhenOpeningSitesInInternetExplorer - - - - - 0 - You can configure Microsoft Edge to open a site automatically in Internet Explorer 11 and choose to display a notification before the site opens. If you want to display a notification, you must enable Configure the Enterprise Mode Site List or Send all intranets sites to Internet Explorer 11 or both. - -If enabled, the notification appears on a new page. If you want users to continue in Microsoft Edge, select the Show Keep going in Microsoft Edge option from the drop-down list under Options. - -If disabled or not configured, the default app behavior occurs and no additional page displays. - -Default setting: Disabled or not configured -Related policies: --Configure the Enterprise Mode Site List --Send all intranet sites to Internet Explorer 11 - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ShowMessageWhenOpeningSitesInInternetExplorer - HighestValueMostSecure - - - - SyncFavoritesBetweenIEAndMicrosoftEdge - - - - - 0 - Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SyncFavoritesBetweenIEAndMicrosoftEdge - LowestValueMostSecure - - - - UnlockHomeButton - - - - - 0 - By default, when enabling Configure Home Button or Set Home Button URL, the home button is locked down to prevent your users from changing what page loads when clicking the home button. Use this policy to let users change the home button even when Configure Home Button or Set Home Button URL are enabled. - -If enabled, the UI settings for the home button are enabled allowing your users to make changes, including hiding and showing the home button as well as configuring a custom URL. - -If disabled or not configured, the UI settings for the home button are disabled preventing your users from making changes. - -Default setting: Disabled or not configured -Related policy: --Configure Home Button --Set Home Button URL - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - UnlockHomeButton - LowestValueMostSecure - - - - UseSharedFolderForBooks - - - - - 0 - This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - UseSharedFolderForBooks - LowestValueMostSecure - - - - - CredentialsUI - - - - - - - - - - - - - - - - - - - DisablePasswordReveal - - - - - - - - - - - - - - - - - text/plain - - phone - credui.admx - CredUI~AT~WindowsComponents~CredUI - DisablePasswordReveal - LastWrite - - - - - Desktop - - - - - - - - - - - - - - - - - - - PreventUserRedirectionOfProfileFolders - - - - - - - - - - - - - - - - - text/plain - - phone - desktop.admx - desktop~AT~Desktop - DisablePersonalDirChange - LastWrite - - - - - Display - - - - - - - - - - - - - - - - - - - EnablePerProcessDpi - - - - - - Enable or disable Per-Process System DPI for all applications. - - - - - - - - - - - text/plain - - - phone - Display.admx - DisplayGlobalPerProcessSystemDpiSettings - Display~AT~System~DisplayCat - DisplayPerProcessSystemDpiSettings - LowestValueMostSecure - - - - - Education - - - - - - - - - - - - - - - - - - - AllowGraphingCalculator - - - - - 1 - This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, users will be able to access graphing functionality. - - - - - - - - - - - text/plain - - - Programs.admx - Programs~AT~WindowsComponents~Calculator - AllowGraphingCalculator - LowestValueMostSecure - - - - DefaultPrinterName - - - - - - This policy sets user's default printer - - - - - - - - - - - text/plain - - LastWrite - - - - PreventAddingNewPrinters - - - - - 0 - Boolean that specifies whether or not to prevent user to install new printers - - - - - - - - - - - text/plain - - - Printing.admx - Printing~AT~ControlPanel~CplPrinters - NoAddPrinter - HighestValueMostSecure - - - - PrinterNames - - - - - - This policy provisions per-user network printers - - - - - - - - - - - text/plain - - LastWrite - - - - - EnterpriseCloudPrint - - - - - - - - - - - - - - - - - - - CloudPrinterDiscoveryEndPoint - - - - - - This policy provisions per-user discovery end point to discover cloud printers - - - - - - - - - - - text/plain - - LastWrite - - - - CloudPrintOAuthAuthority - - - - - - Authentication endpoint for acquiring OAuth tokens - - - - - - - - - - - text/plain - - LastWrite - - - - CloudPrintOAuthClientId - - - - - - A GUID identifying the client application authorized to retrieve OAuth tokens from the OAuthAuthority - - - - - - - - - - - text/plain - - LastWrite - - - - CloudPrintResourceId - - - - - - Resource URI for which access is being requested by the Enterprise Cloud Print client during OAuth authentication - - - - - - - - - - - text/plain - - LastWrite - - - - DiscoveryMaxPrinterLimit - - - - - 20 - Defines the maximum number of printers that should be queried from discovery end point - - - - - - - - - - - text/plain - - - LastWrite - - - - MopriaDiscoveryResourceId - - - - - - Resource URI for which access is being requested by the Mopria discovery client during OAuth authentication - - - - - - - - - - - text/plain - - LastWrite - - - - - Experience - - - - - - - - - - - - - - - - - - - AllowTailoredExperiencesWithDiagnosticData - - - - - 1 - - - - - - - - - - - - text/plain - - - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableTailoredExperiencesWithDiagnosticData - LowestValueMostSecure - - - - AllowThirdPartySuggestionsInWindowsSpotlight - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableThirdPartySuggestions - LowestValueMostSecure - - - - AllowWindowsSpotlight - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableWindowsSpotlightFeatures - LowestValueMostSecure - - - - AllowWindowsSpotlightOnActionCenter - - - - - 1 - - - - - - - - - - - - text/plain - - - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableWindowsSpotlightOnActionCenter - LowestValueMostSecure - - - - AllowWindowsSpotlightOnSettings - - - - - 1 - - - - - - - - - - - - text/plain - - - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableWindowsSpotlightOnSettings - LowestValueMostSecure - - - - AllowWindowsSpotlightWindowsWelcomeExperience - - - - - 1 - - - - - - - - - - - - text/plain - - - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableWindowsSpotlightWindowsWelcomeExperience - LowestValueMostSecure - - - - ConfigureWindowsSpotlightOnLockScreen - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - ConfigureWindowsSpotlight - LowestValueMostSecure - - - - - InternetExplorer - - - - - - - - - - - - - - - - - - - AddSearchProvider - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - AddSearchProvider - LastWrite - - - - AllowActiveXFiltering - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - TurnOnActiveXFiltering - LastWrite - - - - AllowAddOnList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - AddonManagement_AddOnList - LastWrite - - - - AllowAutoComplete - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - RestrictFormSuggestPW - LastWrite - - - - AllowCertificateAddressMismatchWarning - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyWarnCertMismatch - LastWrite - - - - AllowDeletingBrowsingHistoryOnExit - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory - DBHDisableDeleteOnExit - LastWrite - - - - AllowEnhancedProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_EnableEnhancedProtectedMode - LastWrite - - - - AllowEnhancedSuggestionsInAddressBar - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - AllowServicePoweredQSA - LastWrite - - - - AllowEnterpriseModeFromToolsMenu - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - EnterpriseModeEnable - LastWrite - - - - AllowEnterpriseModeSiteList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - EnterpriseModeSiteList - LastWrite - - - - AllowInternetExplorer7PolicyList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView - CompatView_UsePolicyList - LastWrite - - - - AllowInternetExplorerStandardsMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView - CompatView_IntranetSites - LastWrite - - - - AllowInternetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyInternetZoneTemplate - LastWrite - - - - AllowIntranetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyIntranetZoneTemplate - LastWrite - - - - AllowLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyLocalMachineZoneTemplate - LastWrite - - - - AllowLockedDownInternetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyInternetZoneLockdownTemplate - LastWrite - - - - AllowLockedDownIntranetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyIntranetZoneLockdownTemplate - LastWrite - - - - AllowLockedDownLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyLocalMachineZoneLockdownTemplate - LastWrite - - - - AllowLockedDownRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyRestrictedSitesZoneLockdownTemplate - LastWrite - - - - AllowOneWordEntry - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetSettings~Advanced~Browsing - UseIntranetSiteForOneWordEntry - LastWrite - - - - AllowSiteToZoneAssignmentList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_Zonemaps - LastWrite - - - - AllowsLockedDownTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyTrustedSitesZoneLockdownTemplate - LastWrite - - - - AllowSoftwareWhenSignatureIsInvalid - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_InvalidSignatureBlock - LastWrite - - - - AllowsRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyRestrictedSitesZoneTemplate - LastWrite - - - - AllowSuggestedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - EnableSuggestedSites - LastWrite - - - - AllowTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyTrustedSitesZoneTemplate - LastWrite - - - - CheckServerCertificateRevocation - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_CertificateRevocation - LastWrite - - - - CheckSignaturesOnDownloadedPrograms - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_DownloadSignatures - LastWrite - - - - ConsistentMimeHandlingInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryConsistentMimeHandling - IESF_PolicyExplorerProcesses_5 - LastWrite - - - - DisableActiveXVersionListAutoDownload - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VersionListAutomaticDownloadDisable - LastWrite - - - - DisableAdobeFlash - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - DisableFlashInIE - LastWrite - - - - DisableBypassOfSmartScreenWarnings - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - DisableSafetyFilterOverride - LastWrite - - - - DisableBypassOfSmartScreenWarningsAboutUncommonFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - DisableSafetyFilterOverrideForAppRepUnknown - LastWrite - - - - DisableCompatView - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView - CompatView_DisableList - LastWrite - - - - DisableConfiguringHistory - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory - RestrictHistory - LastWrite - - - - DisableCrashDetection - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - AddonManagement_RestrictCrashDetection - LastWrite - - - - DisableCustomerExperienceImprovementProgramParticipation - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - SQM_DisableCEIP - LastWrite - - - - DisableDeletingUserVisitedWebsites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory - DBHDisableDeleteHistory - LastWrite - - - - DisableEnclosureDownloading - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~RSS_Feeds - Disable_Downloading_of_Enclosures - LastWrite - - - - DisableEncryptionSupport - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_SetWinInetProtocols - LastWrite - - - - DisableFeedsBackgroundSync - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~RSS_Feeds - Disable_Background_Syncing - LastWrite - - - - DisableFirstRunWizard - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NoFirstRunCustomise - LastWrite - - - - DisableFlipAheadFeature - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_DisableFlipAhead - LastWrite - - - - DisableGeolocation - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - GeolocationDisable - LastWrite - - - - DisableHomePageChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - RestrictHomePage - LastWrite - - - - DisableIgnoringCertificateErrors - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL - NoCertError - LastWrite - - - - DisableInPrivateBrowsing - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryPrivacy - DisableInPrivateBrowsing - LastWrite - - - - DisableProcessesInEnhancedProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_EnableEnhancedProtectedMode64Bit - LastWrite - - - - DisableProxyChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - RestrictProxy - LastWrite - - - - DisableSearchProviderChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NoSearchProvider - LastWrite - - - - DisableSecondaryHomePageChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - SecondaryHomePages - LastWrite - - - - DisableSecuritySettingsCheck - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Disable_Security_Settings_Check - LastWrite - - - - DisableWebAddressAutoComplete - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - RestrictWebAddressSuggest - LastWrite - - - - DoNotAllowActiveXControlsInProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_DisableEPMCompat - LastWrite - - - - DoNotBlockOutdatedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDisable - LastWrite - - - - DoNotBlockOutdatedActiveXControlsOnSpecificDomains - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDomainAllowlist - LastWrite - - - - IncludeAllLocalSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_IncludeUnspecifiedLocalSites - LastWrite - - - - IncludeAllNetworkPaths - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_UNCAsIntranet - LastWrite - - - - InternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAccessDataSourcesAcrossDomains_1 - LastWrite - - - - InternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNotificationBarActiveXURLaction_1 - LastWrite - - - - InternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNotificationBarDownloadURLaction_1 - LastWrite - - - - InternetZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowPasteViaScript_1 - LastWrite - - - - InternetZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDropOrPasteFiles_1 - LastWrite - - - - InternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyFontDownload_1 - LastWrite - - - - InternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyZoneElevationURLaction_1 - LastWrite - - - - InternetZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_XAML_1 - LastWrite - - - - InternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_1 - LastWrite - - - - InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet - LastWrite - - - - InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowTDCControl_Both_Internet - LastWrite - - - - InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_WebBrowserControl_1 - LastWrite - - - - InternetZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyWindowsRestrictionsURLaction_1 - LastWrite - - - - InternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_AllowScriptlets_1 - LastWrite - - - - InternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_Phishing_1 - LastWrite - - - - InternetZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_ScriptStatusBar_1 - LastWrite - - - - InternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyUserdataPersistence_1 - LastWrite - - - - InternetZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowVBScript_1 - LastWrite - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_1 - LastWrite - - - - InternetZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDownloadSignedActiveX_1 - LastWrite - - - - InternetZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDownloadUnsignedActiveX_1 - LastWrite - - - - InternetZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyTurnOnXSSFilter_Both_Internet - LastWrite - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet - LastWrite - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet - LastWrite - - - - InternetZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyMimeSniffingURLaction_1 - LastWrite - - - - InternetZoneEnableProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_TurnOnProtectedMode_1 - LastWrite - - - - InternetZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_LocalPathForUpload_1 - LastWrite - - - - InternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyScriptActiveXNotMarkedSafe_1 - LastWrite - - - - InternetZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyJavaPermissions_1 - LastWrite - - - - InternetZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyLaunchAppsAndFilesInIFRAME_1 - LastWrite - - - - InternetZoneLogonOptions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyLogon_1 - LastWrite - - - - InternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNavigateSubframesAcrossDomains_1 - LastWrite - - - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicySignedFrameworkComponentsURLaction_1 - LastWrite - - - - InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_UnsafeFiles_1 - LastWrite - - - - InternetZoneUsePopupBlocker - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyBlockPopupWindows_1 - LastWrite - - - - IntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyAccessDataSourcesAcrossDomains_3 - LastWrite - - - - IntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyNotificationBarActiveXURLaction_3 - LastWrite - - - - IntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyNotificationBarDownloadURLaction_3 - LastWrite - - - - IntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyFontDownload_3 - LastWrite - - - - IntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyZoneElevationURLaction_3 - LastWrite - - - - IntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_3 - LastWrite - - - - IntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_Policy_AllowScriptlets_3 - LastWrite - - - - IntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_Policy_Phishing_3 - LastWrite - - - - IntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyUserdataPersistence_3 - LastWrite - - - - IntranetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_3 - LastWrite - - - - IntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyScriptActiveXNotMarkedSafe_3 - LastWrite - - - - IntranetZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyJavaPermissions_3 - LastWrite - - - - IntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyNavigateSubframesAcrossDomains_3 - LastWrite - - - - LocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyAccessDataSourcesAcrossDomains_9 - LastWrite - - - - LocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyNotificationBarActiveXURLaction_9 - LastWrite - - - - LocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyNotificationBarDownloadURLaction_9 - LastWrite - - - - LocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyFontDownload_9 - LastWrite - - - - LocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyZoneElevationURLaction_9 - LastWrite - - - - LocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_9 - LastWrite - - - - LocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_Policy_AllowScriptlets_9 - LastWrite - - - - LocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_Policy_Phishing_9 - LastWrite - - - - LocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyUserdataPersistence_9 - LastWrite - - - - LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_9 - LastWrite - - - - LocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyScriptActiveXNotMarkedSafe_9 - LastWrite - - - - LocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyJavaPermissions_9 - LastWrite - - - - LocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyNavigateSubframesAcrossDomains_9 - LastWrite - - - - LockedDownInternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_2 - LastWrite - - - - LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyFontDownload_2 - LastWrite - - - - LockedDownInternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyZoneElevationURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_Policy_AllowScriptlets_2 - LastWrite - - - - LockedDownInternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_Policy_Phishing_2 - LastWrite - - - - LockedDownInternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyUserdataPersistence_2 - LastWrite - - - - LockedDownInternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_2 - LastWrite - - - - LockedDownInternetZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyJavaPermissions_2 - LastWrite - - - - LockedDownInternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_2 - LastWrite - - - - LockedDownIntranetJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyJavaPermissions_4 - LastWrite - - - - LockedDownIntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_4 - LastWrite - - - - LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyFontDownload_4 - LastWrite - - - - LockedDownIntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyZoneElevationURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_Policy_AllowScriptlets_4 - LastWrite - - - - LockedDownIntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_Policy_Phishing_4 - LastWrite - - - - LockedDownIntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyUserdataPersistence_4 - LastWrite - - - - LockedDownIntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_4 - LastWrite - - - - LockedDownIntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_4 - LastWrite - - - - LockedDownLocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyFontDownload_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyZoneElevationURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_Policy_AllowScriptlets_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_Policy_Phishing_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyUserdataPersistence_10 - LastWrite - - - - LockedDownLocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_10 - LastWrite - - - - LockedDownLocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyJavaPermissions_10 - LastWrite - - - - LockedDownLocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_10 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyFontDownload_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyZoneElevationURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_Policy_AllowScriptlets_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_Policy_Phishing_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyUserdataPersistence_8 - LastWrite - - - - LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_8 - LastWrite - - - - LockedDownRestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyJavaPermissions_8 - LastWrite - - - - LockedDownRestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_8 - LastWrite - - - - LockedDownTrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyFontDownload_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyZoneElevationURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_Policy_AllowScriptlets_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_Policy_Phishing_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyUserdataPersistence_6 - LastWrite - - - - LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_6 - LastWrite - - - - LockedDownTrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyJavaPermissions_6 - LastWrite - - - - LockedDownTrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_6 - LastWrite - - - - MimeSniffingSafetyFeatureInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMimeSniffingSafetyFeature - IESF_PolicyExplorerProcesses_6 - LastWrite - - - - MKProtocolSecurityRestrictionInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMKProtocolSecurityRestriction - IESF_PolicyExplorerProcesses_3 - LastWrite - - - - NewTabDefaultPage - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NewTabAction - LastWrite - - - - NotificationBarInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryInformationBar - IESF_PolicyExplorerProcesses_10 - LastWrite - - - - PreventManagingSmartScreenFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Disable_Managing_Safety_Filter_IE9 - LastWrite - - - - PreventPerUserInstallationOfActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - DisablePerUserActiveXInstall - LastWrite - - - - ProtectionFromZoneElevationInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation - IESF_PolicyExplorerProcesses_9 - LastWrite - - - - RemoveRunThisTimeButtonForOutdatedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDisableRunThisTime - LastWrite - - - - RestrictActiveXInstallInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall - IESF_PolicyExplorerProcesses_11 - LastWrite - - - - RestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAccessDataSourcesAcrossDomains_7 - LastWrite - - - - RestrictedSitesZoneAllowActiveScripting - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyActiveScripting_7 - LastWrite - - - - RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNotificationBarActiveXURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNotificationBarDownloadURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowBinaryAndScriptBehaviors - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyBinaryBehaviors_7 - LastWrite - - - - RestrictedSitesZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowPasteViaScript_7 - LastWrite - - - - RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDropOrPasteFiles_7 - LastWrite - - - - RestrictedSitesZoneAllowFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyFileDownload_7 - LastWrite - - - - RestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyFontDownload_7 - LastWrite - - - - RestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyZoneElevationURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_XAML_7 - LastWrite - - - - RestrictedSitesZoneAllowMETAREFRESH - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowMETAREFRESH_7 - LastWrite - - - - RestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted - LastWrite - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowTDCControl_Both_Restricted - LastWrite - - - - RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_WebBrowserControl_7 - LastWrite - - - - RestrictedSitesZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyWindowsRestrictionsURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_AllowScriptlets_7 - LastWrite - - - - RestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_Phishing_7 - LastWrite - - - - RestrictedSitesZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_ScriptStatusBar_7 - LastWrite - - - - RestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyUserdataPersistence_7 - LastWrite - - - - RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowVBScript_7 - LastWrite - - - - RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_7 - LastWrite - - - - RestrictedSitesZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDownloadSignedActiveX_7 - LastWrite - - - - RestrictedSitesZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDownloadUnsignedActiveX_7 - LastWrite - - - - RestrictedSitesZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyTurnOnXSSFilter_Both_Restricted - LastWrite - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted - LastWrite - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted - LastWrite - - - - RestrictedSitesZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyMimeSniffingURLaction_7 - LastWrite - - - - RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_LocalPathForUpload_7 - LastWrite - - - - RestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_7 - LastWrite - - - - RestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyJavaPermissions_7 - LastWrite - - - - RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyLaunchAppsAndFilesInIFRAME_7 - LastWrite - - - - RestrictedSitesZoneLogonOptions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyLogon_7 - LastWrite - - - - RestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNavigateSubframesAcrossDomains_7 - LastWrite - - - - RestrictedSitesZoneRunActiveXControlsAndPlugins - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyRunActiveXControls_7 - LastWrite - - - - RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicySignedFrameworkComponentsURLaction_7 - LastWrite - - - - RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyScriptActiveXMarkedSafe_7 - LastWrite - - - - RestrictedSitesZoneScriptingOfJavaApplets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyScriptingOfJavaApplets_7 - LastWrite - - - - RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_UnsafeFiles_7 - LastWrite - - - - RestrictedSitesZoneTurnOnProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_TurnOnProtectedMode_7 - LastWrite - - - - RestrictedSitesZoneUsePopupBlocker - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyBlockPopupWindows_7 - LastWrite - - - - RestrictFileDownloadInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload - IESF_PolicyExplorerProcesses_12 - LastWrite - - - - ScriptedWindowSecurityRestrictionsInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions - IESF_PolicyExplorerProcesses_8 - LastWrite - - - - SearchProviderList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - SpecificSearchProvider - LastWrite - - - - SpecifyUseOfActiveXInstallerService - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - OnlyUseAXISForActiveXInstall - LastWrite - - - - TrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAccessDataSourcesAcrossDomains_5 - LastWrite - - - - TrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyNotificationBarActiveXURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyNotificationBarDownloadURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyFontDownload_5 - LastWrite - - - - TrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyZoneElevationURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_Policy_AllowScriptlets_5 - LastWrite - - - - TrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_Policy_Phishing_5 - LastWrite - - - - TrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyUserdataPersistence_5 - LastWrite - - - - TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 - LastWrite - - - - TrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 - LastWrite - - - - TrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyJavaPermissions_5 - LastWrite - - - - TrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyNavigateSubframesAcrossDomains_5 - LastWrite - - - - - KioskBrowser - - - - - - - - - - - - - - - - - - - BlockedUrlExceptions - - - - - - List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - BlockedUrls - - - - - - List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - DefaultURL - - - - - - Configures the default URL kiosk browsers to navigate on launch and restart. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - EnableEndSessionButton - - - - - 0 - Enable/disable kiosk browser's end session button. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - EnableHomeButton - - - - - 0 - Enable/disable kiosk browser's home button. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - EnableNavigationButtons - - - - - 0 - Enable/disable kiosk browser's navigation buttons (forward/back). - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - RestartOnIdleTime - - - - - 0 - Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - - Multitasking - - - - - - - - - - - - - - - - - - - BrowserAltTabBlowout - - - - - 1 - Configures the inclusion of Edge tabs into Alt-Tab. - - - - - - - - - - - text/plain - - - phone - multitasking.admx - AltTabFilterDropdown - multitasking~AT~WindowsComponents~MULTITASKING - MultiTaskingAltTabFilter - LastWrite - - - - - Notifications - - - - - - - - - - - - - - - - - - - DisallowNotificationMirroring - - - - - 0 - - - - - - - - - - - - text/plain - - - WPN.admx - WPN~AT~StartMenu~NotificationsCategory - NoNotificationMirroring - LowestValueMostSecure - - - - DisallowTileNotification - - - - - 0 - - - - - - - - - - - - text/plain - - - WPN.admx - WPN~AT~StartMenu~NotificationsCategory - NoTileNotification - LowestValueMostSecure - - - - - Printers - - - - - - - - - - - - - - - - - - - PointAndPrintRestrictions_User - - - - - - - - - - - - - - - - - text/plain - - phone - Printing.admx - Printing~AT~ControlPanel~CplPrinters - PointAndPrint_Restrictions - LastWrite - - - - - Privacy - - - - - - - - - - - - - - - - - - - DisablePrivacyExperience - - - - - 0 - Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. - - - - - - - - - - - text/plain - - - phone - OOBE.admx - OOBE~AT~WindowsComponents~OOBE - DisablePrivacyExperience - LowestValueMostSecure - - - - - Security - - - - - - - - - - - - - - - - - - - RecoveryEnvironmentAuthentication - - - - - 0 - This policy controls the requirement of Admin Authentication in RecoveryEnvironment. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - - Settings - - - - - - - - - - - - - - - - - - - ConfigureTaskbarCalendar - - - - - 0 - - - - - - - - - - - - text/plain - - - Taskbar.admx - Taskbar~AT~StartMenu~TPMCategory - ConfigureTaskbarCalendar - LastWrite - - - - PageVisibilityList - - - - - - - - - - - - - - - - - text/plain - - ControlPanel.admx - SettingsPageVisibilityBox - ControlPanel~AT~ControlPanel - SettingsPageVisibility - LastWrite - - - - - Start - - - - - - - - - - - - - - - - - - - DisableContextMenus - - - - - 0 - Enabling this policy prevents context menus from being invoked in the Start Menu. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - DisableContextMenusInStart - LowestValueMostSecure - - - - ForceStartSize - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - ForceStartSize - LastWrite - - - - HideAppList - - - - - 0 - Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - HideFrequentlyUsedApps - - - - - 0 - Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - NoFrequentUsedPrograms - LowestValueMostSecure - - - - HidePeopleBar - - - - - 0 - Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - HidePeopleBar - LowestValueMostSecure - - - - HideRecentJumplists - - - - - 0 - Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - NoRecentDocsHistory - LowestValueMostSecure - - - - HideRecentlyAddedApps - - - - - 0 - Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - HideRecentlyAddedApps - LowestValueMostSecure - - - - StartLayout - - - - - - - - - - - - - - - - - text/plain - - phone - StartMenu.admx - StartMenu~AT~StartMenu - LockedStartLayout - LastWrite - - - - - System - - - - - - - - - - - - - - - - - - - AllowTelemetry - - - - - 3 - - - - - - - - - - - - text/plain - - - DataCollection.admx - AllowTelemetry - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - AllowTelemetry - LowestValueMostSecure - - - - - WindowsPowerShell - - - - - - - - - - - - - - - - - - - TurnOnPowerShellScriptBlockLogging - - - - - - - - - - - - - - - - - text/plain - - phone - PowerShellExecutionPolicy.admx - PowerShellExecutionPolicy~AT~WindowsComponents~PowerShell - EnableScriptBlockLogging - LastWrite - - - - - - - Policy - ./Device/Vendor/MSFT - - - - - - - - - - - - - - - com.microsoft/10.0/MDM/Policy - - - - ConfigOperations - - - - - - - Policy CSP ConfigOperations - - - - - - - - - - - - - - - ADMXInstall - - - - - - - Win32 App ADMX Ingestion - - - - - - - - - - - - - - - * - - - - - - - Win32 App Name - - - - - - - - - - - - - - - Properties - - - - - - - Properties of Win32 App ADMX Ingestion - - - - - - - - - - - - - - - * - - - - - - - Setting Type of Win32 App. Policy Or Preference - - - - - - - - - - - - - - - * - - - - - - - Unique ID of ADMX file - - - - - - - - - - - - - - - Version - - - - - - - - Version of ADMX file - - - - - - - - - - - - - - - - - - - * - - - - - - - Setting Type of Win32 App. Policy Or Preference - - - - - - - - - - - - - - - * - - - - - - - - Unique ID of ADMX file - - - - - - - - - - - - - - - - - - - - Config - - - - - - - - - - - - - - - - - - - - - AboveLock - - - - - - - - - - - - - - - - - - - - - AllowActionCenterNotifications - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCortanaAboveLock - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowToasts - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Accounts - - - - - - - - - - - - - - - - - - - - - AllowAddingNonMicrosoftAccountsManually - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowMicrosoftAccountConnection - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowMicrosoftAccountSignInAssistant - - - - - - - - - - - - - - - - - - - text/plain - - - - - DomainNamesForEmailSync - - - - - - - - - - - - - - - - - - - text/plain - - - - - - ActiveXControls - - - - - - - - - - - - - - - - - - - - - ApprovedInstallationSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - - ApplicationDefaults - - - - - - - - - - - - - - - - - - - - - DefaultAssociationsConfiguration - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableAppUriHandlers - - - - - - - - Enables web-to-app linking, which allows apps to be launched with a http(s) URI - - - - - - - - - - - text/plain - - - - - - ApplicationManagement - - - - - - - - - - - - - - - - - - - - - AllowAllTrustedApps - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowAppStoreAutoUpdate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDeveloperUnlock - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowGameDVR - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSharedUserAppData - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStore - - - - - - - - - - - - - - - - - - - text/plain - - - - - ApplicationRestrictions - - - - - - - - - - - - - - - - - - - text/plain - - - - - BlockNonAdminUserInstall - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableStoreOriginatedApps - - - - - - - - - - - - - - - - - - - text/plain - - - - - LaunchAppAfterLogOn - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are to be launched after logon. - - - - - - - - - - - text/plain - - - - - MSIAllowUserControlOverInstall - - - - - - - - - - - - - - - - - - - text/plain - - - - - MSIAlwaysInstallWithElevatedPrivileges - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequirePrivateStoreOnly - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictAppDataToSystemVolume - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictAppToSystemVolume - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduleForceRestartForUpdateFailures - - - - - - - - - - - - - - - - - - - text/plain - - - - - - AppRuntime - - - - - - - - - - - - - - - - - - - - - AllowMicrosoftAccountsToBeOptional - - - - - - - - - - - - - - - - - - - text/plain - - - - - - AppVirtualization - - - - - - - - - - - - - - - - - - - - - AllowAppVClient - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDynamicVirtualization - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPackageCleanup - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPackageScripts - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPublishingRefreshUX - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowReportingServer - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowRoamingFileExclusions - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowRoamingRegistryExclusions - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStreamingAutoload - - - - - - - - - - - - - - - - - - - text/plain - - - - - ClientCoexistenceAllowMigrationmode - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntegrationAllowRootGlobal - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntegrationAllowRootUser - - - - - - - - - - - - - - - - - - - text/plain - - - - - PublishingAllowServer1 - - - - - - - - - - - - - - - - - - - text/plain - - - - - PublishingAllowServer2 - - - - - - - - - - - - - - - - - - - text/plain - - - - - PublishingAllowServer3 - - - - - - - - - - - - - - - - - - - text/plain - - - - - PublishingAllowServer4 - - - - - - - - - - - - - - - - - - - text/plain - - - - - PublishingAllowServer5 - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowCertificateFilterForClient_SSL - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowHighCostLaunch - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowLocationProvider - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowPackageInstallationRoot - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowPackageSourceRoot - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowReestablishmentInterval - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingAllowReestablishmentRetries - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingSharedContentStoreMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingSupportBranchCache - - - - - - - - - - - - - - - - - - - text/plain - - - - - StreamingVerifyCertificateRevocationList - - - - - - - - - - - - - - - - - - - text/plain - - - - - VirtualComponentsAllowList - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Audit - - - - - - - - - - - - - - - - - - - - - AccountLogon_AuditCredentialValidation - - - - - - - - This policy setting allows you to audit events generated by validation tests on user account logon credentials. - -Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. - - - - - - - - - - - text/plain - - - - - AccountLogon_AuditKerberosAuthenticationService - - - - - - - - This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. - -If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. - - - - - - - - - - - text/plain - - - - - AccountLogon_AuditKerberosServiceTicketOperations - - - - - - - - This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. - -If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. - - - - - - - - - - - text/plain - - - - - AccountLogon_AuditOtherAccountLogonEvents - - - - - - - - This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. - -Currently, there are no events in this subcategory. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditAccountLockout - - - - - - - - This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. - -If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. - -Logon events are essential for understanding user activity and to detect potential attacks. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditGroupMembership - - - - - - - - This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. - -When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditIPsecExtendedMode - - - - - - - - This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. - -If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditIPsecMainMode - - - - - - - - This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. - -If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditIPsecQuickMode - - - - - - - - This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. - -If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If - you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditLogoff - - - - - - - - This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. - -If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. -If you do not configure this policy setting, no audit event is generated when a logon session is closed. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditLogon - - - - - - - - This policy setting allows you to audit events generated by user account logon attempts on the computer. -Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. - Failed logon attempts. - Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. - Security identifiers (SIDs) were filtered and not allowed to log on. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditNetworkPolicyServer - - - - - - - - This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. -If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. -If you do not configure this policy settings, IAS and NAP user access requests are not audited. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditOtherLogonLogoffEvents - - - - - - - - This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. - Invoking a screen saver. - Dismissal of a screen saver. - Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. - Access to a wireless network granted to a user or computer account. - Access to a wired 802.1x network granted to a user or computer account. - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditSpecialLogon - - - - - - - - This policy setting allows you to audit events generated by special logons such as the following : - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). - - - - - - - - - - - text/plain - - - - - AccountLogonLogoff_AuditUserDeviceClaims - - - - - - - - This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. - -User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. - -When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. - - - - - - - - - - - text/plain - - - - - AccountManagement_AuditApplicationGroupManagement - - - - - - - - This policy setting allows you to audit events generated by changes to application groups such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. - -If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an application group changes. - - - - - - - - - - - text/plain - - - - - AccountManagement_AuditComputerAccountManagement - - - - - - - - This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. - -If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a computer account changes. - - - - - - - - - - - text/plain - - - - - AccountManagement_AuditDistributionGroupManagement - - - - - - - - This policy setting allows you to audit events generated by changes to distribution groups such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. - -If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a distribution group changes. - -Note: Events in this subcategory are logged only on domain controllers. - - - - - - - - - - - text/plain - - - - - AccountManagement_AuditOtherAccountManagementEvents - - - - - - - - This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: -Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy -Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy - - - - - - - - - - - text/plain - - - - - AccountManagement_AuditSecurityGroupManagement - - - - - - - - This policy setting allows you to audit events generated by changes to security groups such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. - -If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a security group changes. - - - - - - - - - - - text/plain - - - - - AccountManagement_AuditUserAccountManagement - - - - - - - - This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. - A security identifier (SID) is added to the SID History of a user account. - The Directory Services Restore Mode password is configured. - Permissions on administrative user accounts are changed. - Credential Manager credentials are backed up or restored. - -If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. - - - - - - - - - - - text/plain - - - - - DetailedTracking_AuditDPAPIActivity - - - - - - - - This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. - -If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. - - - - - - - - - - - text/plain - - - - - DetailedTracking_AuditPNPActivity - - - - - - - - This policy setting allows you to audit when plug and play detects an external device. - -If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. -If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. - - - - - - - - - - - text/plain - - - - - DetailedTracking_AuditProcessCreation - - - - - - - - This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. - -If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a process is created. - - - - - - - - - - - text/plain - - - - - DetailedTracking_AuditProcessTermination - - - - - - - - This policy setting allows you to audit events generated when a process ends. - -If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a process ends. - - - - - - - - - - - text/plain - - - - - DetailedTracking_AuditRPCEvents - - - - - - - - This policy setting allows you to audit inbound remote procedure call (RPC) connections. - -If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. - - - - - - - - - - - text/plain - - - - - DetailedTracking_AuditTokenRightAdjusted - - - - - - - - This policy setting allows you to audit events generated by adjusting the privileges of a token. - - - - - - - - - - - text/plain - - - - - DSAccess_AuditDetailedDirectoryServiceReplication - - - - - - - - This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. - - - - - - - - - - - text/plain - - - - - DSAccess_AuditDirectoryServiceAccess - - - - - - - - This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. - -Only AD DS objects with a matching system access control list (SACL) are logged. - -Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. - - - - - - - - - - - text/plain - - - - - DSAccess_AuditDirectoryServiceChanges - - - - - - - - This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. - -When possible, events logged in this subcategory indicate the old and new values of the object’s properties. - -Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. - -Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. - -If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. -If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. - - - - - - - - - - - text/plain - - - - - DSAccess_AuditDirectoryServiceReplication - - - - - - - - This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. - -If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. -If you do not configure this policy setting, no audit event is generated during AD DS replication. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditApplicationGenerated - - - - - - - - This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. -Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. - Initialization of an application client context. - Other application operations using the Windows Auditing APIs. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditCentralAccessPolicyStaging - - - - - - - - This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. - -If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: -1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. -2) Failure audits when configured records access attempts when: - a) The current central access policy does not grant access but the proposed policy grants access. - b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. - -Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditCertificationServices - - - - - - - - This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. -AD CS operations include the following: - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. - Issuing of a certificate. - Revocation of a certificate. - Changes to the Certificate Manager settings for AD CS. - Changes in the configuration of AD CS. - Changes to a Certificate Services template. - Importing of a certificate. - Publishing of a certification authority certificate is to Active Directory Domain Services. - Changes to the security permissions for AD CS. - Archival of a key. - Importing of a key. - Retrieval of a key. - Starting of Online Certificate Status Protocol (OCSP) Responder Service. - Stopping of Online Certificate Status Protocol (OCSP) Responder Service. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditDetailedFileShare - - - - - - - - This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. - -If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. - -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditFileShare - - - - - - - - This policy setting allows you to audit attempts to access a shared folder. - -If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. - -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditFileSystem - - - - - - - - This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. - -If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. - -Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditFilteringPlatformConnection - - - - - - - - This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits a bind to a local port. - The WFP blocks a bind to a local port. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits an application or service to listen on a port for incoming connections. - The WFP blocks an application or service to listen on a port for incoming connections. - -If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. -If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditFilteringPlatformPacketDrop - - - - - - - - This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditHandleManipulation - - - - - - - - This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. - -If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a handle is manipulated. - -Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditKernelObject - - - - - - - - This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. -Only kernel objects with a matching system access control list (SACL) generate security audit events. - -Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditOtherObjectAccessEvents - - - - - - - - This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. -For scheduler jobs, the following are audited: - Job created. - Job deleted. - Job enabled. - Job disabled. - Job updated. -For COM+ objects, the following are audited: - Catalog object added. - Catalog object updated. - Catalog object deleted. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditRegistry - - - - - - - - This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. - -If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. - -Note: You can set a SACL on a registry object using the Permissions dialog box. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditRemovableStorage - - - - - - - - This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. - -If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. - -If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. - - - - - - - - - - - text/plain - - - - - ObjectAccess_AuditSAM - - - - - - - - This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. -SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. - SAM_USER – A user account. - SAM_DOMAIN – A domain. - SAM_SERVER – A computer account. -If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. -Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. -Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). - - - - - - - - - - - text/plain - - - - - PolicyChange_AuditAuthenticationPolicyChange - - - - - - - - This policy setting allows you to audit events generated by changes to the authentication policy such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. - Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. - Granting of any of the following user rights to a user or group: - Access This Computer From the Network. - Allow Logon Locally. - Allow Logon Through Terminal Services. - Logon as a Batch Job. - Logon a Service. - Namespace collision. For example, when a new trust has the same name as an existing namespace name. - -If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. - -Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. - - - - - - - - - - - text/plain - - - - - PolicyChange_AuditAuthorizationPolicyChange - - - - - - - - This policy setting allows you to audit events generated by changes to the authorization policy such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. - Changes to the Resource attributes of an object. - Changes to the Central Access Policy (CAP) applied to an object. - -If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when the authorization policy changes. - - - - - - - - - - - text/plain - - - - - PolicyChange_AuditFilteringPlatformPolicyChange - - - - - - - - This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. - Changes to WFP providers and engine. - -If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. - - - - - - - - - - - text/plain - - - - - PolicyChange_AuditMPSSVCRuleLevelPolicyChange - - - - - - - - This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. - Changes to Windows Firewall exception list. - Changes to Windows Firewall settings. - Rules ignored or not applied by Windows Firewall Service. - Changes to Windows Firewall Group Policy settings. - -If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. - - - - - - - - - - - text/plain - - - - - PolicyChange_AuditOtherPolicyChangeEvents - - - - - - - - This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. - Cryptographic context operations or modifications. - Applied Central Access Policies (CAPs) changes. - Boot Configuration Data (BCD) modifications. - - - - - - - - - - - text/plain - - - - - PolicyChange_AuditPolicyChange - - - - - - - - This policy setting allows you to audit changes in the security audit policy settings such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. - De-registration of security event sources. - Changes to the per-user audit settings. - Changes to the value of CrashOnAuditFail. - Changes to the system access control list on a file system or registry object. - Changes to the Special Groups list. - -Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. - - - - - - - - - - - text/plain - - - - - PrivilegeUse_AuditNonSensitivePrivilegeUse - - - - - - - - This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). -The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. - Add workstations to domain. - Adjust memory quotas for a process. - Allow log on locally. - Allow log on through Terminal Services. - Bypass traverse checking. - Change the system time. - Create a pagefile. - Create global objects. - - Create permanent shared objects. - Create symbolic links. - Deny access this computer from the network. - Deny log on as a batch job. - Deny log on as a service. - Deny log on locally. - Deny log on through Terminal Services. - Force shutdown from a remote system. - Increase a process working set. - Increase scheduling priority. - Lock pages in memory. - Log on as a batch job. - Log on as a service. - Modify an object label. - Perform volume maintenance tasks. - Profile single process. - Profile system performance. - Remove computer from docking station. - Shut down the system. - Synchronize directory service data. - -If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. -If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. - - - - - - - - - - - text/plain - - - - - PrivilegeUse_AuditOtherPrivilegeUseEvents - - - - - - - - Not used. - - - - - - - - - - - text/plain - - - - - PrivilegeUse_AuditSensitivePrivilegeUse - - - - - - - - This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. - Back up files and directories. - Create a token object. - Debug programs. - Enable computer and user accounts to be trusted for delegation. - Generate security audits. - Impersonate a client after authentication. - Load and unload device drivers. - Manage auditing and security log. - Modify firmware environment values. - Replace a process-level token. - Restore files and directories. - Take ownership of files or other objects. - -If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. - - - - - - - - - - - - text/plain - - - - - System_AuditIPsecDriver - - - - - - - - This policy setting allows you to audit events generated by the IPsec filter driver such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. - Network packets dropped due to being in plaintext. - Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. - Inability to process IPsec filters. - -If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. - - - - - - - - - - - text/plain - - - - - System_AuditOtherSystemEvents - - - - - - - - This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. - - - - - - - - - - - text/plain - - - - - System_AuditSecurityStateChange - - - - - - - - This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. - - - - - - - - - - - text/plain - - - - - System_AuditSecuritySystemExtension - - - - - - - - This policy setting allows you to audit events related to security system extensions or services such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. -If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. - - - - - - - - - - - text/plain - - - - - System_AuditSystemIntegrity - - - - - - - - This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. - The detection of a hash value of an executable file that is not valid as determined by Code Integrity. - Cryptographic operations that compromise system integrity. - - - - - - - - - - - text/plain - - - - - - Authentication - - - - - - - - - - - - - - - - - - - - - AllowAadPasswordReset - - - - - - - - Specifies whether password reset is enabled for AAD accounts. - - - - - - - - - - - text/plain - - - - - AllowFastReconnect - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSecondaryAuthenticationDevice - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureWebcamAccessDomainNames - - - - - - - - Specifies a list of domains that are allowed to access the webcam in CXH-based authentication scenarios. - - - - - - - - - - - text/plain - - - - - EnableFastFirstSignIn - - - - - - - - Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts - - - - - - - - - - - text/plain - - - - - EnableWebSignIn - - - - - - - - Specifies whether web-based sign in is allowed for logging in to Windows - - - - - - - - - - - text/plain - - - - - PreferredAadTenantDomainName - - - - - - - - Specifies the preferred domain among available domains in the AAD tenant. - - - - - - - - - - - text/plain - - - - - - Autoplay - - - - - - - - - - - - - - - - - - - - - DisallowAutoplayForNonVolumeDevices - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetDefaultAutoRunBehavior - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOffAutoPlay - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Bitlocker - - - - - - - - - - - - - - - - - - - - - EncryptionMethod - - - - - - - - - - - - - - - - - - - text/plain - - - - - - BITS - - - - - - - - - - - - - - - - - - - - - BandwidthThrottlingEndTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - BandwidthThrottlingStartTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - BandwidthThrottlingTransferRate - - - - - - - - - - - - - - - - - - - text/plain - - - - - CostedNetworkBehaviorBackgroundPriority - - - - - - - - - - - - - - - - - - - text/plain - - - - - CostedNetworkBehaviorForegroundPriority - - - - - - - - - - - - - - - - - - - text/plain - - - - - JobInactivityTimeout - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Bluetooth - - - - - - - - - - - - - - - - - - - - - AllowAdvertising - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDiscoverableMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPrepairing - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPromptedProximalConnections - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalDeviceName - - - - - - - - - - - - - - - - - - - text/plain - - - - - ServicesAllowedList - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetMinimumEncryptionKeySize - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Browser - - - - - - - - - - - - - - - - - - - - - AllowAddressBarDropdown - - - - - - - - This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. - - - - - - - - - - - text/plain - - - - - AllowAutofill - - - - - - - - This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowBrowser - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowConfigurationUpdateForBooksLibrary - - - - - - - - This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. - - - - - - - - - - - text/plain - - - - - AllowCookies - - - - - - - - This setting lets you configure how your company deals with cookies. - - - - - - - - - - - text/plain - - - - - AllowDeveloperTools - - - - - - - - This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowDoNotTrack - - - - - - - - This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. - - - - - - - - - - - text/plain - - - - - AllowExtensions - - - - - - - - This setting lets you decide whether employees can load extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowFlash - - - - - - - - This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowFlashClickToRun - - - - - - - - Configure the Adobe Flash Click-to-Run setting. - - - - - - - - - - - text/plain - - - - - AllowFullScreenMode - - - - - - - - With this policy, you can specify whether to allow full-screen mode, which shows only the web content and hides the Microsoft Edge UI. - -If enabled or not configured, full-screen mode is available for use in Microsoft Edge. Your users and extensions must have the proper permissions. - -If disabled, full-screen mode is unavailable for use in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowInPrivate - - - - - - - - This setting lets you decide whether employees can browse using InPrivate website browsing. - - - - - - - - - - - text/plain - - - - - AllowMicrosoftCompatibilityList - - - - - - - - This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. - -If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. - -If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. - - - - - - - - - - - text/plain - - - - - AllowPasswordManager - - - - - - - - This setting lets you decide whether employees can save their passwords locally, using Password Manager. - - - - - - - - - - - text/plain - - - - - AllowPopups - - - - - - - - This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. - - - - - - - - - - - text/plain - - - - - AllowPrelaunch - - - - - - - - Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - - - AllowPrinting - - - - - - - - With this policy, you can restrict whether printing web content in Microsoft Edge is allowed. - -If enabled, printing is allowed. - -If disabled, printing is not allowed. - - - - - - - - - - - text/plain - - - - - AllowSavingHistory - - - - - - - - Microsoft Edge saves your user's browsing history, which is made up of info about the websites they visit, on their devices. - -If enabled or not configured, the browsing history is saved and visible in the History pane. - -If disabled, the browsing history stops saving and is not visible in the History pane. If browsing history exists before this policy was disabled, the previous browsing history remains visible in the History pane. This policy, when disabled, does not stop roaming of existing history or history coming from other roamed devices. - - - - - - - - - - - text/plain - - - - - AllowSearchEngineCustomization - - - - - - - - Allow search engine customization for MDM enrolled devices. Users can change their default search engine. - -If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. -If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. - -This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). - - - - - - - - - - - text/plain - - - - - AllowSearchSuggestionsinAddressBar - - - - - - - - This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowSideloadingOfExtensions - - - - - - - - This setting lets you decide whether employees can sideload extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - AllowSmartScreen - - - - - - - - This setting lets you decide whether to turn on Windows Defender SmartScreen. - - - - - - - - - - - text/plain - - - - - AllowTabPreloading - - - - - - - - Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - - - AllowWebContentOnNewTabPage - - - - - - - - This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. - -If you enable this setting, Microsoft Edge opens a new tab with the New Tab page. - -If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it. - -If you don't configure this setting, employees can choose how new tabs appears. - - - - - - - - - - - text/plain - - - - - AlwaysEnableBooksLibrary - - - - - - - - Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. - - - - - - - - - - - text/plain - - - - - ClearBrowsingDataOnExit - - - - - - - - Specifies whether to always clear browsing history on exiting Microsoft Edge. - - - - - - - - - - - text/plain - - - - - ConfigureAdditionalSearchEngines - - - - - - - - Allows you to add up to 5 additional search engines for MDM-enrolled devices. - -If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. - -If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - ConfigureFavoritesBar - - - - - - - - The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. - -If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. - -If disabled, the favorites bar is hidden, and the favorites bar toggle resets to Off, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. - -If not configured, the favorites bar is hidden but is visible on the Start and New Tab pages, and the favorites bar toggle in Settings sets to Off but is enabled allowing the user to make changes. - - - - - - - - - - - text/plain - - - - - ConfigureHomeButton - - - - - - - - The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. - -By default, this policy is disabled or not configured and clicking the home button loads the default Start page. - -When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. - -If Enabled AND: -- Show home button & set to Start page is selected, clicking the home button loads the Start page. -- Show home button & set to New tab page is selected, clicking the home button loads a New tab page. -- Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. -- Hide home button is selected, the home button is hidden in Microsoft Edge. - -Default setting: Disabled or not configured -Related policies: -- Set Home Button URL -- Unlock Home Button - - - - - - - - - - - text/plain - - - - - ConfigureKioskMode - - - - - - - - Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. - -You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw). - -If enabled and set to 0 (Default or not configured): -- If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. -- If it’s one of many apps, Microsoft Edge runs as normal. -If enabled and set to 1: -- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. -- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge. - - - - - - - - - - - text/plain - - - - - ConfigureKioskResetAfterIdleTimeout - - - - - - - - You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user’s browsing data. - -If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. - -If you set this policy to 0, Microsoft Edge does not use an idle timer. - -If disabled or not configured, the default value is 5 minutes. - -If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. - - - - - - - - - - - text/plain - - - - - ConfigureOpenMicrosoftEdgeWith - - - - - - - - You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. - -If enabled, you can choose one of the following options: -- Start page: the Start page loads ignoring the Configure Start Pages policy. -- New tab page: the New tab page loads ignoring the Configure Start Pages policy. -- Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. -- A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. - -When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. - -If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. - -Default setting: A specific page or pages (default) -Related policies: --Disable Lockdown of Start Pages --Configure Start Pages - - - - - - - - - - - text/plain - - - - - ConfigureTelemetryForMicrosoft365Analytics - - - - - - - - Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization. - - - - - - - - - - - text/plain - - - - - DisableLockdownOfStartPages - - - - - - - - You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. - -If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Start Pages -- Configure Open Microsoft Edge With - - - - - - - - - - - text/plain - - - - - EnableExtendedBooksTelemetry - - - - - - - - This setting allows organizations to send extended telemetry on book usage from the Books Library. - - - - - - - - - - - text/plain - - - - - EnterpriseModeSiteList - - - - - - - - This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. - - - - - - - - - - - text/plain - - - - - EnterpriseSiteListServiceUrl - - - - - - - - - - - - - - - - - - - text/plain - - - - - FirstRunURL - - - - - - - - Configure first run URL. - - - - - - - - - - - text/plain - - - - - HomePages - - - - - - - - When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. - -If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - - <support.contoso.com><support.microsoft.com> - -If disabled or not configured, the webpages specified in App settings loads as the default Start pages. - -Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. - -Version 1809: -If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Open Microsoft Edge With -- Disable Lockdown of Start Pages - - - - - - - - - - - text/plain - - - - - LockdownFavorites - - - - - - - - This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. - -If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. - - - - - - - - - - - text/plain - - - - - PreventAccessToAboutFlagsInMicrosoftEdge - - - - - - - - Prevent access to the about:flags page in Microsoft Edge. - - - - - - - - - - - text/plain - - - - - PreventCertErrorOverrides - - - - - - - - Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors. - -If enabled, overriding certificate errors are not allowed. - -If disabled or not configured, overriding certificate errors are allowed. - - - - - - - - - - - text/plain - - - - - PreventFirstRunPage - - - - - - - - Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - PreventLiveTileDataCollection - - - - - - - - This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - PreventSmartScreenPromptOverride - - - - - - - - Don't allow Windows Defender SmartScreen warning overrides - - - - - - - - - - - text/plain - - - - - PreventSmartScreenPromptOverrideForFiles - - - - - - - - Don't allow Windows Defender SmartScreen warning overrides for unverified files. - - - - - - - - - - - text/plain - - - - - PreventTurningOffRequiredExtensions - - - - - - - - You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. - -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. - -When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. - -If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. - -If disabled or not configured, extensions defined as part of this policy get ignored. - -Default setting: Disabled or not configured -Related policies: Allow Developer Tools -Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) - - - - - - - - - - - text/plain - - - - - PreventUsingLocalHostIPAddressForWebRTC - - - - - - - - Prevent using localhost IP address for WebRTC - - - - - - - - - - - text/plain - - - - - ProvisionFavorites - - - - - - - - This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. - -If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. - - - - - - - - - - - text/plain - - - - - SendIntranetTraffictoInternetExplorer - - - - - - - - Sends all intranet traffic over to Internet Explorer. - - - - - - - - - - - text/plain - - - - - SetDefaultSearchEngine - - - - - - - - Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. - -If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. - -If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - - - SetHomeButtonURL - - - - - - - - The home button can be configured to load a custom URL when your user clicks the home button. - -If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. - -Default setting: Blank or not configured -Related policy: Configure Home Button - - - - - - - - - - - text/plain - - - - - SetNewTabPageURL - - - - - - - - You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. - -If enabled, you can set the default New Tab page URL. - -If disabled or not configured, the default Microsoft Edge new tab page is used. - -Default setting: Disabled or not configured -Related policy: Allow web content on New Tab page - - - - - - - - - - - text/plain - - - - - ShowMessageWhenOpeningSitesInInternetExplorer - - - - - - - - You can configure Microsoft Edge to open a site automatically in Internet Explorer 11 and choose to display a notification before the site opens. If you want to display a notification, you must enable Configure the Enterprise Mode Site List or Send all intranets sites to Internet Explorer 11 or both. - -If enabled, the notification appears on a new page. If you want users to continue in Microsoft Edge, select the Show Keep going in Microsoft Edge option from the drop-down list under Options. - -If disabled or not configured, the default app behavior occurs and no additional page displays. - -Default setting: Disabled or not configured -Related policies: --Configure the Enterprise Mode Site List --Send all intranet sites to Internet Explorer 11 - - - - - - - - - - - text/plain - - - - - SyncFavoritesBetweenIEAndMicrosoftEdge - - - - - - - - Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. - - - - - - - - - - - text/plain - - - - - UnlockHomeButton - - - - - - - - By default, when enabling Configure Home Button or Set Home Button URL, the home button is locked down to prevent your users from changing what page loads when clicking the home button. Use this policy to let users change the home button even when Configure Home Button or Set Home Button URL are enabled. - -If enabled, the UI settings for the home button are enabled allowing your users to make changes, including hiding and showing the home button as well as configuring a custom URL. - -If disabled or not configured, the UI settings for the home button are disabled preventing your users from making changes. - -Default setting: Disabled or not configured -Related policy: --Configure Home Button --Set Home Button URL - - - - - - - - - - - text/plain - - - - - UseSharedFolderForBooks - - - - - - - - This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. - - - - - - - - - - - text/plain - - - - - - Camera - - - - - - - - - - - - - - - - - - - - - AllowCamera - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Cellular - - - - - - - - - - - - - - - - - - - - - LetAppsAccessCellularData - - - - - - - - This policy setting specifies whether Windows apps can access cellular data. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCellularData_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - ShowAppCellularAccessUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Connectivity - - - - - - - - - - - - - - - - - - - - - AllowBluetooth - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCellularData - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCellularDataRoaming - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowConnectedDevices - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowNFC - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPhonePCLinking - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUSBConnection - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowVPNOverCellular - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowVPNRoamingOverCellular - - - - - - - - - - - - - - - - - - - text/plain - - - - - DiablePrintingOverHTTP - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDownloadingOfPrintDriversOverHTTP - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowNetworkConnectivityActiveTests - - - - - - - - - - - - - - - - - - - text/plain - - - - - HardenedUNCPaths - - - - - - - - - - - - - - - - - - - text/plain - - - - - ProhibitInstallationAndConfigurationOfNetworkBridge - - - - - - - - - - - - - - - - - - - text/plain - - - - - - ControlPolicyConflict - - - - - - - - - - - - - - - - - - - - - MDMWinsOverGP - - - - - - - - If set to 1 then any MDM policy that is set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC. Setting the value to 0 (zero) or deleting the policy will remove the GP policy blocks restore the saved GP policies. - - - - - - - - - - - text/plain - - - - - - CredentialProviders - - - - - - - - - - - - - - - - - - - - - AllowPINLogon - - - - - - - - - - - - - - - - - - - text/plain - - - - - BlockPicturePassword - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableAutomaticReDeploymentCredentials - - - - - - - - - - - - - - - - - - - text/plain - - - - - - CredentialsDelegation - - - - - - - - - - - - - - - - - - - - - RemoteHostAllowsDelegationOfNonExportableCredentials - - - - - - - - - - - - - - - - - - - text/plain - - - - - - CredentialsUI - - - - - - - - - - - - - - - - - - - - - DisablePasswordReveal - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnumerateAdministrators - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Cryptography - - - - - - - - - - - - - - - - - - - - - AllowFipsAlgorithmPolicy - - - - - - - - - - - - - - - - - - - text/plain - - - - - TLSCipherSuites - - - - - - - - - - - - - - - - - - - text/plain - - - - - - DataProtection - - - - - - - - - - - - - - - - - - - - - AllowDirectMemoryAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - LegacySelectiveWipeID - - - - - - - - - - - - - - - - - - - text/plain - - - - - - DataUsage - - - - - - - - - - - - - - - - - - - - - SetCost3G - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetCost4G - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Defender - - - - - - - - - - - - - - - - - - - - - AllowArchiveScanning - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowBehaviorMonitoring - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCloudProtection - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEmailScanning - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowFullScanOnMappedNetworkDrives - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowFullScanRemovableDriveScanning - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowIntrusionPreventionSystem - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowIOAVProtection - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowOnAccessProtection - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowRealtimeMonitoring - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowScanningNetworkFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowScriptScanning - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUserUIAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - AttackSurfaceReductionOnlyExclusions - - - - - - - - - - - - - - - - - - - text/plain - - - - - AttackSurfaceReductionRules - - - - - - - - - - - - - - - - - - - text/plain - - - - - AvgCPULoadFactor - - - - - - - - - - - - - - - - - - - text/plain - - - - - CheckForSignaturesBeforeRunningScan - - - - - - - - - - - - - - - - - - - text/plain - - - - - CloudBlockLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - CloudExtendedTimeout - - - - - - - - - - - - - - - - - - - text/plain - - - - - ControlledFolderAccessAllowedApplications - - - - - - - - - - - - - - - - - - - text/plain - - - - - ControlledFolderAccessProtectedFolders - - - - - - - - - - - - - - - - - - - text/plain - - - - - DaysToRetainCleanedMalware - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCatchupFullScan - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCatchupQuickScan - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableControlledFolderAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableLowCPUPriority - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableNetworkProtection - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludedExtensions - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludedPaths - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludedProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - PUAProtection - - - - - - - - - - - - - - - - - - - text/plain - - - - - RealTimeScanDirection - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScanParameter - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduleQuickScanTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduleScanDay - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduleScanTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - SecurityIntelligenceLocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - SignatureUpdateFallbackOrder - - - - - - - - - - - - - - - - - - - text/plain - - - - - SignatureUpdateFileSharesSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - SignatureUpdateInterval - - - - - - - - - - - - - - - - - - - text/plain - - - - - SubmitSamplesConsent - - - - - - - - - - - - - - - - - - - text/plain - - - - - ThreatSeverityDefaultAction - - - - - - - - - - - - - - - - - - - text/plain - - - - - - DeliveryOptimization - - - - - - - - - - - - - - - - - - - - - DOAbsoluteMaxCacheSize - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOAllowVPNPeerCaching - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOCacheHost - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOCacheHostSource - - - - - - - - - - - - - - - - - - - text/plain - - - - - DODelayBackgroundDownloadFromHttp - - - - - - - - - - - - - - - - - - - text/plain - - - - - DODelayCacheServerFallbackBackground - - - - - - - - - - - - - - - - - - - text/plain - - - - - DODelayCacheServerFallbackForeground - - - - - - - - - - - - - - - - - - - text/plain - - - - - DODelayForegroundDownloadFromHttp - - - - - - - - - - - - - - - - - - - text/plain - - - - - DODownloadMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOGroupId - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOGroupIdSource - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxBackgroundDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxCacheAge - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxCacheSize - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMaxForegroundDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMinBackgroundQos - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMinBatteryPercentageAllowedToUpload - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMinDiskSizeAllowedToPeer - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMinFileSizeToCache - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMinRAMAllowedToPeer - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOModifyCacheDrive - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOMonthlyUploadDataCap - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOPercentageMaxBackgroundBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOPercentageMaxForegroundBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DORestrictPeerSelectionBy - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOSetHoursToLimitBackgroundDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - DOSetHoursToLimitForegroundDownloadBandwidth - - - - - - - - - - - - - - - - - - - text/plain - - - - - - DeviceGuard - - - - - - - - - - - - - - - - - - - - - ConfigureSystemGuardLaunch - - - - - - - - Secure Launch configuration: 0 - Unmanaged, configurable by Administrative user, 1 - Enables Secure Launch if supported by hardware, 2 - Disables Secure Launch. - - - - - - - - - - - text/plain - - - - - EnableVirtualizationBasedSecurity - - - - - - - - Turns On Virtualization Based Security(VBS) - - - - - - - - - - - text/plain - - - - - LsaCfgFlags - - - - - - - - Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if configured previously without UEFI Lock, 1 - Turns on CredentialGuard with UEFI lock. 2 - Turns on CredentialGuard without UEFI lock. - - - - - - - - - - - text/plain - - - - - RequirePlatformSecurityFeatures - - - - - - - - Select Platform Security Level: 1 - Turns on VBS with Secure Boot, 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support. - - - - - - - - - - - text/plain - - - - - - DeviceHealthMonitoring - - - - - - - - - - - - - - - - - - - - - AllowDeviceHealthMonitoring - - - - - - - - Enable/disable 4Nines device health monitoring on devices. - - - - - - - - - - - text/plain - - - - - ConfigDeviceHealthMonitoringScope - - - - - - - - If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which types of events are monitored. - - - - - - - - - - - text/plain - - - - - ConfigDeviceHealthMonitoringUploadDestination - - - - - - - - If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which destinations are in-scope for monitored events to be uploaded. - - - - - - - - - - - text/plain - - - - - - DeviceInstallation - - - - - - - - - - - - - - - - - - - - - AllowInstallationOfMatchingDeviceIDs - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInstallationOfMatchingDeviceInstanceIDs - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInstallationOfMatchingDeviceSetupClasses - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventDeviceMetadataFromNetwork - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventInstallationOfDevicesNotDescribedByOtherPolicySettings - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventInstallationOfMatchingDeviceIDs - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventInstallationOfMatchingDeviceInstanceIDs - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventInstallationOfMatchingDeviceSetupClasses - - - - - - - - - - - - - - - - - - - text/plain - - - - - - DeviceLock - - - - - - - - - - - - - - - - - - - - - AllowIdleReturnWithoutPassword - - - - - - - - Specifies whether the user must input a PIN or password when the device resumes from an idle state. - - - - - - - - - - - text/plain - - - - - AllowSimpleDevicePassword - - - - - - - - Specifies whether PINs or passwords such as 1111 or 1234 are allowed. For the desktop, it also controls the use of picture passwords. - - - - - - - - - - - text/plain - - - - - AlphanumericDevicePasswordRequired - - - - - - - - Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0 - - - - - - - - - - - text/plain - - - - - DevicePasswordEnabled - - - - - - - - Specifies whether device lock is enabled. - - - - - - - - - - - text/plain - - - - - DevicePasswordExpiration - - - - - - - - Specifies when the password expires (in days). - - - - - - - - - - - text/plain - - - - - DevicePasswordHistory - - - - - - - - Specifies how many passwords can be stored in the history that can’t be used. - - - - - - - - - - - text/plain - - - - - EnforceLockScreenAndLogonImage - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnforceLockScreenProvider - - - - - - - - - - - - - - - - - - - text/plain - - - - - MaxDevicePasswordFailedAttempts - - - - - - - - - - - - - - - - - - - text/plain - - - - - MaxInactivityTimeDeviceLock - - - - - - - - The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. - - - - - - - - - - - text/plain - - - - - MaxInactivityTimeDeviceLockWithExternalDisplay - - - - - - - - Sets the maximum timeout value for the external display. - - - - - - - - - - - text/plain - - - - - MinDevicePasswordComplexCharacters - - - - - - - - The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. - - - - - - - - - - - text/plain - - - - - MinDevicePasswordLength - - - - - - - - Specifies the minimum number or characters required in the PIN or password. - - - - - - - - - - - text/plain - - - - - MinimumPasswordAge - - - - - - - - This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. - -The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998. - -Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default. - - - - - - - - - - - text/plain - - - - - PreventEnablingLockScreenCamera - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventLockScreenSlideShow - - - - - - - - - - - - - - - - - - - text/plain - - - - - Display - - - - - - - - - - - - - - - - - - - - - DisablePerProcessDpiForApps - - - - - - - - This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. - - - - - - - - - - - text/plain - - - - - EnablePerProcessDpi - - - - - - - - Enable or disable Per-Process System DPI for all applications. - - - - - - - - - - - text/plain - - - - - EnablePerProcessDpiForApps - - - - - - - - This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. - - - - - - - - - - - text/plain - - - - - TurnOffGdiDPIScalingForApps - - - - - - - - This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. - - - - - - - - - - - text/plain - - - - - TurnOnGdiDPIScalingForApps - - - - - - - - This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. - - - - - - - - - - - text/plain - - - - - - DmaGuard - - - - - - - - - - - - - - - - - - - - - DeviceEnumerationPolicy - - - - - - - - - - - - - - - - - - - text/plain - - - - - - ErrorReporting - - - - - - - - - - - - - - - - - - - - - CustomizeConsentSettings - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableWindowsErrorReporting - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisplayErrorNotification - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotSendAdditionalData - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventCriticalErrorDisplay - - - - - - - - - - - - - - - - - - - text/plain - - - - - - EventLogService - - - - - - - - - - - - - - - - - - - - - ControlEventLogBehavior - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyMaximumFileSizeApplicationLog - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyMaximumFileSizeSecurityLog - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyMaximumFileSizeSystemLog - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Experience - - - - - - - - - - - - - - - - - - - - - AllowClipboardHistory - - - - - - - - Allows history of clipboard items to be stored in memory. - - - - - - - - - - - text/plain - - - - - AllowCopyPaste - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCortana - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDeviceDiscovery - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowFindMyDevice - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowManualMDMUnenrollment - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSaveAsOfOfficeFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowScreenCapture - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSharingOfOfficeFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSIMErrorDialogPromptWhenNoSIM - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSyncMySettings - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowTaskSwitcher - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowVoiceRecording - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsConsumerFeatures - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsTips - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCloudOptimizedContent - - - - - - - - This policy controls Windows experiences that use the cloud optimized content client component. If you enable this policy, they will present only default content. If you disable or do not configure this policy, they will be able to use cloud provided content. - - - - - - - - - - - text/plain - - - - - DoNotShowFeedbackNotifications - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotSyncBrowserSettings - - - - - - - - You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user. - Related policy: PreventUsersFromTurningOnBrowserSyncing - 0 (default) = allow syncing, 2 = disable syncing - - - - - - - - - - - text/plain - - - - - PreventUsersFromTurningOnBrowserSyncing - - - - - - - - You can configure Microsoft Edge to allow users to turn on the Sync your Settings option to sync information, such as history and favorites, between user's devices. When enabled and you enable the Do not sync browser setting policy, browser settings sync automatically. If disabled, users have the option to sync the browser settings. - Related policy: DoNotSyncBrowserSettings - 1 (default) = Do not allow users to turn on syncing, 0 = Allows users to turn on syncing - - - - - - - - - - - text/plain - - - - - ShowLockOnUserTile - - - - - - - - Shows or hides lock from the user tile menu. -If you enable this policy setting, the lock option will be shown in the User Tile menu. - -If you disable this policy setting, the lock option will never be shown in the User Tile menu. - -If you do not configure this policy setting, users will be able to choose whether they want lock to show through the Power Options Control Panel. - - - - - - - - - - - text/plain - - - - - - ExploitGuard - - - - - - - - - - - - - - - - - - - - - ExploitProtectionSettings - - - - - - - - - - - - - - - - - - - text/plain - - - - - - FactoryComposer - - - - - - - - - - - - - - - - - - - - - BackgroundImagePath - - - - - - - - - - - - - - - - - - - text/plain - - - - - OEMVersion - - - - - - - - - - - - - - - - - - - text/plain - - - - - UserToSignIn - - - - - - - - - - - - - - - - - - - text/plain - - - - - UWPLaunchOnBoot - - - - - - - - - - - - - - - - - - - text/plain - - - - - - FileExplorer - - - - - - - - - - - - - - - - - - - - - TurnOffDataExecutionPreventionForExplorer - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOffHeapTerminationOnCorruption - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Games - - - - - - - - - - - - - - - - - - - - - AllowAdvancedGamingServices - - - - - - - - Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. - - - - - - - - - - - text/plain - - - - - - Handwriting - - - - - - - - - - - - - - - - - - - - - PanelDefaultModeDocked - - - - - - - - Specifies whether the handwriting panel comes up floating near the text box or attached to the bottom of the screen - - - - - - - - - - - text/plain - - - - - - InternetExplorer - - - - - - - - - - - - - - - - - - - - - AddSearchProvider - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowActiveXFiltering - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowAddOnList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCertificateAddressMismatchWarning - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDeletingBrowsingHistoryOnExit - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnhancedProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnhancedSuggestionsInAddressBar - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnterpriseModeFromToolsMenu - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEnterpriseModeSiteList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowFallbackToSSL3 - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetExplorer7PolicyList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetExplorerStandardsMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowIntranetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownInternetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownIntranetZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLockedDownRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowOneWordEntry - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSiteToZoneAssignmentList - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowsLockedDownTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSoftwareWhenSignatureIsInvalid - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowsRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSuggestedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - - - text/plain - - - - - CheckServerCertificateRevocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - CheckSignaturesOnDownloadedPrograms - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConsistentMimeHandlingInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableAdobeFlash - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableBypassOfSmartScreenWarnings - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableBypassOfSmartScreenWarningsAboutUncommonFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCompatView - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableConfiguringHistory - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCrashDetection - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableCustomerExperienceImprovementProgramParticipation - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDeletingUserVisitedWebsites - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableEnclosureDownloading - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableEncryptionSupport - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFeedsBackgroundSync - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFirstRunWizard - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFlipAheadFeature - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableGeolocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableIgnoringCertificateErrors - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableInPrivateBrowsing - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableProcessesInEnhancedProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableProxyChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableSearchProviderChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableSecondaryHomePageChange - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableSecuritySettingsCheck - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableUpdateCheck - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableWebAddressAutoComplete - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotAllowActiveXControlsInProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotAllowUsersToAddSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotAllowUsersToChangePolicies - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotBlockOutdatedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotBlockOutdatedActiveXControlsOnSpecificDomains - - - - - - - - - - - - - - - - - - - text/plain - - - - - IncludeAllLocalSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - IncludeAllNetworkPaths - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneEnableProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneLogonOptions - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - InternetZoneUsePopupBlocker - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - IntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownInternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownIntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownLocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownRestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - LockedDownTrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - MimeSniffingSafetyFeatureInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - MKProtocolSecurityRestrictionInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - NewTabDefaultPage - - - - - - - - - - - - - - - - - - - text/plain - - - - - NotificationBarInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventManagingSmartScreenFilter - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventPerUserInstallationOfActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - ProtectionFromZoneElevationInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - RemoveRunThisTimeButtonForOutdatedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictActiveXInstallInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowActiveScripting - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowBinaryAndScriptBehaviors - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowMETAREFRESH - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneLogonOptions - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneRunActiveXControlsAndPlugins - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneScriptingOfJavaApplets - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneTurnOnProtectedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictedSitesZoneUsePopupBlocker - - - - - - - - - - - - - - - - - - - text/plain - - - - - RestrictFileDownloadInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScriptedWindowSecurityRestrictionsInternetExplorerProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - SearchProviderList - - - - - - - - - - - - - - - - - - - text/plain - - - - - SecurityZonesUseOnlyMachineSettings - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyUseOfActiveXInstallerService - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Kerberos - - - - - - - - - - - - - - - - - - - - - AllowForestSearchOrder - - - - - - - - - - - - - - - - - - - text/plain - - - - - KerberosClientSupportsClaimsCompoundArmor - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireKerberosArmoring - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireStrictKDCValidation - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetMaximumContextTokenSize - - - - - - - - - - - - - - - - - - - text/plain - - - - - UPNNameHints - - - - - - - - Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an AAD UPN into an Active Directory Principal. - - This parameter adds a list of domains that an Azure Active Directory joined device should attempt to contact if it is otherwise unable to resolve a UPN to a principal. - - - - - - - - - - - text/plain - - - - - - KioskBrowser - - - - - - - - - - - - - - - - - - - - - BlockedUrlExceptions - - - - - - - - List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. - - - - - - - - - - - text/plain - - - - - BlockedUrls - - - - - - - - List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. - - - - - - - - - - - text/plain - - - - - DefaultURL - - - - - - - - Configures the default URL kiosk browsers to navigate on launch and restart. - - - - - - - - - - - text/plain - - - - - EnableEndSessionButton - - - - - - - - Enable/disable kiosk browser's end session button. - - - - - - - - - - - text/plain - - - - - EnableHomeButton - - - - - - - - Enable/disable kiosk browser's home button. - - - - - - - - - - - text/plain - - - - - EnableNavigationButtons - - - - - - - - Enable/disable kiosk browser's navigation buttons (forward/back). - - - - - - - - - - - text/plain - - - - - RestartOnIdleTime - - - - - - - - Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. - - - - - - - - - - - text/plain - - - - - - LanmanWorkstation - - - - - - - - - - - - - - - - - - - - - EnableInsecureGuestLogons - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Licensing - - - - - - - - - - - - - - - - - - - - - AllowWindowsEntitlementReactivation - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowKMSClientOnlineAVSValidation - - - - - - - - - - - - - - - - - - - text/plain - - - - - - LocalPoliciesSecurityOptions - - - - - - - - - - - - - - - - - - - - - Accounts_BlockMicrosoftAccounts - - - - - - - - This policy setting prevents users from adding new Microsoft accounts on this computer. - -If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. - -If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. - -If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. - - - - - - - - - - - text/plain - - - - - Accounts_EnableAdministratorAccountStatus - - - - - - - - This security setting determines whether the local Administrator account is enabled or disabled. - -Notes - -If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. -Disabling the Administrator account can become a maintenance issue under certain circumstances. - -Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - Accounts_EnableGuestAccountStatus - - - - - - - - This security setting determines if the Guest account is enabled or disabled. - -Default: Disabled. - -Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. - - - - - - - - - - - text/plain - - - - - Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly - - - - - - - - Accounts: Limit local account use of blank passwords to console logon only - -This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. - -Default: Enabled. - - -Warning: - -Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. -If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services. - -Notes - -This setting does not affect logons that use domain accounts. -It is possible for applications that use remote interactive logons to bypass this setting. - - - - - - - - - - - text/plain - - - - - Accounts_RenameAdministratorAccount - - - - - - - - Accounts: Rename administrator account - -This security setting determines whether a different account name is associated with the security identifier (SID) for the account Administrator. Renaming the well-known Administrator account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination. - -Default: Administrator. - - - - - - - - - - - text/plain - - - - - Accounts_RenameGuestAccount - - - - - - - - Accounts: Rename guest account - -This security setting determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Renaming the well-known Guest account makes it slightly more difficult for unauthorized persons to guess this user name and password combination. - -Default: Guest. - - - - - - - - - - - text/plain - - - - - Devices_AllowedToFormatAndEjectRemovableMedia - - - - - - - - Devices: Allowed to format and eject removable media - -This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: - -Administrators -Administrators and Interactive Users - -Default: This policy is not defined and only Administrators have this ability. - - - - - - - - - - - text/plain - - - - - Devices_AllowUndockWithoutHavingToLogon - - - - - - - - Devices: Allow undock without having to log on -This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. -Default: Enabled. - -Caution -Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. - - - - - - - - - - - text/plain - - - - - Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters - - - - - - - - Devices: Prevent users from installing printer drivers when connecting to shared printers - -For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. - -Default on servers: Enabled. -Default on workstations: Disabled - -Notes - -This setting does not affect the ability to add a local printer. -This setting does not affect Administrators. - - - - - - - - - - - text/plain - - - - - Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly - - - - - - - - Devices: Restrict CD-ROM access to locally logged-on user only - -This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously. - -If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network. - -Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked - - - - - - - - Interactive Logon:Display user information when the session is locked -User display name, domain and user names (1) -User display name only (2) -Do not display user information (3) -Domain and user names only (4) - - - - - - - - - - - text/plain - - - - - InteractiveLogon_DoNotDisplayLastSignedIn - - - - - - - - Interactive logon: Don't display last signed-in -This security setting determines whether the Windows sign-in screen will show the username of the last person who signed in on this PC. -If this policy is enabled, the username will not be shown. - -If this policy is disabled, the username will be shown. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_DoNotDisplayUsernameAtSignIn - - - - - - - - Interactive logon: Don't display username at sign-in -This security setting determines whether the username of the person signing in to this PC appears at Windows sign-in, after credentials are entered, and before the PC desktop is shown. -If this policy is enabled, the username will not be shown. - -If this policy is disabled, the username will be shown. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_DoNotRequireCTRLALTDEL - - - - - - - - Interactive logon: Do not require CTRL+ALT+DEL - -This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on. - -If this policy is enabled on a computer, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords. - -If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to Windows. - -Default on domain-computers: Enabled: At least Windows 8/Disabled: Windows 7 or earlier. -Default on stand-alone computers: Enabled. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_MachineInactivityLimit - - - - - - - - Interactive logon: Machine inactivity limit. - -Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session. - -Default: not enforced. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_MessageTextForUsersAttemptingToLogOn - - - - - - - - Interactive logon: Message text for users attempting to log on - -This security setting specifies a text message that is displayed to users when they log on. - -This text is often used for legal reasons, for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited. - -Default: No message. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_MessageTitleForUsersAttemptingToLogOn - - - - - - - - Interactive logon: Message title for users attempting to log on - -This security setting allows the specification of a title to appear in the title bar of the window that contains the Interactive logon: Message text for users attempting to log on. - -Default: No message. - - - - - - - - - - - text/plain - - - - - InteractiveLogon_SmartCardRemovalBehavior - - - - - - - - Interactive logon: Smart card removal behavior - -This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. - -The options are: - - No Action - Lock Workstation - Force Logoff - Disconnect if a Remote Desktop Services session - -If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. - -If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. - -If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. - -Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. - -Default: This policy is not defined, which means that the system treats it as No action. - -On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. - - - - - - - - - - - text/plain - - - - - MicrosoftNetworkClient_DigitallySignCommunicationsAlways - - - - - - - - Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - - - MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees - - - - - - - - Microsoft network client: Digitally sign communications (if server agrees) - -This security setting determines whether the SMB client attempts to negotiate SMB packet signing. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. - -If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. - -Default: Enabled. - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - - - MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers - - - - - - - - Microsoft network client: Send unencrypted password to connect to third-party SMB servers - -If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication. - -Sending unencrypted passwords is a security risk. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - MicrosoftNetworkServer_DigitallySignCommunicationsAlways - - - - - - - - Microsoft network server: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB server component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. - -If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. If this setting is disabled, SMB packet signing is negotiated between the client and server. - -Default: - -Disabled for member servers. -Enabled for domain controllers. - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. -If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. - -Important - -For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: -Microsoft network server: Digitally sign communications (if server agrees) - -For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: -HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - - - MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees - - - - - - - - Microsoft network server: Digitally sign communications (if client agrees) - -This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. - -If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. - -Default: Enabled on domain controllers only. - -Important - -For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - - - NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts - - - - - - - - Network access: Do not allow anonymous enumeration of SAM accounts - -This security setting determines what additional permissions will be granted for anonymous connections to the computer. - -Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. - -This security option allows additional restrictions to be placed on anonymous connections as follows: - -Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. -Disabled: No additional restrictions. Rely on default permissions. - -Default on workstations: Enabled. -Default on server:Enabled. - -Important - -This policy has no impact on domain controllers. - - - - - - - - - - - text/plain - - - - - NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares - - - - - - - - Network access: Do not allow anonymous enumeration of SAM accounts and shares - -This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed. - -Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares - - - - - - - - Network access: Restrict anonymous access to Named Pipes and Shares - -When enabled, this security setting restricts anonymous access to shares and pipes to the settings for: - -Network access: Named pipes that can be accessed anonymously -Network access: Shares that can be accessed anonymously -Default: Enabled. - - - - - - - - - - - text/plain - - - - - NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM - - - - - - - - Network access: Restrict clients allowed to make remote calls to SAM - -This policy setting allows you to restrict remote rpc connections to SAM. - -If not selected, the default security descriptor will be used. - -This policy is supported on at least Windows Server 2016. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM - - - - - - - - Network security: Allow Local System to use computer identity for NTLM - -This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - -If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. - -If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. - -By default, this policy is enabled on Windows 7 and above. - -By default, this policy is disabled on Windows Vista. - -This policy is supported on at least Windows Vista or Windows Server 2008. - -Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_AllowPKU2UAuthenticationRequests - - - - - - - - Network security: Allow PKU2U authentication requests to this computer to use online identities. - -This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange - - - - - - - - Network security: Do not store LAN Manager hash value on next password change - -This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. - - -Default on Windows Vista and above: Enabled -Default on Windows XP: Disabled. - -Important - -Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. -This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_LANManagerAuthenticationLevel - - - - - - - - Network security LAN Manager authentication level - -This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: - -Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). - -Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication). - -Important - -This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. - -Default: - -Windows 2000 and windows XP: send LM and NTLM responses - -Windows Server 2003: Send NTLM response only - -Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only - - - - - - - - - - - text/plain - - - - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients - - - - - - - - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - - - - - - - - - text/plain - - - - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers - - - - - - - - Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - -This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. -Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - - - - - - - - - text/plain - - - - - NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication - - - - - - - - Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication - -This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. - -If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. - -If you do not configure this policy setting, no exceptions will be applied. - -The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic - - - - - - - - Network security: Restrict NTLM: Audit Incoming NTLM Traffic - -This policy setting allows you to audit incoming NTLM traffic. - -If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. - -If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. - -If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. - -This policy is supported on at least Windows 7 or Windows Server 2008 R2. - -Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic - - - - - - - - Network security: Restrict NTLM: Incoming NTLM traffic - -This policy setting allows you to deny or allow incoming NTLM traffic. - -If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. - -If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. - -If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. - -This policy is supported on at least Windows 7 or Windows Server 2008 R2. - -Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. - - - - - - - - - - - text/plain - - - - - NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers - - - - - - - - Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers - -This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. - -If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. - -If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. - -If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. - -This policy is supported on at least Windows 7 or Windows Server 2008 R2. - -Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. - - - - - - - - - - - text/plain - - - - - Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn - - - - - - - - Shutdown: Allow system to be shut down without having to log on - -This security setting determines whether a computer can be shut down without having to log on to Windows. - -When this policy is enabled, the Shut Down command is available on the Windows logon screen. - -When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right before they can perform a system shutdown. - -Default on workstations: Enabled. -Default on servers: Disabled. - - - - - - - - - - - text/plain - - - - - Shutdown_ClearVirtualMemoryPageFile - - - - - - - - Shutdown: Clear virtual memory pagefile - -This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. - -Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. - -When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - UserAccountControl_AllowUIAccessApplicationsToPromptForElevation - - - - - - - - User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop. - -This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. - -• Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. - -• Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. - - - - - - - - - - - text/plain - - - - - UserAccountControl_BehaviorOfTheElevationPromptForAdministrators - - - - - - - - User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - -This policy setting controls the behavior of the elevation prompt for administrators. - -The options are: - -• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. - -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - -• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - -• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - -• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - -• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - - - - - - - - - - - text/plain - - - - - UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers - - - - - - - - User Account Control: Behavior of the elevation prompt for standard users -This policy setting controls the behavior of the elevation prompt for standard users. - -The options are: - -• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - -• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. - -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - - - - - - - - - - text/plain - - - - - UserAccountControl_DetectApplicationInstallationsAndPromptForElevation - - - - - - - - User Account Control: Detect application installations and prompt for elevation - -This policy setting controls the behavior of application installation detection for the computer. - -The options are: - -Enabled: (Default) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - -Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary. - - - - - - - - - - - text/plain - - - - - UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated - - - - - - - - User Account Control: Only elevate executable files that are signed and validated - -This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. - -The options are: - -• Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. - -• Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. - - - - - - - - - - - text/plain - - - - - UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations - - - - - - - - User Account Control: Only elevate UIAccess applications that are installed in secure locations - -This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - -- …\Program Files\, including subfolders -- …\Windows\system32\ -- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows - -Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. - -The options are: - -• Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. - -• Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. - - - - - - - - - - - text/plain - - - - - UserAccountControl_RunAllAdministratorsInAdminApprovalMode - - - - - - - - User Account Control: Turn on Admin Approval Mode - -This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. - -The options are: - -• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - -• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. - - - - - - - - - - - text/plain - - - - - UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation - - - - - - - - User Account Control: Switch to the secure desktop when prompting for elevation - -This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. - -The options are: - -• Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. - -• Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. - - - - - - - - - - - text/plain - - - - - UserAccountControl_UseAdminApprovalMode - - - - - - - - User Account Control: Use Admin Approval Mode for the built-in Administrator account - -This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. - -The options are: - -• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. - -• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. - - - - - - - - - - - text/plain - - - - - UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations - - - - - - - - User Account Control: Virtualize file and registry write failures to per-user locations - -This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software. - -The options are: - -• Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. - -• Disabled: Applications that write data to protected locations fail. - - - - - - - - - - - text/plain - - - - - - LocalUsersAndGroups - - - - - - - - - - - - - - - - - - - - - Configure - - - - - - - - This Setting allows an administrator to manage local groups on a Device. - Possible settings: - 1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. - When using Update, existing group members that are not specified in the policy remain untouched. - 2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. - When using Replace, existing group membership is replaced by the list of members specified in - the add member section. This option works in the same way as a Restricted Group and any group - members that are not specified in the policy are removed. - Caution: If the same group is configured with both Replace and Update, then Replace will win. - - - - - - - - - - - text/plain - - - - - - LockDown - - - - - - - - - - - - - - - - - - - - - AllowEdgeSwipe - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Maps - - - - - - - - - - - - - - - - - - - - - AllowOfflineMapsDownloadOverMeteredConnection - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableOfflineMapsAutoUpdate - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Messaging - - - - - - - - - - - - - - - - - - - - - AllowMessageSync - - - - - - - - This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. - - - - - - - - - - - text/plain - - - - - AllowMMS - - - - - - - - This policy setting allows you to enable or disable the sending and receiving cellular MMS messages. - - - - - - - - - - - text/plain - - - - - AllowRCS - - - - - - - - This policy setting allows you to enable or disable the sending and receiving of cellular RCS (Rich Communication Services) messages. - - - - - - - - - - - text/plain - - - - - - MixedReality - - - - - - - - - - - - - - - - - - - - - AADGroupMembershipCacheValidityInDays - - - - - - - - - - - - - - - - - - - text/plain - - - - - BrightnessButtonDisabled - - - - - - - - - - - - - - - - - - - text/plain - - - - - FallbackDiagnostics - - - - - - - - - - - - - - - - - - - text/plain - - - - - MicrophoneDisabled - - - - - - - - - - - - - - - - - - - text/plain - - - - - VolumeButtonDisabled - - - - - - - - - - - - - - - - - - - text/plain - - - - - - MSSecurityGuide - - - - - - - - - - - - - - - - - - - - - ApplyUACRestrictionsToLocalAccountsOnNetworkLogon - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureSMBV1ClientDriver - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureSMBV1Server - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableStructuredExceptionHandlingOverwriteProtection - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications - - - - - - - - - - - - - - - - - - - text/plain - - - - - WDigestAuthentication - - - - - - - - - - - - - - - - - - - text/plain - - - - - - MSSLegacy - - - - - - - - - - - - - - - - - - - - - AllowICMPRedirectsToOverrideOSPFGeneratedRoutes - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers - - - - - - - - - - - - - - - - - - - text/plain - - - - - IPSourceRoutingProtectionLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - IPv6SourceRoutingProtectionLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - - NetworkIsolation - - - - - - - - - - - - - - - - - - - - - EnterpriseCloudResources - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnterpriseInternalProxyServers - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnterpriseIPRange - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnterpriseIPRangesAreAuthoritative - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnterpriseNetworkDomainNames - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnterpriseProxyServers - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnterpriseProxyServersAreAuthoritative - - - - - - - - - - - - - - - - - - - text/plain - - - - - NeutralResources - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Notifications - - - - - - - - - - - - - - - - - - - - - DisallowCloudNotification - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Power - - - - - - - - - - - - - - - - - - - - - AllowStandbyStatesWhenSleepingOnBattery - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStandbyWhenSleepingPluggedIn - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisplayOffTimeoutOnBattery - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisplayOffTimeoutPluggedIn - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnergySaverBatteryThresholdOnBattery - - - - - - - - This policy setting allows you to specify battery charge level at which Energy Saver is turned on. - -If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. - -If you disable or do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - - - EnergySaverBatteryThresholdPluggedIn - - - - - - - - This policy setting allows you to specify battery charge level at which Energy Saver is turned on. - -If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. - -If you disable or do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - - - HibernateTimeoutOnBattery - - - - - - - - - - - - - - - - - - - text/plain - - - - - HibernateTimeoutPluggedIn - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequirePasswordWhenComputerWakesOnBattery - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequirePasswordWhenComputerWakesPluggedIn - - - - - - - - - - - - - - - - - - - text/plain - - - - - SelectLidCloseActionOnBattery - - - - - - - - This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - - - SelectLidCloseActionPluggedIn - - - - - - - - This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - - - SelectPowerButtonActionOnBattery - - - - - - - - This policy setting specifies the action that Windows takes when a user presses the power button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - - - SelectPowerButtonActionPluggedIn - - - - - - - - This policy setting specifies the action that Windows takes when a user presses the power button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - - - SelectSleepButtonActionOnBattery - - - - - - - - This policy setting specifies the action that Windows takes when a user presses the sleep button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - - - SelectSleepButtonActionPluggedIn - - - - - - - - This policy setting specifies the action that Windows takes when a user presses the sleep button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - - - StandbyTimeoutOnBattery - - - - - - - - - - - - - - - - - - - text/plain - - - - - StandbyTimeoutPluggedIn - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOffHybridSleepOnBattery - - - - - - - - This policy setting allows you to turn off hybrid sleep. - -If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). - -If you do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - - - TurnOffHybridSleepPluggedIn - - - - - - - - This policy setting allows you to turn off hybrid sleep. - -If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). - -If you do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - - - UnattendedSleepTimeoutOnBattery - - - - - - - - This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. - -If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. - -If you disable or do not configure this policy setting, users control this setting. - -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - - - - - - - - - - - text/plain - - - - - UnattendedSleepTimeoutPluggedIn - - - - - - - - This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. - -If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. - -If you disable or do not configure this policy setting, users control this setting. - -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - - - - - - - - - - - text/plain - - - - - - Printers - - - - - - - - - - - - - - - - - - - - - PointAndPrintRestrictions - - - - - - - - - - - - - - - - - - - text/plain - - - - - PublishPrinters - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Privacy - - - - - - - - - - - - - - - - - - - - - AllowAutoAcceptPairingAndPrivacyConsentPrompts - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCrossDeviceClipboard - - - - - - - - Allows syncing of Clipboard across devices under the same Microsoft account. - - - - - - - - - - - text/plain - - - - - AllowInputPersonalization - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableAdvertisingId - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisablePrivacyExperience - - - - - - - - Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. - - - - - - - - - - - text/plain - - - - - EnableActivityFeed - - - - - - - - Enables ActivityFeed, which is responsible for mirroring different activity types (as applicable) across device graph of the user. - - - - - - - - - - - text/plain - - - - - LetAppsAccessAccountInfo - - - - - - - - This policy setting specifies whether Windows apps can access account information. - - - - - - - - - - - text/plain - - - - - LetAppsAccessAccountInfo_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessAccountInfo_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessAccountInfo_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessBackgroundSpatialPerception - - - - - - - - This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. - - - - - - - - - - - text/plain - - - - - LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCalendar - - - - - - - - This policy setting specifies whether Windows apps can access the calendar. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCalendar_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCalendar_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCalendar_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCallHistory - - - - - - - - This policy setting specifies whether Windows apps can access call history. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCallHistory_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCallHistory_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCallHistory_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCamera - - - - - - - - This policy setting specifies whether Windows apps can access the camera. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCamera_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCamera_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessCamera_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessContacts - - - - - - - - This policy setting specifies whether Windows apps can access contacts. - - - - - - - - - - - text/plain - - - - - LetAppsAccessContacts_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessContacts_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessContacts_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessEmail - - - - - - - - This policy setting specifies whether Windows apps can access email. - - - - - - - - - - - text/plain - - - - - LetAppsAccessEmail_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessEmail_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessEmail_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessGazeInput - - - - - - - - This policy setting specifies whether Windows apps can access the eye tracker. - - - - - - - - - - - text/plain - - - - - LetAppsAccessGazeInput_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessGazeInput_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessGazeInput_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessLocation - - - - - - - - This policy setting specifies whether Windows apps can access location. - - - - - - - - - - - text/plain - - - - - LetAppsAccessLocation_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessLocation_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessLocation_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMessaging - - - - - - - - This policy setting specifies whether Windows apps can read or send messages (text or MMS). - - - - - - - - - - - text/plain - - - - - LetAppsAccessMessaging_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMessaging_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMessaging_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMicrophone - - - - - - - - This policy setting specifies whether Windows apps can access the microphone. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMicrophone_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMicrophone_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMicrophone_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMotion - - - - - - - - This policy setting specifies whether Windows apps can access motion data. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMotion_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMotion_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessMotion_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessNotifications - - - - - - - - This policy setting specifies whether Windows apps can access notifications. - - - - - - - - - - - text/plain - - - - - LetAppsAccessNotifications_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessNotifications_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessNotifications_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessPhone - - - - - - - - This policy setting specifies whether Windows apps can make phone calls - - - - - - - - - - - text/plain - - - - - LetAppsAccessPhone_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessPhone_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessPhone_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessRadios - - - - - - - - This policy setting specifies whether Windows apps have access to control radios. - - - - - - - - - - - text/plain - - - - - LetAppsAccessRadios_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessRadios_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessRadios_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTasks - - - - - - - - This policy setting specifies whether Windows apps can access tasks. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTasks_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTasks_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTasks_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTrustedDevices - - - - - - - - This policy setting specifies whether Windows apps can access trusted devices. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTrustedDevices_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTrustedDevices_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsAccessTrustedDevices_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsActivateWithVoice - - - - - - - - This policy setting specifies whether Windows apps can be activated by voice. - - - - - - - - - - - text/plain - - - - - LetAppsActivateWithVoiceAboveLock - - - - - - - - This policy setting specifies whether Windows apps can be activated by voice while the system is locked. - - - - - - - - - - - text/plain - - - - - LetAppsGetDiagnosticInfo - - - - - - - - This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names. - - - - - - - - - - - text/plain - - - - - LetAppsGetDiagnosticInfo_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsGetDiagnosticInfo_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsGetDiagnosticInfo_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsRunInBackground - - - - - - - - This policy setting specifies whether Windows apps can run in the background. - - - - - - - - - - - text/plain - - - - - LetAppsRunInBackground_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsRunInBackground_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsRunInBackground_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - - - - LetAppsSyncWithDevices - - - - - - - - This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. - - - - - - - - - - - text/plain - - - - - LetAppsSyncWithDevices_ForceAllowTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsSyncWithDevices_ForceDenyTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - LetAppsSyncWithDevices_UserInControlOfTheseApps - - - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - - - - PublishUserActivities - - - - - - - - Allows apps/system to publish 'User Activities' into ActivityFeed. - - - - - - - - - - - text/plain - - - - - UploadUserActivities - - - - - - - - Allows ActivityFeed to upload published 'User Activities'. - - - - - - - - - - - text/plain - - - - - - RemoteAssistance - - - - - - - - - - - - - - - - - - - - - CustomizeWarningMessages - - - - - - - - - - - - - - - - - - - text/plain - - - - - SessionLogging - - - - - - - - - - - - - - - - - - - text/plain - - - - - SolicitedRemoteAssistance - - - - - - - - - - - - - - - - - - - text/plain - - - - - UnsolicitedRemoteAssistance - - - - - - - - - - - - - - - - - - - text/plain - - - - - - RemoteDesktopServices - - - - - - - - - - - - - - - - - - - - - AllowUsersToConnectRemotely - - - - - - - - - - - - - - - - - - - text/plain - - - - - ClientConnectionEncryptionLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotAllowDriveRedirection - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotAllowPasswordSaving - - - - - - - - - - - - - - - - - - - text/plain - - - - - PromptForPasswordUponConnection - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireSecureRPCCommunication - - - - - - - - - - - - - - - - - - - text/plain - - - - - - RemoteManagement - - - - - - - - - - - - - - - - - - - - - AllowBasicAuthentication_Client - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowBasicAuthentication_Service - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCredSSPAuthenticationClient - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCredSSPAuthenticationService - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowRemoteServerManagement - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUnencryptedTraffic_Client - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUnencryptedTraffic_Service - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowDigestAuthentication - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowNegotiateAuthenticationClient - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowNegotiateAuthenticationService - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowStoringOfRunAsCredentials - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyChannelBindingTokenHardeningLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedHosts - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOnCompatibilityHTTPListener - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOnCompatibilityHTTPSListener - - - - - - - - - - - - - - - - - - - text/plain - - - - - - RemoteProcedureCall - - - - - - - - - - - - - - - - - - - - - RestrictUnauthenticatedRPCClients - - - - - - - - - - - - - - - - - - - text/plain - - - - - RPCEndpointMapperClientAuthentication - - - - - - - - - - - - - - - - - - - text/plain - - - - - - RemoteShell - - - - - - - - - - - - - - - - - - - - - AllowRemoteShellAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - MaxConcurrentUsers - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyIdleTimeout - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyMaxMemory - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyMaxProcesses - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyMaxRemoteShells - - - - - - - - - - - - - - - - - - - text/plain - - - - - SpecifyShellTimeout - - - - - - - - - - - - - - - - - - - text/plain - - - - - - RestrictedGroups - - - - - - - - - - - - - - - - - - - - - ConfigureGroupMembership - - - - - - - - This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. -Caution: If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. - - - - - - - - - - - text/plain - - - - - - Search - - - - - - - - - - - - - - - - - - - - - AllowCloudSearch - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCortanaInAAD - - - - - - - - This features allows you to show the cortana opt-in page during Windows Setup - - - - - - - - - - - text/plain - - - - - AllowFindMyFiles - - - - - - - - This feature allows you to disable find my files completely on the machine - - - - - - - - - - - text/plain - - - - - AllowIndexingEncryptedStoresOrItems - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSearchToUseLocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStoringImagesFromVisionSearch - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUsingDiacritics - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsIndexer - - - - - - - - - - - - - - - - - - - text/plain - - - - - AlwaysUseAutoLangDetection - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableBackoff - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableRemovableDriveIndexing - - - - - - - - - - - - - - - - - - - text/plain - - - - - DoNotUseWebResults - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventIndexingLowDiskSpaceMB - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventRemoteQueries - - - - - - - - - - - - - - - - - - - text/plain - - - - - SafeSearchPermissions - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Security - - - - - - - - - - - - - - - - - - - - - AllowAddProvisioningPackage - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowManualRootCertificateInstallation - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowRemoveProvisioningPackage - - - - - - - - - - - - - - - - - - - text/plain - - - - - AntiTheftMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - ClearTPMIfNotReady - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureWindowsPasswords - - - - - - - - Configures the use of passwords for Windows features - - - - - - - - - - - text/plain - - - - - PreventAutomaticDeviceEncryptionForAzureADJoinedDevices - - - - - - - - - - - - - - - - - - - text/plain - - - - - RecoveryEnvironmentAuthentication - - - - - - - - This policy controls the requirement of Admin Authentication in RecoveryEnvironment. - - - - - - - - - - - text/plain - - - - - RequireDeviceEncryption - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireProvisioningPackageSignature - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireRetrieveHealthCertificateOnBoot - - - - - - - - - - - - - - - - - - - text/plain - - - - - - ServiceControlManager - - - - - - - - - - - - - - - - - - - - - SvchostProcessMitigation - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Settings - - - - - - - - - - - - - - - - - - - - - AllowAutoPlay - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDataSense - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDateTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowEditDeviceName - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLanguage - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowOnlineTips - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowPowerSleep - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowRegion - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowSignInOptions - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowVPN - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWorkplace - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowYourAccount - - - - - - - - - - - - - - - - - - - text/plain - - - - - PageVisibilityList - - - - - - - - - - - - - - - - - - - text/plain - - - - - - SmartScreen - - - - - - - - - - - - - - - - - - - - - EnableAppInstallControl - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableSmartScreenInShell - - - - - - - - - - - - - - - - - - - text/plain - - - - - PreventOverrideForFilesInShell - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Speech - - - - - - - - - - - - - - - - - - - - - AllowSpeechModelUpdate - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Start - - - - - - - - - - - - - - - - - - - - - AllowPinnedFolderDocuments - - - - - - - - This policy controls the visibility of the Documents shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderDownloads - - - - - - - - This policy controls the visibility of the Downloads shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderFileExplorer - - - - - - - - This policy controls the visibility of the File Explorer shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderHomeGroup - - - - - - - - This policy controls the visibility of the HomeGroup shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderMusic - - - - - - - - This policy controls the visibility of the Music shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderNetwork - - - - - - - - This policy controls the visibility of the Network shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderPersonalFolder - - - - - - - - This policy controls the visibility of the PersonalFolder shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderPictures - - - - - - - - This policy controls the visibility of the Pictures shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderSettings - - - - - - - - This policy controls the visibility of the Settings shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - AllowPinnedFolderVideos - - - - - - - - This policy controls the visibility of the Videos shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - - - DisableContextMenus - - - - - - - - Enabling this policy prevents context menus from being invoked in the Start Menu. - - - - - - - - - - - text/plain - - - - - ForceStartSize - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideAppList - - - - - - - - Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HideChangeAccountSettings - - - - - - - - Enabling this policy hides "Change account settings" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - - - HideFrequentlyUsedApps - - - - - - - - Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HideHibernate - - - - - - - - Enabling this policy hides "Hibernate" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - - - HideLock - - - - - - - - Enabling this policy hides "Lock" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - - - HidePowerButton - - - - - - - - Enabling this policy hides the power button from appearing in the start menu. - - - - - - - - - - - text/plain - - - - - HideRecentJumplists - - - - - - - - Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HideRecentlyAddedApps - - - - - - - - Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - - - HideRestart - - - - - - - - Enabling this policy hides "Restart/Update and restart" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - - - HideShutDown - - - - - - - - Enabling this policy hides "Shut down/Update and shut down" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - - - HideSignOut - - - - - - - - Enabling this policy hides "Sign out" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - - - HideSleep - - - - - - - - Enabling this policy hides "Sleep" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - - - HideSwitchAccount - - - - - - - - Enabling this policy hides "Switch account" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - - - HideUserTile - - - - - - - - Enabling this policy hides the user tile from appearing in the start menu. - - - - - - - - - - - text/plain - - - - - ImportEdgeAssets - - - - - - - - This policy setting allows you to import Edge assets to be used with StartLayout policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when StartLayout policy is modified. - - - - - - - - - - - text/plain - - - - - NoPinningToTaskbar - - - - - - - - This policy setting allows you to control pinning programs to the Taskbar. If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. - - - - - - - - - - - text/plain - - - - - StartLayout - - - - - - - - - - - - - - - - - - - text/plain - - - - - - Storage - - - - - - - - - - - - - - - - - - - - - AllowDiskHealthModelUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStorageSenseGlobal - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStorageSenseTemporaryFilesCleanup - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigStorageSenseCloudContentDehydrationThreshold - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigStorageSenseDownloadsCleanupThreshold - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigStorageSenseGlobalCadence - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigStorageSenseRecycleBinCleanupThreshold - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnhancedStorageDevices - - - - - - - - - - - - - - - - - - - text/plain - - - - - RemovableDiskDenyWriteAccess - - - - - - - - If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. Note: To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." - - - - - - - - - - - text/plain - - - - - - System - - - - - - - - - - - - - - - - - - - - - AllowBuildPreview - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowCommercialDataPipeline - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowDeviceNameInDiagnosticData - - - - - - - - This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. - - - - - - - - - - - text/plain - - - - - AllowEmbeddedMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowExperimentation - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowFontProviders - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLocation - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowStorageCard - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowTelemetry - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUserToResetPhone - - - - - - - - - - - - - - - - - - - text/plain - - - - - BootStartDriverInitialization - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureMicrosoft365UploadEndpoint - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureTelemetryOptInChangeNotification - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureTelemetryOptInSettingsUx - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDeviceDelete - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDiagnosticDataViewer - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDirectXDatabaseUpdate - - - - - - - - This group policy allows control over whether the DirectX Database Updater task will be run on the system. - - - - - - - - - - - text/plain - - - - - DisableEnterpriseAuthProxy - - - - - - - - This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. - - - - - - - - - - - text/plain - - - - - DisableOneDriveFileSync - - - - - - - - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. - - - - - - - - - - - text/plain - - - - - DisableSystemRestore - - - - - - - - - - - - - - - - - - - text/plain - - - - - FeedbackHubAlwaysSaveDiagnosticsLocally - - - - - - - - Diagnostic files created when a feedback is filed in the Feedback Hub app will always be saved locally. If this policy is not present or set to false, users will be presented with the option to save locally. The default is to not save locally. - - - - - - - - - - - text/plain - - - - - LimitEnhancedDiagnosticDataWindowsAnalytics - - - - - - - - This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. By configuring this setting, you're not stopping people from changing their Telemetry Settings; however, you are stopping them from choosing a higher level than you've set for the organization. To enable this behavior, you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced).If you configure these policy settings together, you'll send the Basic level of diagnostic data plus any additional events that are required for Windows Analytics, to Microsoft. The additional events are documented here: https://go.Microsoft.com/fwlink/?linked=847594. If you enable Enhanced diagnostic data in the Allow Telemetry policy setting, but you don't configure this policy setting, you'll send the required events for Windows Analytics, plus any additional Enhanced level telemetry data to Microsoft. This setting has no effect on computers configured to send Full, Basic, or Security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy setting. - - - - - - - - - - - text/plain - - - - - TelemetryProxy - - - - - - - - - - - - - - - - - - - text/plain - - - - - TurnOffFileHistory - - - - - - - - This policy setting allows you to turn off File History. - -If you enable this policy setting, File History cannot be activated to create regular, automatic backups. - -If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. - - - - - - - - - - - text/plain - - - - - - SystemServices - - - - - - - - - - - - - - - - - - - - - ConfigureHomeGroupListenerServiceStartupMode - - - - - - - - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - - - ConfigureHomeGroupProviderServiceStartupMode - - - - - - - - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - - - ConfigureXboxAccessoryManagementServiceStartupMode - - - - - - - - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - - - ConfigureXboxLiveAuthManagerServiceStartupMode - - - - - - - - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - - - ConfigureXboxLiveGameSaveServiceStartupMode - - - - - - - - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - - - ConfigureXboxLiveNetworkingServiceStartupMode - - - - - - - - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - - - - TaskManager - - - - - - - - - - - - - - - - - - - - - AllowEndTask - - - - - - - - This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled - - - - - - - - - - - text/plain - - - - - - TaskScheduler - - - - - - - - - - - - - - - - - - - - - EnableXboxGameSaveTask - - - - - - - - This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. - - - - - - - - - - - text/plain - - - - - - TextInput - - - - - - - - - - - - - - - - - - - - - AllowHardwareKeyboardTextSuggestions - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowIMELogging - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowIMENetworkAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInputPanel - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowJapaneseIMESurrogatePairCharacters - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowJapaneseIVSCharacters - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowJapaneseNonPublishingStandardGlyph - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowJapaneseUserDictionary - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowKeyboardTextSuggestions - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLanguageFeaturesUninstall - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowLinguisticDataCollection - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureJapaneseIMEVersion - - - - - - - - This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. -The following list shows the supported values: -0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. -1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. -2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. - - - - - - - - - - - text/plain - - - - - ConfigureSimplifiedChineseIMEVersion - - - - - - - - This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. -The following list shows the supported values: -0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. -1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. -2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. - - - - - - - - - - - text/plain - - - - - ConfigureTraditionalChineseIMEVersion - - - - - - - - This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. -The following list shows the supported values: -0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. -1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. -2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. - - - - - - - - - - - text/plain - - - - - EnableTouchKeyboardAutoInvokeInDesktopMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludeJapaneseIMEExceptJIS0208 - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludeJapaneseIMEExceptJIS0208andEUDC - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludeJapaneseIMEExceptShiftJIS - - - - - - - - - - - - - - - - - - - text/plain - - - - - ForceTouchKeyboardDockedState - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardDictationButtonAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardEmojiButtonAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardFullModeAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardHandwritingModeAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardNarrowModeAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardSplitModeAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - TouchKeyboardWideModeAvailability - - - - - - - - - - - - - - - - - - - text/plain - - - - - - TimeLanguageSettings - - - - - - - - - - - - - - - - - - - - - AllowSet24HourClock - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureTimeZone - - - - - - - - Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. - - - - - - - - - - - text/plain - - - - - - Troubleshooting - - - - - - - - - - - - - - - - - - - - - AllowRecommendations - - - - - - - - This policy setting applies recommended troubleshooting for known problems on the device and lets administrators configure how it's applied to their domains/IT environments. -Not configuring this policy setting will allow the user to configure if and how recommended troubleshooting is applied. - -Enabling this policy allows you to configure how recommended troubleshooting is applied on the user's device. You can select from one of the following values: -0 = Turn this feature off. -1 = Turn this feature off but still apply critical troubleshooting. -2 = Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. -3 = Run recommended troubleshooting automatically and notify the user after it's been successfully run. -4 = Run recommended troubleshooting automatically without notifying the user. -5 = Allow the user to choose their own recommended troubleshooting settings. - - - - - - - - - - - text/plain - - - - - - Update - - - - - - - - - - - - - - - - - - - - - ActiveHoursEnd - - - - - - - - - - - - - - - - - - - text/plain - - - - - ActiveHoursMaxRange - - - - - - - - - - - - - - - - - - - text/plain - - - - - ActiveHoursStart - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowAutoUpdate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowAutoWindowsUpdateDownloadOverMeteredNetwork - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowMUUpdateService - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowNonMicrosoftSignedUpdate - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowUpdateService - - - - - - - - - - - - - - - - - - - text/plain - - - - - AutomaticMaintenanceWakeUp - - - - - - - - This policy setting allows you to configure Automatic Maintenance wake up policy. - -The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. - -If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. - -If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. - - - - - - - - - - - text/plain - - - - - AutoRestartDeadlinePeriodInDays - - - - - - - - - - - - - - - - - - - text/plain - - - - - AutoRestartDeadlinePeriodInDaysForFeatureUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - AutoRestartNotificationSchedule - - - - - - - - - - - - - - - - - - - text/plain - - - - - AutoRestartRequiredNotificationDismissal - - - - - - - - - - - - - - - - - - - text/plain - - - - - BranchReadinessLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureDeadlineForFeatureUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureDeadlineForQualityUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureDeadlineGracePeriod - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureDeadlineNoAutoReboot - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigureFeatureUpdateUninstallPeriod - - - - - - - - Enable enterprises/IT admin to configure feature update uninstall period - - - - - - - - - - - text/plain - - - - - DeferFeatureUpdatesPeriodInDays - - - - - - - - - - - - - - - - - - - text/plain - - - - - DeferQualityUpdatesPeriodInDays - - - - - - - - - - - - - - - - - - - text/plain - - - - - DeferUpdatePeriod - - - - - - - - - - - - - - - - - - - text/plain - - - - - DeferUpgradePeriod - - - - - - - - - - - - - - - - - - - text/plain - - - - - DetectionFrequency - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDualScan - - - - - - - - Do not allow update deferral policies to cause scans against Windows Update - - - - - - - - - - - text/plain - - - - - DisableWUfBSafeguards - - - - - - - - - - - - - - - - - - - text/plain - - - - - EngagedRestartDeadline - - - - - - - - - - - - - - - - - - - text/plain - - - - - EngagedRestartDeadlineForFeatureUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - EngagedRestartSnoozeSchedule - - - - - - - - - - - - - - - - - - - text/plain - - - - - EngagedRestartSnoozeScheduleForFeatureUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - EngagedRestartTransitionSchedule - - - - - - - - - - - - - - - - - - - text/plain - - - - - EngagedRestartTransitionScheduleForFeatureUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - ExcludeWUDriversInQualityUpdate - - - - - - - - - - - - - - - - - - - text/plain - - - - - FillEmptyContentUrls - - - - - - - - - - - - - - - - - - - text/plain - - - - - IgnoreMOAppDownloadLimit - - - - - - - - - - - - - - - - - - - text/plain - - - - - IgnoreMOUpdateDownloadLimit - - - - - - - - - - - - - - - - - - - text/plain - - - - - ManagePreviewBuilds - - - - - - - - - - - - - - - - - - - text/plain - - - - - PauseDeferrals - - - - - - - - - - - - - - - - - - - text/plain - - - - - PauseFeatureUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - PauseFeatureUpdatesStartTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - PauseQualityUpdates - - - - - - - - - - - - - - - - - - - text/plain - - - - - PauseQualityUpdatesStartTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - PhoneUpdateRestrictions - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireDeferUpgrade - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequireUpdateApproval - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallDay - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallEveryWeek - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallFirstWeek - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallFourthWeek - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallSecondWeek - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallThirdWeek - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduledInstallTime - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduleImminentRestartWarning - - - - - - - - - - - - - - - - - - - text/plain - - - - - ScheduleRestartWarning - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetAutoRestartNotificationDisable - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetDisablePauseUXAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetDisableUXWUAccess - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetEDURestart - - - - - - - - - - - - - - - - - - - text/plain - - - - - SetProxyBehaviorForUpdateDetection - - - - - - - - - - - - - - - - - - - text/plain - - - - - TargetReleaseVersion - - - - - - - - - - - - - - - - - - - text/plain - - - - - UpdateNotificationLevel - - - - - - - - - - - - - - - - - - - text/plain - - - - - UpdateServiceUrl - - - - - - - - - - - - - - - - - - - text/plain - - - - - UpdateServiceUrlAlternate - - - - - - - - - - - - - - - - - - - text/plain - - - - - - UserRights - - - - - - - - - - - - - - - - - - - - - AccessCredentialManagerAsTrustedCaller - - - - - - - - This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. - - - - - - - - - - - text/plain - - - - - AccessFromNetwork - - - - - - - - This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. - - - - - - - - - - - text/plain - - - - - ActAsPartOfTheOperatingSystem - - - - - - - - This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. - - - - - - - - - - - text/plain - - - - - AllowLocalLogOn - - - - - - - - This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. - - - - - - - - - - - text/plain - - - - - BackupFilesAndDirectories - - - - - - - - This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users - - - - - - - - - - - text/plain - - - - - ChangeSystemTime - - - - - - - - This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. - - - - - - - - - - - text/plain - - - - - CreateGlobalObjects - - - - - - - - This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. - - - - - - - - - - - text/plain - - - - - CreatePageFile - - - - - - - - This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users - - - - - - - - - - - text/plain - - - - - CreatePermanentSharedObjects - - - - - - - - This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it. - - - - - - - - - - - text/plain - - - - - CreateSymbolicLinks - - - - - - - - This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. - - - - - - - - - - - text/plain - - - - - CreateToken - - - - - - - - This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. - - - - - - - - - - - text/plain - - - - - DebugPrograms - - - - - - - - This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. - - - - - - - - - - - text/plain - - - - - DenyAccessFromNetwork - - - - - - - - This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies. - - - - - - - - - - - text/plain - - - - - DenyLocalLogOn - - - - - - - - This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. - - - - - - - - - - - text/plain - - - - - DenyRemoteDesktopServicesLogOn - - - - - - - - This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. - - - - - - - - - - - text/plain - - - - - EnableDelegation - - - - - - - - This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. - - - - - - - - - - - text/plain - - - - - GenerateSecurityAudits - - - - - - - - This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled. - - - - - - - - - - - text/plain - - - - - ImpersonateClient - - - - - - - - Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. -1) The access token that is being impersonated is for this user. -2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. -3) The requested level is less than Impersonate, such as Anonymous or Identify. -Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. - - - - - - - - - - - text/plain - - - - - IncreaseSchedulingPriority - - - - - - - - This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. - - - - - - - - - - - text/plain - - - - - LoadUnloadDeviceDrivers - - - - - - - - This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. - - - - - - - - - - - text/plain - - - - - LockMemory - - - - - - - - This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). - - - - - - - - - - - text/plain - - - - - ManageAuditingAndSecurityLog - - - - - - - - This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. - - - - - - - - - - - text/plain - - - - - ManageVolume - - - - - - - - This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. - - - - - - - - - - - text/plain - - - - - ModifyFirmwareEnvironment - - - - - - - - This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. - - - - - - - - - - - text/plain - - - - - ModifyObjectLabel - - - - - - - - This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. - - - - - - - - - - - text/plain - - - - - ProfileSingleProcess - - - - - - - - This user right determines which users can use performance monitoring tools to monitor the performance of system processes. - - - - - - - - - - - text/plain - - - - - RemoteShutdown - - - - - - - - This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. - - - - - - - - - - - text/plain - - - - - RestoreFilesAndDirectories - - - - - - - - This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. - - - - - - - - - - - text/plain - - - - - TakeOwnership - - - - - - - - This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. - - - - - - - - - - - text/plain - - - - - - Wifi - - - - - - - - - - - - - - - - - - - - - AllowAutoConnectToWiFiSenseHotspots - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowInternetSharing - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowManualWiFiConfiguration - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWiFi - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWiFiDirect - - - - - - - - - - - - - - - - - - - text/plain - - - - - WLANScanMode - - - - - - - - - - - - - - - - - - - text/plain - - - - - - WindowsConnectionManager - - - - - - - - - - - - - - - - - - - - - ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork - - - - - - - - - - - - - - - - - - - text/plain - - - - - - WindowsDefenderSecurityCenter - - - - - - - - - - - - - - - - - - - - - CompanyName - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableAccountProtectionUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableAppBrowserUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableClearTpmButton - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableDeviceSecurityUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableEnhancedNotifications - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableFamilyUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableHealthUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableNetworkUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableNotifications - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableTpmFirmwareUpdateWarning - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableVirusUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisallowExploitProtectionOverride - - - - - - - - - - - - - - - - - - - text/plain - - - - - Email - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableCustomizedToasts - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableInAppCustomization - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideRansomwareDataRecovery - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideSecureBoot - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideTPMTroubleshooting - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideWindowsSecurityNotificationAreaControl - - - - - - - - - - - - - - - - - - - text/plain - - - - - Phone - - - - - - - - - - - - - - - - - - - text/plain - - - - - URL - - - - - - - - - - - - - - - - - - - text/plain - - - - - - WindowsInkWorkspace - - - - - - - - - - - - - - - - - - - - - AllowSuggestedAppsInWindowsInkWorkspace - - - - - - - - - - - - - - - - - - - text/plain - - - - - AllowWindowsInkWorkspace - - - - - - - - - - - - - - - - - - - text/plain - - - - - - WindowsLogon - - - - - - - - - - - - - - - - - - - - - AllowAutomaticRestartSignOn - - - - - - - - - - - - - - - - - - - text/plain - - - - - ConfigAutomaticRestartSignOn - - - - - - - - - - - - - - - - - - - text/plain - - - - - DisableLockScreenAppNotifications - - - - - - - - - - - - - - - - - - - text/plain - - - - - DontDisplayNetworkSelectionUI - - - - - - - - - - - - - - - - - - - text/plain - - - - - EnableFirstLogonAnimation - - - - - - - - This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. - -If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. - -If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. - -If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. - -Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. - - - - - - - - - - - text/plain - - - - - EnumerateLocalUsersOnDomainJoinedComputers - - - - - - - - - - - - - - - - - - - text/plain - - - - - HideFastUserSwitching - - - - - - - - This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager. If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied. The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager. If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations. - - - - - - - - - - - text/plain - - - - - - WindowsPowerShell - - - - - - - - - - - - - - - - - - - - - TurnOnPowerShellScriptBlockLogging - - - - - - - - - - - - - - - - - - - text/plain - - - - - - WirelessDisplay - - - - - - - - - - - - - - - - - - - - - AllowMdnsAdvertisement - - - - - - - - This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. - - - - - - - - - - - text/plain - - - - - AllowMdnsDiscovery - - - - - - - - This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. - - - - - - - - - - - text/plain - - - - - AllowProjectionFromPC - - - - - - - - This policy allows you to turn off projection from a PC. - If you set it to 0, your PC cannot discover or project to other devices. - If you set it to 1, your PC can discover and project to other devices. - - - - - - - - - - - text/plain - - - - - AllowProjectionFromPCOverInfrastructure - - - - - - - - This policy allows you to turn off projection from a PC over infrastructure. - If you set it to 0, your PC cannot discover or project to other infrastructure devices, though it may still be possible to discover and project over WiFi Direct. - If you set it to 1, your PC can discover and project to other devices over infrastructure. - - - - - - - - - - - text/plain - - - - - AllowProjectionToPC - - - - - - - - This policy setting allows you to turn off projection to a PC - If you set it to 0, your PC isn't discoverable and can't be projected to - If you set it to 1, your PC is discoverable and can be projected to above the lock screen only. The user has an option to turn it always on or off except for manual launch, too. - - - - - - - - - - - text/plain - - - - - AllowProjectionToPCOverInfrastructure - - - - - - - - This policy setting allows you to turn off projection to a PC over infrastructure. - If you set it to 0, your PC cannot be discoverable and can't be projected to over infrastructure, though it may still be possible to project over WiFi Direct. - If you set it to 1, your PC can be discoverable and can be projected to over infrastructure. - - - - - - - - - - - text/plain - - - - - AllowUserInputFromWirelessDisplayReceiver - - - - - - - - - - - - - - - - - - - text/plain - - - - - RequirePinForPairing - - - - - - - - This policy setting allows you to require a pin for pairing. - If you set this to 0, a pin isn't required for pairing. - If you set this to 1, the pairing ceremony for new devices will always require a PIN. - If you set this to 2, all pairings will require PIN. - - - - - - - - - - - text/plain - - - - - - - Result - - - - - - - - - - - - - - - - - - - AboveLock - - - - - - - - - - - - - - - - - - - AllowActionCenterNotifications - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowCortanaAboveLock - - - - - 1 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - AllowCortanaAboveLock - LowestValueMostSecure - - - - AllowToasts - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - - Accounts - - - - - - - - - - - - - - - - - - - AllowAddingNonMicrosoftAccountsManually - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowMicrosoftAccountConnection - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowMicrosoftAccountSignInAssistant - - - - - 1 - - - - - - - - - - - - text/plain - - - LastWrite - - - - DomainNamesForEmailSync - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - ActiveXControls - - - - - - - - - - - - - - - - - - - ApprovedInstallationSites - - - - - - - - - - - - - - - - - text/plain - - phone - ActiveXInstallService.admx - ActiveXInstallService~AT~WindowsComponents~AxInstSv - ApprovedActiveXInstallSites - LastWrite - - - - - ApplicationDefaults - - - - - - - - - - - - - - - - - - - DefaultAssociationsConfiguration - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsExplorer.admx - DefaultAssociationsConfiguration_TextBox - WindowsExplorer~AT~WindowsComponents~WindowsExplorer - DefaultAssociationsConfiguration - LastWrite - - - - EnableAppUriHandlers - - - - - 1 - Enables web-to-app linking, which allows apps to be launched with a http(s) URI - - - - - - - - - - - text/plain - - - GroupPolicy.admx - GroupPolicy~AT~System~PolicyPolicies - EnableAppUriHandlers - HighestValueMostSecure - - - - - ApplicationManagement - - - - - - - - - - - - - - - - - - - AllowAllTrustedApps - - - - - 65535 - - - - - - - - - - - - text/plain - - - AppxPackageManager.admx - AppxPackageManager~AT~WindowsComponents~AppxDeployment - AppxDeploymentAllowAllTrustedApps - LowestValueMostSecure - - - - AllowAppStoreAutoUpdate - - - - - 2 - - - - - - - - - - - - text/plain - - - WindowsStore.admx - WindowsStore~AT~WindowsComponents~WindowsStore - DisableAutoInstall - LowestValueMostSecure - - - - AllowDeveloperUnlock - - - - - 65535 - - - - - - - - - - - - text/plain - - - AppxPackageManager.admx - AppxPackageManager~AT~WindowsComponents~AppxDeployment - AllowDevelopmentWithoutDevLicense - LowestValueMostSecure - - - - AllowGameDVR - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - GameDVR.admx - GameDVR~AT~WindowsComponents~GAMEDVR - AllowGameDVR - LowestValueMostSecure - - - - AllowSharedUserAppData - - - - - 0 - - - - - - - - - - - - text/plain - - - AppxPackageManager.admx - AppxPackageManager~AT~WindowsComponents~AppxDeployment - AllowSharedLocalAppData - LowestValueMostSecure - - - - AllowStore - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - ApplicationRestrictions - - - - - - - - - - - - - - - - - text/plain - - desktop - LastWrite - - - - BlockNonAdminUserInstall - - - - - 0 - - - - - - - - - - - - text/plain - - - AppxPackageManager.admx - AppxPackageManager~AT~WindowsComponents~AppxDeployment - BlockNonAdminUserInstall - LowestValueMostSecure - - - - DisableStoreOriginatedApps - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsStore.admx - WindowsStore~AT~WindowsComponents~WindowsStore - DisableStoreApps - LowestValueMostSecure - - - - LaunchAppAfterLogOn - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are to be launched after logon. - - - - - - - - - - - text/plain - - LastWrite - - - - MSIAllowUserControlOverInstall - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - MSI.admx - MSI~AT~WindowsComponents~MSI - EnableUserControl - HighestValueMostSecure - - - - MSIAlwaysInstallWithElevatedPrivileges - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - MSI.admx - MSI~AT~WindowsComponents~MSI - AlwaysInstallElevated - HighestValueMostSecure - - - - RequirePrivateStoreOnly - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsStore.admx - WindowsStore~AT~WindowsComponents~WindowsStore - RequirePrivateStoreOnly - HighestValueMostSecure - - - - RestrictAppDataToSystemVolume - - - - - 0 - - - - - - - - - - - - text/plain - - - AppxPackageManager.admx - AppxPackageManager~AT~WindowsComponents~AppxDeployment - RestrictAppDataToSystemVolume - LowestValueMostSecure - - - - RestrictAppToSystemVolume - - - - - 0 - - - - - - - - - - - - text/plain - - - AppxPackageManager.admx - AppxPackageManager~AT~WindowsComponents~AppxDeployment - DisableDeploymentToNonSystemVolumes - LowestValueMostSecure - - - - ScheduleForceRestartForUpdateFailures - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -]]> - - - - - AppRuntime - - - - - - - - - - - - - - - - - - - AllowMicrosoftAccountsToBeOptional - - - - - - - - - - - - - - - - - text/plain - - phone - AppXRuntime.admx - AppXRuntime~AT~WindowsComponents~AppXRuntime - AppxRuntimeMicrosoftAccountsOptional - LastWrite - - - - - AppVirtualization - - - - - - - - - - - - - - - - - - - AllowAppVClient - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV - EnableAppV - LastWrite - - - - AllowDynamicVirtualization - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Virtualization - Virtualization_JITVEnable - LastWrite - - - - AllowPackageCleanup - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_PackageManagement - PackageManagement_AutoCleanupEnable - LastWrite - - - - AllowPackageScripts - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Scripting - Scripting_Enable_Package_Scripts - LastWrite - - - - AllowPublishingRefreshUX - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Publishing - Enable_Publishing_Refresh_UX - LastWrite - - - - AllowReportingServer - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Reporting - Reporting_Server_Policy - LastWrite - - - - AllowRoamingFileExclusions - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Integration - Integration_Roaming_File_Exclusions - LastWrite - - - - AllowRoamingRegistryExclusions - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Integration - Integration_Roaming_Registry_Exclusions - LastWrite - - - - AllowStreamingAutoload - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Steaming_Autoload - LastWrite - - - - ClientCoexistenceAllowMigrationmode - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Client_Coexistence - Client_Coexistence_Enable_Migration_mode - LastWrite - - - - IntegrationAllowRootGlobal - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Integration - Integration_Root_User - LastWrite - - - - IntegrationAllowRootUser - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Integration - Integration_Root_Global - LastWrite - - - - PublishingAllowServer1 - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Publishing - Publishing_Server1_Policy - LastWrite - - - - PublishingAllowServer2 - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Publishing - Publishing_Server2_Policy - LastWrite - - - - PublishingAllowServer3 - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Publishing - Publishing_Server3_Policy - LastWrite - - - - PublishingAllowServer4 - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Publishing - Publishing_Server4_Policy - LastWrite - - - - PublishingAllowServer5 - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Publishing - Publishing_Server5_Policy - LastWrite - - - - StreamingAllowCertificateFilterForClient_SSL - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Certificate_Filter_For_Client_SSL - LastWrite - - - - StreamingAllowHighCostLaunch - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Allow_High_Cost_Launch - LastWrite - - - - StreamingAllowLocationProvider - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Location_Provider - LastWrite - - - - StreamingAllowPackageInstallationRoot - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Package_Installation_Root - LastWrite - - - - StreamingAllowPackageSourceRoot - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Package_Source_Root - LastWrite - - - - StreamingAllowReestablishmentInterval - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Reestablishment_Interval - LastWrite - - - - StreamingAllowReestablishmentRetries - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Reestablishment_Retries - LastWrite - - - - StreamingSharedContentStoreMode - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Shared_Content_Store_Mode - LastWrite - - - - StreamingSupportBranchCache - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Support_Branch_Cache - LastWrite - - - - StreamingVerifyCertificateRevocationList - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Streaming - Streaming_Verify_Certificate_Revocation_List - LastWrite - - - - VirtualComponentsAllowList - - - - - - - - - - - - - - - - - text/plain - - phone - appv.admx - appv~AT~System~CAT_AppV~CAT_Virtualization - Virtualization_JITVAllowList - LastWrite - - - - - Audit - - - - - - - - - - - - - - - - - - - AccountLogon_AuditCredentialValidation - - - - - 0 - This policy setting allows you to audit events generated by validation tests on user account logon credentials. - -Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon - Audit Credential Validation - LastWrite - - - - AccountLogon_AuditKerberosAuthenticationService - - - - - 0 - This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. - -If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon - Audit Kerberos Authentication Service - LastWrite - - - - AccountLogon_AuditKerberosServiceTicketOperations - - - - - 0 - This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. - -If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon - Audit Kerberos Service Ticket Operations - LastWrite - - - - AccountLogon_AuditOtherAccountLogonEvents - - - - - 0 - This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. - -Currently, there are no events in this subcategory. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Logon - Audit Other Account Logon Events - LastWrite - - - - AccountLogonLogoff_AuditAccountLockout - - - - - 1 - This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. - -If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. - -Logon events are essential for understanding user activity and to detect potential attacks. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Account Lockout - LastWrite - - - - AccountLogonLogoff_AuditGroupMembership - - - - - 0 - This policy allows you to audit the group memberhsip information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. - -When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group memberhsip information cannot fit in a single security audit event. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Group Membership - LastWrite - - - - AccountLogonLogoff_AuditIPsecExtendedMode - - - - - 0 - This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. - -If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit IPsec Extended Mode - LastWrite - - - - AccountLogonLogoff_AuditIPsecMainMode - - - - - 0 - This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. - -If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit IPsec Main Mode - LastWrite - - - - AccountLogonLogoff_AuditIPsecQuickMode - - - - - 0 - This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. - -If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts.If - you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit IPsec Quick Mode - LastWrite - - - - AccountLogonLogoff_AuditLogoff - - - - - 1 - This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. - -If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. -If you do not configure this policy setting, no audit event is generated when a logon session is closed. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Logoff - LastWrite - - - - AccountLogonLogoff_AuditLogon - - - - - 1 - This policy setting allows you to audit events generated by user account logon attempts on the computer. -Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. The following events are included: - Successful logon attempts. - Failed logon attempts. - Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. - Security identifiers (SIDs) were filtered and not allowed to log on. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Logon - LastWrite - - - - AccountLogonLogoff_AuditNetworkPolicyServer - - - - - 3 - This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. -If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. -If you do not configure this policy settings, IAS and NAP user access requests are not audited. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Network Policy Server - LastWrite - - - - AccountLogonLogoff_AuditOtherLogonLogoffEvents - - - - - 0 - This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: - Terminal Services session disconnections. - New Terminal Services sessions. - Locking and unlocking a workstation. - Invoking a screen saver. - Dismissal of a screen saver. - Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. - Access to a wireless network granted to a user or computer account. - Access to a wired 802.1x network granted to a user or computer account. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Other Logon Logoff Events - LastWrite - - - - AccountLogonLogoff_AuditSpecialLogon - - - - - 1 - This policy setting allows you to audit events generated by special logons such as the following : - The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. - A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see article 947223 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121697). - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit Special Logon - LastWrite - - - - AccountLogonLogoff_AuditUserDeviceClaims - - - - - 0 - This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. - -User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. - -When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Logon/Logoff - Audit User Device Claims - LastWrite - - - - AccountManagement_AuditApplicationGroupManagement - - - - - 0 - This policy setting allows you to audit events generated by changes to application groups such as the following: - Application group is created, changed, or deleted. - Member is added or removed from an application group. - -If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an application group changes. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management - Audit Application Group Management - LastWrite - - - - AccountManagement_AuditComputerAccountManagement - - - - - 0 - This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. - -If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a computer account changes. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management - Audit Computer Account Management - LastWrite - - - - AccountManagement_AuditDistributionGroupManagement - - - - - 0 - This policy setting allows you to audit events generated by changes to distribution groups such as the following: - Distribution group is created, changed, or deleted. - Member is added or removed from a distribution group. - Distribution group type is changed. - -If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a distribution group changes. - -Note: Events in this subcategory are logged only on domain controllers. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management - Audit Distributio Group Management - LastWrite - - - - AccountManagement_AuditOtherAccountManagementEvents - - - - - 0 - This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: - The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. - The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. - Changes to the Default Domain Group Policy under the following Group Policy paths: -Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy -Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management - Audit Other Account Management Events - LastWrite - - - - AccountManagement_AuditSecurityGroupManagement - - - - - 1 - This policy setting allows you to audit events generated by changes to security groups such as the following: - Security group is created, changed, or deleted. - Member is added or removed from a security group. - Group type is changed. - -If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a security group changes. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management - Audit Security Group Management - LastWrite - - - - AccountManagement_AuditUserAccountManagement - - - - - 1 - This policy setting allows you to audit changes to user accounts. Events include the following: - A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. - A user account’s password is set or changed. - A security identifier (SID) is added to the SID History of a user account. - The Directory Services Restore Mode password is configured. - Permissions on administrative user accounts are changed. - Credential Manager credentials are backed up or restored. - -If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated when a user account changes. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Account Management - Audit User Account Management - LastWrite - - - - DetailedTracking_AuditDPAPIActivity - - - - - 0 - This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. - -If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking - Audit DPAPI Activity - LastWrite - - - - DetailedTracking_AuditPNPActivity - - - - - 0 - This policy setting allows you to audit when plug and play detects an external device. - -If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. -If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking - Audit PNP Activity - LastWrite - - - - DetailedTracking_AuditProcessCreation - - - - - 0 - This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. - -If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a process is created. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking - Audit Process Creation - LastWrite - - - - DetailedTracking_AuditProcessTermination - - - - - 0 - This policy setting allows you to audit events generated when a process ends. - -If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a process ends. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking - Audit Process Termination - LastWrite - - - - DetailedTracking_AuditRPCEvents - - - - - 0 - This policy setting allows you to audit inbound remote procedure call (RPC) connections. - -If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking - Audit RPC Events - LastWrite - - - - DetailedTracking_AuditTokenRightAdjusted - - - - - 0 - This policy setting allows you to audit events generated by adjusting the privileges of a token. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Detailed Tracking - Audit Token Right Adjusted - LastWrite - - - - DSAccess_AuditDetailedDirectoryServiceReplication - - - - - 0 - This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access - Audit Detailed Directory Service Replication - LastWrite - - - - DSAccess_AuditDirectoryServiceAccess - - - - - 0 - This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. - -Only AD DS objects with a matching system access control list (SACL) are logged. - -Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access - Audit Directory Service Access - LastWrite - - - - DSAccess_AuditDirectoryServiceChanges - - - - - 0 - This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. - -When possible, events logged in this subcategory indicate the old and new values of the object’s properties. - -Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. - -Note: Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. - -If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. -If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access - Audit Directory Service Changes - LastWrite - - - - DSAccess_AuditDirectoryServiceReplication - - - - - 0 - This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. - -If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. -If you do not configure this policy setting, no audit event is generated during AD DS replication. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~DS Access - Audit Directory Service Replication - LastWrite - - - - ObjectAccess_AuditApplicationGenerated - - - - - 0 - This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. -Events in this subcategory include: - Creation of an application client context. - Deletion of an application client context. - Initialization of an application client context. - Other application operations using the Windows Auditing APIs. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Application Generated - LastWrite - - - - ObjectAccess_AuditCentralAccessPolicyStaging - - - - - 0 - This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. - -If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: -1) Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. -2) Failure audits when configured records access attempts when: - a) The current central access policy does not grant access but the proposed policy grants access. - b) A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. - -Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Central Access Policy Staging - LastWrite - - - - ObjectAccess_AuditCertificationServices - - - - - 0 - This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. -AD CS operations include the following: - AD CS startup/shutdown/backup/restore. - Changes to the certificate revocation list (CRL). - New certificate requests. - Issuing of a certificate. - Revocation of a certificate. - Changes to the Certificate Manager settings for AD CS. - Changes in the configuration of AD CS. - Changes to a Certificate Services template. - Importing of a certificate. - Publishing of a certification authority certificate is to Active Directory Domain Services. - Changes to the security permissions for AD CS. - Archival of a key. - Importing of a key. - Retrieval of a key. - Starting of Online Certificate Status Protocol (OCSP) Responder Service. - Stopping of Online Certificate Status Protocol (OCSP) Responder Service. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Certification Services - LastWrite - - - - ObjectAccess_AuditDetailedFileShare - - - - - 0 - This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. - -If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. - -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Detailed File Share - LastWrite - - - - ObjectAccess_AuditFileShare - - - - - 0 - This policy setting allows you to audit attempts to access a shared folder. - -If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. - -Note: There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit File Share - LastWrite - - - - ObjectAccess_AuditFileSystem - - - - - 0 - This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see https://go.microsoft.com/fwlink/?LinkId=122083. - -If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. - -Note: You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit File System - LastWrite - - - - ObjectAccess_AuditFilteringPlatformConnection - - - - - 0 - This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). The following events are included: - The Windows Firewall Service blocks an application from accepting incoming connections on the network. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits a bind to a local port. - The WFP blocks a bind to a local port. - The WFP allows a connection. - The WFP blocks a connection. - The WFP permits an application or service to listen on a port for incoming connections. - The WFP blocks an application or service to listen on a port for incoming connections. - -If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. -If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Filtering Platform Connection - LastWrite - - - - ObjectAccess_AuditFilteringPlatformPacketDrop - - - - - 0 - This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Filtering Platform Packet Drop - LastWrite - - - - ObjectAccess_AuditHandleManipulation - - - - - 0 - This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. - -If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a handle is manipulated. - -Note: Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Handle Manipulation - LastWrite - - - - ObjectAccess_AuditKernelObject - - - - - 0 - This policy setting allows you to audit attempts to access the kernel, which include mutexes and semaphores. -Only kernel objects with a matching system access control list (SACL) generate security audit events. - -Note: The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Kernel Object - LastWrite - - - - ObjectAccess_AuditOtherObjectAccessEvents - - - - - 0 - This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. -For scheduler jobs, the following are audited: - Job created. - Job deleted. - Job enabled. - Job disabled. - Job updated. -For COM+ objects, the following are audited: - Catalog object added. - Catalog object updated. - Catalog object deleted. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Other Object Access Events - LastWrite - - - - ObjectAccess_AuditRegistry - - - - - 0 - This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. - -If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. - -Note: You can set a SACL on a registry object using the Permissions dialog box. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Registry - LastWrite - - - - ObjectAccess_AuditRemovableStorage - - - - - 0 - This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. - -If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. - -If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit Removable Storage - LastWrite - - - - ObjectAccess_AuditSAM - - - - - 0 - This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. -SAM objects include the following: - SAM_ALIAS -- A local group. - SAM_GROUP -- A group that is not a local group. - SAM_USER – A user account. - SAM_DOMAIN – A domain. - SAM_SERVER – A computer account. -If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. -Note: Only the System Access Control List (SACL) for SAM_SERVER can be modified. -Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see article 841001 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=121698). - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Object Access - Audit SAM - LastWrite - - - - PolicyChange_AuditAuthenticationPolicyChange - - - - - 1 - This policy setting allows you to audit events generated by changes to the authentication policy such as the following: - Creation of forest and domain trusts. - Modification of forest and domain trusts. - Removal of forest and domain trusts. - Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. - Granting of any of the following user rights to a user or group: - Access This Computer From the Network. - Allow Logon Locally. - Allow Logon Through Terminal Services. - Logon as a Batch Job. - Logon a Service. - Namespace collision. For example, when a new trust has the same name as an existing namespace name. - -If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. - -Note: The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change - Audit Authentication Policy Change - LastWrite - - - - PolicyChange_AuditAuthorizationPolicyChange - - - - - 0 - This policy setting allows you to audit events generated by changes to the authorization policy such as the following: - Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. - Changes in the Encrypted File System (EFS) policy. - Changes to the Resource attributes of an object. - Changes to the Central Access Policy (CAP) applied to an object. - -If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when the authorization policy changes. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change - Audit Authorization Policy Change - LastWrite - - - - PolicyChange_AuditFilteringPlatformPolicyChange - - - - - 0 - This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP) such as the following: - IPsec services status. - Changes to IPsec policy settings. - Changes to Windows Firewall policy settings. - Changes to WFP providers and engine. - -If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change - Audit Filtering Platform Policy Change - LastWrite - - - - PolicyChange_AuditMPSSVCRuleLevelPolicyChange - - - - - 0 - This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. Events include the following: - Reporting of active policies when Windows Firewall service starts. - Changes to Windows Firewall rules. - Changes to Windows Firewall exception list. - Changes to Windows Firewall settings. - Rules ignored or not applied by Windows Firewall Service. - Changes to Windows Firewall Group Policy settings. - -If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change - Audit MPSSVC Rule Level Policy Change - LastWrite - - - - PolicyChange_AuditOtherPolicyChangeEvents - - - - - 0 - This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: - Trusted Platform Module (TPM) configuration changes. - Kernel-mode cryptographic self tests. - Cryptographic provider operations. - Cryptographic context operations or modifications. - Applied Central Access Policies (CAPs) changes. - Boot Configuration Data (BCD) modifications. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change - Audit Other Policy Change Events - LastWrite - - - - PolicyChange_AuditPolicyChange - - - - - 1 - This policy setting allows you to audit changes in the security audit policy settings such as the following: - Settings permissions and audit settings on the Audit Policy object. - Changes to the system audit policy. - Registration of security event sources. - De-registration of security event sources. - Changes to the per-user audit settings. - Changes to the value of CrashOnAuditFail. - Changes to the system access control list on a file system or registry object. - Changes to the Special Groups list. - -Note: System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Policy Change - Audit Policy Change - LastWrite - - - - PrivilegeUse_AuditNonSensitivePrivilegeUse - - - - - 0 - This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). -The following privileges are non-sensitive: - Access Credential Manager as a trusted caller. - Access this computer from the network. - Add workstations to domain. - Adjust memory quotas for a process. - Allow log on locally. - Allow log on through Terminal Services. - Bypass traverse checking. - Change the system time. - Create a pagefile. - Create global objects. - - Create permanent shared objects. - Create symbolic links. - Deny access this computer from the network. - Deny log on as a batch job. - Deny log on as a service. - Deny log on locally. - Deny log on through Terminal Services. - Force shutdown from a remote system. - Increase a process working set. - Increase scheduling priority. - Lock pages in memory. - Log on as a batch job. - Log on as a service. - Modify an object label. - Perform volume maintenance tasks. - Profile single process. - Profile system performance. - Remove computer from docking station. - Shut down the system. - Synchronize directory service data. - -If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. -If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use - Audit Non Sensitive Privilege Use - LastWrite - - - - PrivilegeUse_AuditOtherPrivilegeUseEvents - - - - - 0 - Not used. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use - Audit Other Privilege Use Events - LastWrite - - - - PrivilegeUse_AuditSensitivePrivilegeUse - - - - - 0 - This policy setting allows you to audit events generated when sensitive privileges (user rights) are used such as the following: - A privileged service is called. - One of the following privileges are called: - Act as part of the operating system. - Back up files and directories. - Create a token object. - Debug programs. - Enable computer and user accounts to be trusted for delegation. - Generate security audits. - Impersonate a client after authentication. - Load and unload device drivers. - Manage auditing and security log. - Modify firmware environment values. - Replace a process-level token. - Restore files and directories. - Take ownership of files or other objects. - -If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. -If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. - - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~Privilege Use - Audit Sensitive Privilege Use - LastWrite - - - - System_AuditIPsecDriver - - - - - 0 - This policy setting allows you to audit events generated by the IPsec filter driver such as the following: - Startup and shutdown of the IPsec services. - Network packets dropped due to integrity check failure. - Network packets dropped due to replay check failure. - Network packets dropped due to being in plaintext. - Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. - Inability to process IPsec filters. - -If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System - Audit IPsec Driver - LastWrite - - - - System_AuditOtherSystemEvents - - - - - 3 - This policy setting allows you to audit any of the following events: - Startup and shutdown of the Windows Firewall service and driver. - Security policy processing by the Windows Firewall Service. - Cryptography key file and migration operations. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System - Audit Other System Events - LastWrite - - - - System_AuditSecurityStateChange - - - - - 1 - This policy setting allows you to audit events generated by changes in the security state of the computer such as the following events: - Startup and shutdown of the computer. - Change of system time. - Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System - Audit Security State Change - LastWrite - - - - System_AuditSecuritySystemExtension - - - - - 0 - This policy setting allows you to audit events related to security system extensions or services such as the following: - A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. - A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. -If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. -If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System - Audit Security System Extension - LastWrite - - - - System_AuditSystemIntegrity - - - - - 3 - This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: - Events that could not be written to the event log because of a problem with the auditing system. - A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. - The detection of a Remote Procedure Call (RPC) that compromises system integrity. - The detection of a hash value of an executable file that is not valid as determined by Code Integrity. - Cryptographic operations that compromise system integrity. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Advanced Audit Policy Configuration~System Audit Policies~System - Audit System Integrity - LastWrite - - - - - Authentication - - - - - - - - - - - - - - - - - - - AllowAadPasswordReset - - - - - 0 - Specifies whether password reset is enabled for AAD accounts. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowFastReconnect - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowSecondaryAuthenticationDevice - - - - - 0 - - - - - - - - - - - - text/plain - - - DeviceCredential.admx - DeviceCredential~AT~WindowsComponents~MSSecondaryAuthFactorCategory - MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice - LowestValueMostSecure - - - - ConfigureWebcamAccessDomainNames - - - - - - Specifies a list of domains that are allowed to access the webcam in CXH-based authentication scenarios. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - EnableFastFirstSignIn - - - - - 0 - Specifies whether new non-admin AAD accounts should auto-connect to pre-created candidate local accounts - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - EnableWebSignIn - - - - - 0 - Specifies whether web-based sign in is allowed for logging in to Windows - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - PreferredAadTenantDomainName - - - - - - Specifies the preferred domain among available domains in the AAD tenant. - - - - - - - - - - - text/plain - - LastWrite - - - - - Autoplay - - - - - - - - - - - - - - - - - - - DisallowAutoplayForNonVolumeDevices - - - - - - - - - - - - - - - - - text/plain - - phone - AutoPlay.admx - AutoPlay~AT~WindowsComponents~AutoPlay - NoAutoplayfornonVolume - LastWrite - - - - SetDefaultAutoRunBehavior - - - - - - - - - - - - - - - - - text/plain - - phone - AutoPlay.admx - AutoPlay~AT~WindowsComponents~AutoPlay - NoAutorun - LastWrite - - - - TurnOffAutoPlay - - - - - - - - - - - - - - - - - text/plain - - phone - AutoPlay.admx - AutoPlay~AT~WindowsComponents~AutoPlay - Autorun - LastWrite - - - - - Bitlocker - - - - - - - - - - - - - - - - - - - EncryptionMethod - - - - - 6 - - - - - - - - - - - - text/plain - - - LastWrite - - - - - BITS - - - - - - - - - - - - - - - - - - - BandwidthThrottlingEndTime - - - - - 17 - - - - - - - - - - - - text/plain - - - Bits.admx - BITS_BandwidthLimitSchedTo - Bits~AT~Network~BITS - BITS_MaxBandwidth - LastWrite - - - - BandwidthThrottlingStartTime - - - - - 8 - - - - - - - - - - - - text/plain - - - Bits.admx - BITS_BandwidthLimitSchedFrom - Bits~AT~Network~BITS - BITS_MaxBandwidth - LastWrite - - - - BandwidthThrottlingTransferRate - - - - - 1000 - - - - - - - - - - - - text/plain - - - Bits.admx - BITS_MaxTransferRateText - Bits~AT~Network~BITS - BITS_MaxBandwidth - LastWrite - - - - CostedNetworkBehaviorBackgroundPriority - - - - - 1 - - - - - - - - - - - - text/plain - - - Bits.admx - BITS_TransferPolicyNormalPriorityValue - Bits~AT~Network~BITS - BITS_SetTransferPolicyOnCostedNetwork - LastWrite - - - - CostedNetworkBehaviorForegroundPriority - - - - - 1 - - - - - - - - - - - - text/plain - - - Bits.admx - BITS_TransferPolicyForegroundPriorityValue - Bits~AT~Network~BITS - BITS_SetTransferPolicyOnCostedNetwork - LastWrite - - - - JobInactivityTimeout - - - - - 90 - - - - - - - - - - - - text/plain - - - Bits.admx - BITS_Job_Timeout_Time - Bits~AT~Network~BITS - BITS_Job_Timeout - LastWrite - - - - - Bluetooth - - - - - - - - - - - - - - - - - - - AllowAdvertising - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowDiscoverableMode - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowPrepairing - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowPromptedProximalConnections - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - LocalDeviceName - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - ServicesAllowedList - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - SetMinimumEncryptionKeySize - - - - - 0 - - - - - - - - - - - - text/plain - - - LastWrite - - - - - Browser - - - - - - - - - - - - - - - - - - - AllowAddressBarDropdown - - - - - 1 - This policy setting lets you decide whether the Address bar drop-down functionality is available in Microsoft Edge. We recommend disabling this setting if you want to minimize network connections from Microsoft Edge to Microsoft services. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowAddressBarDropdown - LowestValueMostSecure - - - - AllowAutofill - - - - - 0 - This setting lets you decide whether employees can use Autofill to automatically fill in form fields while using Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowAutofill - LowestValueMostSecure - - - - AllowBrowser - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowConfigurationUpdateForBooksLibrary - - - - - 1 - This policy setting lets you decide whether Microsoft Edge can automatically update the configuration data for the Books Library. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowCookies - - - - - 2 - This setting lets you configure how your company deals with cookies. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - CookiesListBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - Cookies - LowestValueMostSecure - - - - AllowDeveloperTools - - - - - 1 - This setting lets you decide whether employees can use F12 Developer Tools on Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowDeveloperTools - LowestValueMostSecure - - - - AllowDoNotTrack - - - - - 0 - This setting lets you decide whether employees can send Do Not Track headers to websites that request tracking info. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowDoNotTrack - LowestValueMostSecure - - - - AllowExtensions - - - - - 1 - This setting lets you decide whether employees can load extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowExtensions - LowestValueMostSecure - - - - AllowFlash - - - - - 1 - This setting lets you decide whether employees can run Adobe Flash in Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowFlash - HighestValueMostSecure - - - - AllowFlashClickToRun - - - - - 1 - Configure the Adobe Flash Click-to-Run setting. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowFlashClickToRun - HighestValueMostSecure - - - - AllowFullScreenMode - - - - - 1 - With this policy, you can specify whether to allow full-screen mode, which shows only the web content and hides the Microsoft Edge UI. - -If enabled or not configured, full-screen mode is available for use in Microsoft Edge. Your users and extensions must have the proper permissions. - -If disabled, full-screen mode is unavailable for use in Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowFullScreenMode - LowestValueMostSecure - - - - AllowInPrivate - - - - - 1 - This setting lets you decide whether employees can browse using InPrivate website browsing. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowInPrivate - LowestValueMostSecure - - - - AllowMicrosoftCompatibilityList - - - - - 1 - This policy setting lets you decide whether the Microsoft Compatibility List is enabled or disabled in Microsoft Edge. This feature uses a Microsoft-provided list to ensure that any sites with known compatibility issues are displayed correctly when a user navigates to them. By default, the Microsoft Compatibility List is enabled and can be viewed by navigating to about:compat. - -If you enable or don’t configure this setting, Microsoft Edge will periodically download the latest version of the list from Microsoft and will apply the configurations specified there during browser navigation. If a user visits a site on the Microsoft Compatibility List, he or she will be prompted to open the site in Internet Explorer 11. Once in Internet Explorer, the site will automatically be rendered as if the user is viewing it in the previous version of Internet Explorer it requires to display correctly. - -If you disable this setting, the Microsoft Compatibility List will not be used during browser navigation. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowCVList - LowestValueMostSecure - - - - AllowPasswordManager - - - - - 1 - This setting lets you decide whether employees can save their passwords locally, using Password Manager. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPasswordManager - LowestValueMostSecure - - - - AllowPopups - - - - - 0 - This setting lets you decide whether to turn on Pop-up Blocker and whether to allow pop-ups to appear in secondary windows. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPopups - LowestValueMostSecure - - - - AllowPrelaunch - - - - - 1 - Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPrelaunch - LowestValueMostSecure - - - - AllowPrinting - - - - - 1 - With this policy, you can restrict whether printing web content in Microsoft Edge is allowed. - -If enabled, printing is allowed. - -If disabled, printing is not allowed. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowPrinting - LowestValueMostSecure - - - - AllowSavingHistory - - - - - 1 - Microsoft Edge saves your user's browsing history, which is made up of info about the websites they visit, on their devices. - -If enabled or not configured, the browsing history is saved and visible in the History pane. - -If disabled, the browsing history stops saving and is not visible in the History pane. If browsing history exists before this policy was disabled, the previous browsing history remains visible in the History pane. This policy, when disabled, does not stop roaming of existing history or history coming from other roamed devices. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSavingHistory - LowestValueMostSecure - - - - AllowSearchEngineCustomization - - - - - 1 - Allow search engine customization for MDM enrolled devices. Users can change their default search engine. - -If this setting is turned on or not configured, users can add new search engines and change the default used in the address bar from within Microsoft Edge Settings. -If this setting is disabled, users will be unable to add search engines or change the default used in the address bar. - -This policy will only apply on domain joined machines or when the device is MDM enrolled. For more information, see Microsoft browser extension policy (aka.ms/browserpolicy). - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSearchEngineCustomization - LowestValueMostSecure - - - - AllowSearchSuggestionsinAddressBar - - - - - 1 - This setting lets you decide whether search suggestions should appear in the Address bar of Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSearchSuggestionsinAddressBar - LowestValueMostSecure - - - - AllowSideloadingOfExtensions - - - - - 1 - This setting lets you decide whether employees can sideload extensions in Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSideloadingOfExtensions - LowestValueMostSecure - - - - AllowSmartScreen - - - - - 1 - This setting lets you decide whether to turn on Windows Defender SmartScreen. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowSmartScreen - LowestValueMostSecure - - - - AllowTabPreloading - - - - - 1 - Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowTabPreloading - LowestValueMostSecure - - - - AllowWebContentOnNewTabPage - - - - - 1 - This policy setting lets you configure what appears when Microsoft Edge opens a new tab. By default, Microsoft Edge opens the New Tab page. - -If you enable this setting, Microsoft Edge opens a new tab with the New Tab page. - -If you disable this setting, Microsoft Edge opens a new tab with a blank page. If you use this setting, employees can't change it. - -If you don't configure this setting, employees can choose how new tabs appears. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowWebContentOnNewTabPage - LowestValueMostSecure - - - - AlwaysEnableBooksLibrary - - - - - 0 - Specifies whether the Books Library in Microsoft Edge will always be visible regardless of the country or region setting for the device. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AlwaysEnableBooksLibrary - LowestValueMostSecure - - - - ClearBrowsingDataOnExit - - - - - 0 - Specifies whether to always clear browsing history on exiting Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - AllowClearingBrowsingDataOnExit - LowestValueMostSecure - - - - ConfigureAdditionalSearchEngines - - - - - - Allows you to add up to 5 additional search engines for MDM-enrolled devices. - -If this setting is turned on, you can add up to 5 additional search engines for your employee. For each additional search engine you wish to add, you must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. This policy does not affect the default search engine. Employees will not be able to remove these search engines, but they can set any one of these as the default. - -If this setting is not configured, the search engines are the ones specified in the App settings. If this setting is disabled, the search engines you had added will be deleted from your employee's machine. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - MicrosoftEdge.admx - ConfigureAdditionalSearchEngines_Prompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureAdditionalSearchEngines - LastWrite - - - - ConfigureFavoritesBar - - - - - 0 - The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. - -If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. - -If disabled, the favorites bar is hidden, and the favorites bar toggle resets to Off, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. - -If not configured, the favorites bar is hidden but is visible on the Start and New Tab pages, and the favorites bar toggle in Settings sets to Off but is enabled allowing the user to make changes. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureFavoritesBar - LowestValueMostSecure - - - - ConfigureHomeButton - - - - - 0 - The Home button loads either the default Start page, the New tab page, or a URL defined in the Set Home Button URL policy. - -By default, this policy is disabled or not configured and clicking the home button loads the default Start page. - -When enabled, the home button is locked down preventing your users from making changes in Microsoft Edge's UI settings. To let your users change the Microsoft Edge UI settings, enable the Unlock Home Button policy. - -If Enabled AND: -- Show home button & set to Start page is selected, clicking the home button loads the Start page. -- Show home button & set to New tab page is selected, clicking the home button loads a New tab page. -- Show home button & set a specific page is selected, clicking the home button loads the URL specified in the Set Home Button URL policy. -- Hide home button is selected, the home button is hidden in Microsoft Edge. - -Default setting: Disabled or not configured -Related policies: -- Set Home Button URL -- Unlock Home Button - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureHomeButtonDropdown - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureHomeButton - LastWrite - - - - ConfigureKioskMode - - - - - 0 - Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single app or as one of multiple apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with limited functionality, or normal Microsoft Edge. - -You need to configure Microsoft Edge in assigned access for this policy to take effect; otherwise, these settings are ignored. To learn more about assigned access and kiosk configuration, see “Configure kiosk and shared devices running Windows desktop editions” (https://aka.ms/E489vw). - -If enabled and set to 0 (Default or not configured): -- If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. -- If it’s one of many apps, Microsoft Edge runs as normal. -If enabled and set to 1: -- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. -- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureKioskMode_TextBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureKioskMode - LastWrite - - - - ConfigureKioskResetAfterIdleTimeout - - - - - 5 - You can configure Microsoft Edge to reset to the configured start experience after a specified amount of idle time. The reset timer begins after the last user interaction. Resetting to the configured start experience deletes the current user’s browsing data. - -If enabled, you can set the idle time in minutes (0-1440). You must set the Configure kiosk mode policy to 1 and configure Microsoft Edge in assigned access as a single app for this policy to work. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge resets after 30 seconds. - -If you set this policy to 0, Microsoft Edge does not use an idle timer. - -If disabled or not configured, the default value is 5 minutes. - -If you do not configure Microsoft Edge in assigned access, then this policy does not take effect. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureKioskResetAfterIdleTimeout_TextBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureKioskResetAfterIdleTimeout - LastWrite - - - - ConfigureOpenMicrosoftEdgeWith - - - - - 3 - You can configure Microsoft Edge to lock down the Start page, preventing users from changing or customizing it. - -If enabled, you can choose one of the following options: -- Start page: the Start page loads ignoring the Configure Start Pages policy. -- New tab page: the New tab page loads ignoring the Configure Start Pages policy. -- Previous pages: all tabs the user had open when Microsoft Edge last closed loads ignoring the Configure Start Pages policy. -- A specific page or pages: the URL(s) specified with Configure Start Pages policy load(s). If selected, you must specify at least one URL in Configure Start Pages; otherwise, this policy is ignored. - -When enabled, and you want to make changes, you must first set the Disable Lockdown of Start Pages to not configured, make the changes to the Configure Open Edge With policy, and then enable the Disable Lockdown of Start Pages policy. - -If disabled or not configured, and you enable the Disable Lockdown of Start Pages policy, your users can change or customize the Start page. - -Default setting: A specific page or pages (default) -Related policies: --Disable Lockdown of Start Pages --Configure Start Pages - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - ConfigureOpenEdgeWithListBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfigureOpenEdgeWith - LastWrite - - - - ConfigureTelemetryForMicrosoft365Analytics - - - - - 0 - Configures what browsing data will be sent to Microsoft 365 Analytics for devices belonging to an organization. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - ZonesListBox - MicrosoftEdge~AT~WindowsComponents~DataCollectionAndPreviewBuilds - ConfigureTelemetryForMicrosoft365Analytics - LowestValueMostSecure - - - - DisableLockdownOfStartPages - - - - - 0 - You can configure Microsoft Edge to disable the lockdown of Start pages allowing users to change or customize their start pages. To do this, you must also enable the Configure Start Pages or Configure Open Microsoft With policy. When enabled, all configured start pages are editable. Any Start page configured using the Configure Start pages policy is not locked down allowing users to edit their Start pages. - -If disabled or not configured, the Start pages configured in the Configure Start Pages policy cannot be changed and remain locked down. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Start Pages -- Configure Open Microsoft Edge With - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - DisableLockdownOfStartPagesListBox - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - DisableLockdownOfStartPages - LowestValueMostSecure - - - - EnableExtendedBooksTelemetry - - - - - 0 - This setting allows organizations to send extended telemetry on book usage from the Books Library. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - EnableExtendedBooksTelemetry - LowestValueMostSecure - - - - EnterpriseModeSiteList - - - - - - This setting lets you configure whether your company uses Enterprise Mode and the Enterprise Mode Site List to address common compatibility problems with legacy websites. - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - EnterSiteListPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - EnterpriseModeSiteList - LastWrite - - - - EnterpriseSiteListServiceUrl - - - - - - - - - - - - - - - - - text/plain - - phone - LastWrite - - - - FirstRunURL - - - - - - Configure first run URL. - - - - - - - - - - - text/plain - - desktop - LastWrite - - - - HomePages - - - - - - When you enable the Configure Open Microsoft Edge With policy, you can configure one or more Start pages. When you enable this policy, users are not allowed to make changes to their Start pages. - -If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - - <support.contoso.com><support.microsoft.com> - -If disabled or not configured, the webpages specified in App settings loads as the default Start pages. - -Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. - -Version 1809: -If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. - -Supported devices: Domain-joined or MDM-enrolled -Related policy: -- Configure Open Microsoft Edge With -- Disable Lockdown of Start Pages - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - HomePagesPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - HomePages - LastWrite - - - - LockdownFavorites - - - - - 0 - This policy setting lets you decide whether employees can add, import, sort, or edit the Favorites list on Microsoft Edge. - -If you enable this setting, employees won't be able to add, import, or change anything in the Favorites list. Also as part of this, Save a Favorite, Import settings, and the context menu items (such as, Create a new folder) are all turned off. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting (default), employees can add, import and make changes to the Favorites list. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - LockdownFavorites - LowestValueMostSecure - - - - PreventAccessToAboutFlagsInMicrosoftEdge - - - - - 0 - Prevent access to the about:flags page in Microsoft Edge. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventAccessToAboutFlagsInMicrosoftEdge - HighestValueMostSecure - - - - PreventCertErrorOverrides - - - - - 0 - Web security certificates are used to ensure a site your users go to is legitimate, and in some circumstances encrypts the data. With this policy, you can specify whether to prevent users from bypassing the security warning to sites that have SSL errors. - -If enabled, overriding certificate errors are not allowed. - -If disabled or not configured, overriding certificate errors are allowed. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventCertErrorOverrides - HighestValueMostSecure - - - - PreventFirstRunPage - - - - - 0 - Specifies whether the First Run webpage is prevented from automatically opening on the first launch of Microsoft Edge. This policy is only available for Windows 10 version 1703 or later for desktop. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventFirstRunPage - HighestValueMostSecure - - - - PreventLiveTileDataCollection - - - - - 0 - This policy lets you decide whether Microsoft Edge can gather Live Tile metadata from the ieonline.microsoft.com service to provide a better experience while pinning a Live Tile to the Start menu. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventLiveTileDataCollection - HighestValueMostSecure - - - - PreventSmartScreenPromptOverride - - - - - 0 - Don't allow Windows Defender SmartScreen warning overrides - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventSmartScreenPromptOverride - HighestValueMostSecure - - - - PreventSmartScreenPromptOverrideForFiles - - - - - 0 - Don't allow Windows Defender SmartScreen warning overrides for unverified files. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventSmartScreenPromptOverrideForFiles - HighestValueMostSecure - - - - PreventTurningOffRequiredExtensions - - - - - - You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. - -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. - -When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. - -If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. - -If disabled or not configured, extensions defined as part of this policy get ignored. - -Default setting: Disabled or not configured -Related policies: Allow Developer Tools -Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - PreventTurningOffRequiredExtensions_Prompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - PreventTurningOffRequiredExtensions - LastWrite - - - - PreventUsingLocalHostIPAddressForWebRTC - - - - - 0 - Prevent using localhost IP address for WebRTC - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - HideLocalHostIPAddress - HighestValueMostSecure - - - - ProvisionFavorites - - - - - - This policy setting allows you to configure a default set of favorites, which will appear for employees. Employees cannot modify, sort, move, export or delete these provisioned favorites. - -If you enable this setting, you can set favorite URL's and favorite folders to appear on top of users' favorites list (either in the Hub or Favorites Bar). The user favorites will appear after these provisioned favorites. - -Important -Don't enable both this setting and the Keep favorites in sync between Internet Explorer and Microsoft Edge setting. Enabling both settings stops employees from syncing their favorites between Internet Explorer and Microsoft Edge. - -If you disable or don't configure this setting, employees will see the favorites they set in the Hub and Favorites Bar. - - - - - - - - - - - text/plain - - MicrosoftEdge.admx - ConfiguredFavoritesPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ConfiguredFavorites - LastWrite - - - - SendIntranetTraffictoInternetExplorer - - - - - 0 - Sends all intranet traffic over to Internet Explorer. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SendIntranetTraffictoInternetExplorer - HighestValueMostSecure - - - - SetDefaultSearchEngine - - - - - - Sets the default search engine for MDM-enrolled devices. Users can still change their default search engine. - -If this setting is turned on, you are setting the default search engine that you would like your employees to use. Employees can still change the default search engine, unless you apply the AllowSearchEngineCustomization policy which will disable the ability to change it. You must specify a link to the OpenSearch XML file that contains, at minimum, the short name and the URL to the search engine. If you would like for your employees to use the Edge factory settings for the default search engine for their market, set the string EDGEDEFAULT; if you would like for your employees to use Bing as the default search engine, set the string EDGEBING. - -If this setting is not configured, the default search engine is set to the one specified in App settings and can be changed by your employees. If this setting is disabled, the policy-set search engine will be removed, and, if it is the current default, the default will be set back to the factory Microsoft Edge search engine for the market. - -Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on domain-joined machines or when the device is MDM-enrolled. - - - - - - - - - - - text/plain - - MicrosoftEdge.admx - SetDefaultSearchEngine_Prompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SetDefaultSearchEngine - LastWrite - - - - SetHomeButtonURL - - - - - - The home button can be configured to load a custom URL when your user clicks the home button. - -If enabled, or configured, and the Configure Home Button policy is enabled, and the Show home button & set a specific page is selected, a custom URL loads when your user clicks the home button. - -Default setting: Blank or not configured -Related policy: Configure Home Button - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - SetHomeButtonURLPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SetHomeButtonURL - LastWrite - - - - SetNewTabPageURL - - - - - - You can set the default New Tab page URL in Microsoft Edge. Enabling this policy prevents your users from changing the New tab page setting. When enabled and the Allow web content on New Tab page policy is disabled, Microsoft Edge ignores the URL specified in this policy and opens about:blank. - -If enabled, you can set the default New Tab page URL. - -If disabled or not configured, the default Microsoft Edge new tab page is used. - -Default setting: Disabled or not configured -Related policy: Allow web content on New Tab page - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - SetNewTabPageURLPrompt - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SetNewTabPageURL - LastWrite - - - - ShowMessageWhenOpeningSitesInInternetExplorer - - - - - 0 - You can configure Microsoft Edge to open a site automatically in Internet Explorer 11 and choose to display a notification before the site opens. If you want to display a notification, you must enable Configure the Enterprise Mode Site List or Send all intranets sites to Internet Explorer 11 or both. - -If enabled, the notification appears on a new page. If you want users to continue in Microsoft Edge, select the Show Keep going in Microsoft Edge option from the drop-down list under Options. - -If disabled or not configured, the default app behavior occurs and no additional page displays. - -Default setting: Disabled or not configured -Related policies: --Configure the Enterprise Mode Site List --Send all intranet sites to Internet Explorer 11 - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ShowMessageWhenOpeningSitesInInternetExplorer - HighestValueMostSecure - - - - SyncFavoritesBetweenIEAndMicrosoftEdge - - - - - 0 - Specifies whether favorites are kept in sync between Internet Explorer and Microsoft Edge. Changes to favorites in one browser are reflected in the other, including: additions, deletions, modifications, and ordering. - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - SyncFavoritesBetweenIEAndMicrosoftEdge - LowestValueMostSecure - - - - UnlockHomeButton - - - - - 0 - By default, when enabling Configure Home Button or Set Home Button URL, the home button is locked down to prevent your users from changing what page loads when clicking the home button. Use this policy to let users change the home button even when Configure Home Button or Set Home Button URL are enabled. - -If enabled, the UI settings for the home button are enabled allowing your users to make changes, including hiding and showing the home button as well as configuring a custom URL. - -If disabled or not configured, the UI settings for the home button are disabled preventing your users from making changes. - -Default setting: Disabled or not configured -Related policy: --Configure Home Button --Set Home Button URL - - - - - - - - - - - text/plain - - - phone - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - UnlockHomeButton - LowestValueMostSecure - - - - UseSharedFolderForBooks - - - - - 0 - This setting specifies whether organizations should use a folder shared across users to store books from the Books Library. - - - - - - - - - - - text/plain - - - MicrosoftEdge.admx - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - UseSharedFolderForBooks - LowestValueMostSecure - - - - - Camera - - - - - - - - - - - - - - - - - - - AllowCamera - - - - - 1 - - - - - - - - - - - - text/plain - - - Camera.admx - Camera~AT~WindowsComponents~L_Camera_GroupPolicyCategory - L_AllowCamera - LowestValueMostSecure - - - - - Cellular - - - - - - - - - - - - - - - - - - - LetAppsAccessCellularData - - - - - 0 - This policy setting specifies whether Windows apps can access cellular data. - - - - - - - - - - - text/plain - - - wwansvc.admx - LetAppsAccessCellularData_Enum - wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess - LetAppsAccessCellularData - HighestValueMostSecure - - - - LetAppsAccessCellularData_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - wwansvc.admx - LetAppsAccessCellularData_ForceAllowTheseApps_List - wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess - LetAppsAccessCellularData - LastWrite - ; - - - - LetAppsAccessCellularData_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - wwansvc.admx - LetAppsAccessCellularData_ForceDenyTheseApps_List - wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess - LetAppsAccessCellularData - LastWrite - ; - - - - LetAppsAccessCellularData_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. - - - - - - - - - - - text/plain - - wwansvc.admx - LetAppsAccessCellularData_UserInControlOfTheseApps_List - wwansvc~AT~Network~WwanSvc_Category~CellularDataAccess - LetAppsAccessCellularData - LastWrite - ; - - - - ShowAppCellularAccessUI - - - - - - - - - - - - - - - - - text/plain - - wwansvc.admx - wwansvc~AT~Network~WwanSvc_Category~UISettings_Category - ShowAppCellularAccessUI - LastWrite - - - - - Connectivity - - - - - - - - - - - - - - - - - - - AllowBluetooth - - - - - 2 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowCellularData - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowCellularDataRoaming - - - - - 1 - - - - - - - - - - - - text/plain - - - WCM.admx - WCM~AT~Network~WCM_Category - WCM_DisableRoaming - LowestValueMostSecure - - - - AllowConnectedDevices - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowNFC - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowPhonePCLinking - - - - - 1 - - - - - - - - - - - - text/plain - - - grouppolicy.admx - grouppolicy~AT~System~PolicyPolicies - enableMMX - LowestValueMostSecure - - - - AllowUSBConnection - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowVPNOverCellular - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowVPNRoamingOverCellular - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - DiablePrintingOverHTTP - - - - - - - - - - - - - - - - - text/plain - - phone - ICM.admx - ICM~AT~System~InternetManagement~InternetManagement_Settings - DisableHTTPPrinting_2 - LastWrite - - - - DisableDownloadingOfPrintDriversOverHTTP - - - - - - - - - - - - - - - - - text/plain - - phone - ICM.admx - ICM~AT~System~InternetManagement~InternetManagement_Settings - DisableWebPnPDownload_2 - LastWrite - - - - DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards - - - - - - - - - - - - - - - - - text/plain - - phone - ICM.admx - ICM~AT~System~InternetManagement~InternetManagement_Settings - ShellPreventWPWDownload_2 - LastWrite - - - - DisallowNetworkConnectivityActiveTests - - - - - 0 - - - - - - - - - - - - text/plain - - - ICM.admx - ICM~AT~System~InternetManagement~InternetManagement_Settings - NoActiveProbe - HighestValueMostSecure - - - - HardenedUNCPaths - - - - - - - - - - - - - - - - - text/plain - - phone - networkprovider.admx - NetworkProvider~AT~Network~Cat_NetworkProvider - Pol_HardenedPaths - LastWrite - - - - ProhibitInstallationAndConfigurationOfNetworkBridge - - - - - - - - - - - - - - - - - text/plain - - phone - NetworkConnections.admx - NetworkConnections~AT~Network~NetworkConnections - NC_AllowNetBridge_NLA - LastWrite - - - - - ControlPolicyConflict - - - - - - - - - - - - - - - - - - - MDMWinsOverGP - - - - - 0 - If set to 1 then any MDM policy that is set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC. Setting the value to 0 (zero) or deleting the policy will remove the GP policy blocks restore the saved GP policies. - - - - - - - - - - - text/plain - - - LastWrite - - - - - CredentialProviders - - - - - - - - - - - - - - - - - - - AllowPINLogon - - - - - - - - - - - - - - - - - text/plain - - phone - credentialproviders.admx - CredentialProviders~AT~System~Logon - AllowDomainPINLogon - LastWrite - - - - BlockPicturePassword - - - - - - - - - - - - - - - - - text/plain - - phone - credentialproviders.admx - CredentialProviders~AT~System~Logon - BlockDomainPicturePassword - LastWrite - - - - DisableAutomaticReDeploymentCredentials - - - - - 1 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - - CredentialsDelegation - - - - - - - - - - - - - - - - - - - RemoteHostAllowsDelegationOfNonExportableCredentials - - - - - - - - - - - - - - - - - text/plain - - phone - CredSsp.admx - CredSsp~AT~System~CredentialsDelegation - AllowProtectedCreds - LastWrite - - - - - CredentialsUI - - - - - - - - - - - - - - - - - - - DisablePasswordReveal - - - - - - - - - - - - - - - - - text/plain - - phone - credui.admx - CredUI~AT~WindowsComponents~CredUI - DisablePasswordReveal - LastWrite - - - - EnumerateAdministrators - - - - - - - - - - - - - - - - - text/plain - - phone - credui.admx - CredUI~AT~WindowsComponents~CredUI - EnumerateAdministrators - LastWrite - - - - - Cryptography - - - - - - - - - - - - - - - - - - - AllowFipsAlgorithmPolicy - - - - - 0 - - - - - - - - - - - - text/plain - - - Windows Settings~Security Settings~Local Policies~Security Options - System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing - LastWrite - - - - TLSCipherSuites - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - DataProtection - - - - - - - - - - - - - - - - - - - AllowDirectMemoryAccess - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - LegacySelectiveWipeID - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - DataUsage - - - - - - - - - - - - - - - - - - - SetCost3G - - - - - - - - - - - - - - - - - text/plain - - wwansvc.admx - wwansvc~AT~Network~WwanSvc_Category~NetworkCost_Category - SetCost3G - LastWrite - - - - SetCost4G - - - - - - - - - - - - - - - - - text/plain - - wwansvc.admx - wwansvc~AT~Network~WwanSvc_Category~NetworkCost_Category - SetCost4G - LastWrite - - - - - Defender - - - - - - - - - - - - - - - - - - - AllowArchiveScanning - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableArchiveScanning - HighestValueMostSecure - - - - AllowBehaviorMonitoring - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection - RealtimeProtection_DisableBehaviorMonitoring - HighestValueMostSecure - - - - AllowCloudProtection - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - SpynetReporting - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Spynet - SpynetReporting - HighestValueMostSecure - - - - AllowEmailScanning - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableEmailScanning - HighestValueMostSecure - - - - AllowFullScanOnMappedNetworkDrives - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableScanningMappedNetworkDrivesForFullScan - HighestValueMostSecure - - - - AllowFullScanRemovableDriveScanning - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableRemovableDriveScanning - HighestValueMostSecure - - - - AllowIntrusionPreventionSystem - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - HighestValueMostSecure - - - - AllowIOAVProtection - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection - RealtimeProtection_DisableIOAVProtection - HighestValueMostSecure - - - - AllowOnAccessProtection - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection - RealtimeProtection_DisableOnAccessProtection - HighestValueMostSecure - - - - AllowRealtimeMonitoring - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection - DisableRealtimeMonitoring - HighestValueMostSecure - - - - AllowScanningNetworkFiles - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableScanningNetworkFiles - HighestValueMostSecure - - - - AllowScriptScanning - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - HighestValueMostSecure - - - - AllowUserUIAccess - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ClientInterface - UX_Configuration_UILockdown - LastWrite - - - - AttackSurfaceReductionOnlyExclusions - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - ExploitGuard_ASR_ASROnlyExclusions - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ASR - ExploitGuard_ASR_ASROnlyExclusions - LastWrite - - - - AttackSurfaceReductionRules - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - ExploitGuard_ASR_Rules - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ASR - ExploitGuard_ASR_Rules - LastWrite - - - - AvgCPULoadFactor - - - - - 50 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_AvgCPULoadFactor - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_AvgCPULoadFactor - LastWrite - - - - CheckForSignaturesBeforeRunningScan - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - CheckForSignaturesBeforeRunningScan - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - CheckForSignaturesBeforeRunningScan - HighestValueMostSecure - - - - CloudBlockLevel - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - MpCloudBlockLevel - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~MpEngine - MpEngine_MpCloudBlockLevel - LastWrite - - - - CloudExtendedTimeout - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - MpBafsExtendedTimeout - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~MpEngine - MpEngine_MpBafsExtendedTimeout - LastWrite - - - - ControlledFolderAccessAllowedApplications - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - ExploitGuard_ControlledFolderAccess_AllowedApplications - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ControlledFolderAccess - ExploitGuard_ControlledFolderAccess_AllowedApplications - LastWrite - - - - ControlledFolderAccessProtectedFolders - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - ExploitGuard_ControlledFolderAccess_ProtectedFolders - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ControlledFolderAccess - ExploitGuard_ControlledFolderAccess_ProtectedFolders - LastWrite - - - - DaysToRetainCleanedMalware - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Quarantine_PurgeItemsAfterDelay - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Quarantine - Quarantine_PurgeItemsAfterDelay - LastWrite - - - - DisableCatchupFullScan - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_DisableCatchupFullScan - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableCatchupFullScan - LastWrite - - - - DisableCatchupQuickScan - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_DisableCatchupQuickScan - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_DisableCatchupQuickScan - LastWrite - - - - EnableControlledFolderAccess - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_ControlledFolderAccess - ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess - LastWrite - - - - EnableLowCPUPriority - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_LowCpuPriority - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_LowCpuPriority - LastWrite - - - - EnableNetworkProtection - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - ExploitGuard_EnableNetworkProtection - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~ExploitGuard~ExploitGuard_NetworkProtection - ExploitGuard_EnableNetworkProtection - LastWrite - - - - ExcludedExtensions - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - Exclusions_PathsList - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Exclusions - Exclusions_Paths - LastWrite - - - - ExcludedPaths - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - Exclusions_ExtensionsList - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Exclusions - Exclusions_Extensions - LastWrite - - - - ExcludedProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - Exclusions_ProcessesList - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Exclusions - Exclusions_Processes - LastWrite - - - - PUAProtection - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Root_PUAProtection - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender - Root_PUAProtection - LastWrite - - - - RealTimeScanDirection - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - RealtimeProtection_RealtimeScanDirection - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~RealtimeProtection - RealtimeProtection_RealtimeScanDirection - LowestValueMostSecure - - - - ScanParameter - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_ScanParameters - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_ScanParameters - LastWrite - - - - ScheduleQuickScanTime - - - - - 120 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_ScheduleQuickScantime - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_ScheduleQuickScantime - LastWrite - - - - ScheduleScanDay - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_ScheduleDay - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_ScheduleDay - LastWrite - - - - ScheduleScanTime - - - - - 120 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - Scan_ScheduleTime - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Scan - Scan_ScheduleTime - LastWrite - - - - SecurityIntelligenceLocation - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - SignatureUpdate_SharedSignaturesLocation - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate - SignatureUpdate_SharedSignaturesLocation - LastWrite - - - - SignatureUpdateFallbackOrder - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - SignatureUpdate_FallbackOrder - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate - SignatureUpdate_FallbackOrder - LastWrite - - - - SignatureUpdateFileSharesSources - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - SignatureUpdate_DefinitionUpdateFileSharesSources - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate - SignatureUpdate_DefinitionUpdateFileSharesSources - LastWrite - - - - SignatureUpdateInterval - - - - - 8 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - SignatureUpdate_SignatureUpdateInterval - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate - SignatureUpdate_SignatureUpdateInterval - LastWrite - - - - SubmitSamplesConsent - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsDefender.admx - SubmitSamplesConsent - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Spynet - SubmitSamplesConsent - HighestValueMostSecure - - - - ThreatSeverityDefaultAction - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefender.admx - Threats_ThreatSeverityDefaultActionList - WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~Threats - Threats_ThreatSeverityDefaultAction - LastWrite - - - - - DeliveryOptimization - - - - - - - - - - - - - - - - - - - DOAbsoluteMaxCacheSize - - - - - 10 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - AbsoluteMaxCacheSize - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - AbsoluteMaxCacheSize - LastWrite - - - - DOAllowVPNPeerCaching - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - AllowVPNPeerCaching - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - AllowVPNPeerCaching - LowestValueMostSecure - - - - DOCacheHost - - - - - - - - - - - - - - - - - text/plain - - DeliveryOptimization.admx - CacheHost - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - CacheHost - LastWrite - - - - DOCacheHostSource - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - CacheHostSource - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - CacheHostSource - LastWrite - - - - DODelayBackgroundDownloadFromHttp - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - DelayBackgroundDownloadFromHttp - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - DelayBackgroundDownloadFromHttp - LastWrite - - - - DODelayCacheServerFallbackBackground - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - DelayCacheServerFallbackBackground - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - DelayCacheServerFallbackBackground - LastWrite - - - - DODelayCacheServerFallbackForeground - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - DelayCacheServerFallbackForeground - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - DelayCacheServerFallbackForeground - LastWrite - - - - DODelayForegroundDownloadFromHttp - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - DelayForegroundDownloadFromHttp - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - DelayForegroundDownloadFromHttp - LastWrite - - - - DODownloadMode - - - - - 1 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - DownloadMode - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - DownloadMode - LastWrite - - - - DOGroupId - - - - - - - - - - - - - - - - - text/plain - - DeliveryOptimization.admx - GroupId - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - GroupId - LastWrite - - - - DOGroupIdSource - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - GroupIdSource - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - GroupIdSource - LastWrite - - - - DOMaxBackgroundDownloadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxBackgroundDownloadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxBackgroundDownloadBandwidth - LastWrite - - - - DOMaxCacheAge - - - - - 259200 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxCacheAge - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxCacheAge - LastWrite - - - - DOMaxCacheSize - - - - - 20 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxCacheSize - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxCacheSize - LastWrite - - - - DOMaxForegroundDownloadBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MaxForegroundDownloadBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MaxForegroundDownloadBandwidth - LastWrite - - - - DOMinBackgroundQos - - - - - 500 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MinBackgroundQos - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MinBackgroundQos - LastWrite - - - - DOMinBatteryPercentageAllowedToUpload - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MinBatteryPercentageAllowedToUpload - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MinBatteryPercentageAllowedToUpload - LastWrite - - - - DOMinDiskSizeAllowedToPeer - - - - - 32 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MinDiskSizeAllowedToPeer - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MinDiskSizeAllowedToPeer - LastWrite - - - - DOMinFileSizeToCache - - - - - 100 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MinFileSizeToCache - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MinFileSizeToCache - LastWrite - - - - DOMinRAMAllowedToPeer - - - - - 4 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MinRAMAllowedToPeer - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MinRAMAllowedToPeer - LastWrite - - - - DOModifyCacheDrive - - - - - %SystemDrive% - - - - - - - - - - - - text/plain - - DeliveryOptimization.admx - ModifyCacheDrive - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - ModifyCacheDrive - LastWrite - - - - DOMonthlyUploadDataCap - - - - - 20 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - MonthlyUploadDataCap - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - MonthlyUploadDataCap - LastWrite - - - - DOPercentageMaxBackgroundBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - PercentageMaxBackgroundBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - PercentageMaxBackgroundBandwidth - LastWrite - - - - DOPercentageMaxForegroundBandwidth - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - PercentageMaxForegroundBandwidth - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - PercentageMaxForegroundBandwidth - LastWrite - - - - DORestrictPeerSelectionBy - - - - - 0 - - - - - - - - - - - - text/plain - - - DeliveryOptimization.admx - RestrictPeerSelectionBy - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - RestrictPeerSelectionBy - LastWrite - - - - DOSetHoursToLimitBackgroundDownloadBandwidth - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - DOSetHoursToLimitForegroundDownloadBandwidth - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - - - - - - - - - - - - - - - - - - - - ]]> - - - - - DeviceGuard - - - - - - - - - - - - - - - - - - - ConfigureSystemGuardLaunch - - - - - 0 - Secure Launch configuration: 0 - Unmanaged, configurable by Administrative user, 1 - Enables Secure Launch if supported by hardware, 2 - Disables Secure Launch. - - - - - - - - - - - text/plain - - - phone - DeviceGuard.admx - SystemGuardDrop - DeviceGuard~AT~System~DeviceGuardCategory - VirtualizationBasedSecurity - LowestValueMostSecureZeroHasNoLimits - - - - EnableVirtualizationBasedSecurity - - - - - 0 - Turns On Virtualization Based Security(VBS) - - - - - - - - - - - text/plain - - - phone - DeviceGuard.admx - DeviceGuard~AT~System~DeviceGuardCategory - VirtualizationBasedSecurity - HighestValueMostSecure - - - - LsaCfgFlags - - - - - 0 - Credential Guard Configuration: 0 - Turns off CredentialGuard remotely if configured previously without UEFI Lock, 1 - Turns on CredentialGuard with UEFI lock. 2 - Turns on CredentialGuard without UEFI lock. - - - - - - - - - - - text/plain - - - phone - DeviceGuard.admx - CredentialIsolationDrop - DeviceGuard~AT~System~DeviceGuardCategory - VirtualizationBasedSecurity - LowestValueMostSecureZeroHasNoLimits - - - - RequirePlatformSecurityFeatures - - - - - 1 - Select Platform Security Level: 1 - Turns on VBS with Secure Boot, 3 - Turns on VBS with Secure Boot and DMA. DMA requires hardware support. - - - - - - - - - - - text/plain - - - phone - DeviceGuard.admx - RequirePlatformSecurityFeaturesDrop - DeviceGuard~AT~System~DeviceGuardCategory - VirtualizationBasedSecurity - HighestValueMostSecure - - - - - DeviceHealthMonitoring - - - - - - - - - - - - - - - - - - - AllowDeviceHealthMonitoring - - - - - 0 - Enable/disable 4Nines device health monitoring on devices. - - - - - - - - - - - text/plain - - - LastWrite - - - - ConfigDeviceHealthMonitoringScope - - - - - - If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which types of events are monitored. - - - - - - - - - - - text/plain - - LastWrite - - - - ConfigDeviceHealthMonitoringUploadDestination - - - - - - If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which destinations are in-scope for monitored events to be uploaded. - - - - - - - - - - - text/plain - - LastWrite - - - - - DeviceInstallation - - - - - - - - - - - - - - - - - - - AllowInstallationOfMatchingDeviceIDs - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_IDs_Allow - LastWrite - - - - AllowInstallationOfMatchingDeviceInstanceIDs - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_Instance_IDs_Allow - LastWrite - - - - AllowInstallationOfMatchingDeviceSetupClasses - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_Classes_Allow - LastWrite - - - - PreventDeviceMetadataFromNetwork - - - - - - - - - - - - - - - - - text/plain - - phone - DeviceSetup.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceMetadata_PreventDeviceMetadataFromNetwork - LastWrite - - - - PreventInstallationOfDevicesNotDescribedByOtherPolicySettings - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_Unspecified_Deny - LastWrite - - - - PreventInstallationOfMatchingDeviceIDs - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_IDs_Deny - LastWrite - - - - PreventInstallationOfMatchingDeviceInstanceIDs - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_Instance_IDs_Deny - LastWrite - - - - PreventInstallationOfMatchingDeviceSetupClasses - - - - - - - - - - - - - - - - - text/plain - - phone - deviceinstallation.admx - DeviceInstallation~AT~System~DeviceInstall_Category~DeviceInstall_Restrictions_Category - DeviceInstall_Classes_Deny - LastWrite - - - - - DeviceLock - - - - - - - - - - - - - - - - - - - AllowIdleReturnWithoutPassword - - - - - 1 - Specifies whether the user must input a PIN or password when the device resumes from an idle state. - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowSimpleDevicePassword - - - - - 1 - Specifies whether PINs or passwords such as 1111 or 1234 are allowed. For the desktop, it also controls the use of picture passwords. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AlphanumericDevicePasswordRequired - - - - - 2 - Determines the type of PIN or password required. This policy only applies if the DeviceLock/DevicePasswordEnabled policy is set to 0 - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - DevicePasswordEnabled - - - - - 1 - Specifies whether device lock is enabled. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - DevicePasswordExpiration - - - - - 0 - Specifies when the password expires (in days). - - - - - - - - - - - text/plain - - - LowestValueMostSecureZeroHasNoLimits - - - - DevicePasswordHistory - - - - - 0 - Specifies how many passwords can be stored in the history that can’t be used. - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - EnforceLockScreenAndLogonImage - - - - - - - - - - - - - - - - - text/plain - - phone - LastWrite - - - - EnforceLockScreenProvider - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - MaxDevicePasswordFailedAttempts - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecureZeroHasNoLimits - - - - MaxInactivityTimeDeviceLock - - - - - 0 - The number of authentication failures allowed before the device will be wiped. A value of 0 disables device wipe functionality. - - - - - - - - - - - text/plain - - - LowestValueMostSecureZeroHasNoLimits - - - - MaxInactivityTimeDeviceLockWithExternalDisplay - - - - - 0 - Sets the maximum timeout value for the external display. - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - MinDevicePasswordComplexCharacters - - - - - 1 - The number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - MinDevicePasswordLength - - - - - 4 - Specifies the minimum number or characters required in the PIN or password. - - - - - - - - - - - text/plain - - - HighestValueMostSecureZeroHasNoLimits - - - - MinimumPasswordAge - - - - - 1 - This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. - -The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998. - -Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Account Policies~Password Policy - Minimum password age - HighestValueMostSecure - - - - PreventEnablingLockScreenCamera - - - - - - - - - - - - - - - - - text/plain - - phone - ControlPanelDisplay.admx - ControlPanelDisplay~AT~ControlPanel~Personalization - CPL_Personalization_NoLockScreenCamera - LastWrite - - - - PreventLockScreenSlideShow - - - - - - - - - - - - - - - - - text/plain - - phone - ControlPanelDisplay.admx - ControlPanelDisplay~AT~ControlPanel~Personalization - CPL_Personalization_NoLockScreenSlideshow - LastWrite - - - - Display - - - - - - - - - - - - - - - - - - - DisablePerProcessDpiForApps - - - - - - This policy allows you to disable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. - - - - - - - - - - - text/plain - - phone - Display.admx - DisplayDisablePerProcessSystemDpiSettings - Display~AT~System~DisplayCat - DisplayPerProcessSystemDpiSettings - LastWrite - - - - EnablePerProcessDpi - - - - - - Enable or disable Per-Process System DPI for all applications. - - - - - - - - - - - text/plain - - - phone - Display.admx - DisplayGlobalPerProcessSystemDpiSettings - Display~AT~System~DisplayCat - DisplayPerProcessSystemDpiSettings - LowestValueMostSecure - - - - EnablePerProcessDpiForApps - - - - - - This policy allows you to enable Per-Process System DPI for a semicolon-separated list of applications. Applications can be specified either by using full paths or with filenames and extensions. This policy will override the system-wide default value. - - - - - - - - - - - text/plain - - phone - Display.admx - DisplayEnablePerProcessSystemDpiSettings - Display~AT~System~DisplayCat - DisplayPerProcessSystemDpiSettings - LastWrite - - - - TurnOffGdiDPIScalingForApps - - - - - - This policy allows to force turn off GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. - - - - - - - - - - - text/plain - - phone - Display.admx - DisplayTurnOffGdiDPIScalingPrompt - Display~AT~System~DisplayCat - DisplayTurnOffGdiDPIScaling - LastWrite - - - - TurnOnGdiDPIScalingForApps - - - - - - This policy allows to turn on GDI DPI Scaling for a semicolon separated list of applications. Applications can be specified either by using full path or just filename and extension. - - - - - - - - - - - text/plain - - phone - Display.admx - DisplayTurnOnGdiDPIScalingPrompt - Display~AT~System~DisplayCat - DisplayTurnOnGdiDPIScaling - LastWrite - - - - - DmaGuard - - - - - - - - - - - - - - - - - - - DeviceEnumerationPolicy - - - - - 1 - - - - - - - - - - - - text/plain - - - dmaguard.admx - dmaguard~AT~System~DmaGuard - DmaGuardEnumerationPolicy - LowestValueMostSecure - - - - - ErrorReporting - - - - - - - - - - - - - - - - - - - CustomizeConsentSettings - - - - - - - - - - - - - - - - - text/plain - - phone - ErrorReporting.admx - ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting - WerConsentCustomize_2 - LastWrite - - - - DisableWindowsErrorReporting - - - - - - - - - - - - - - - - - text/plain - - phone - ErrorReporting.admx - ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting - WerDisable_2 - LastWrite - - - - DisplayErrorNotification - - - - - - - - - - - - - - - - - text/plain - - phone - ErrorReporting.admx - ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting - PCH_ShowUI - LastWrite - - - - DoNotSendAdditionalData - - - - - - - - - - - - - - - - - text/plain - - phone - ErrorReporting.admx - ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting - WerNoSecondLevelData_2 - LastWrite - - - - PreventCriticalErrorDisplay - - - - - - - - - - - - - - - - - text/plain - - phone - ErrorReporting.admx - ErrorReporting~AT~WindowsComponents~CAT_WindowsErrorReporting - WerDoNotShowUI - LastWrite - - - - - EventLogService - - - - - - - - - - - - - - - - - - - ControlEventLogBehavior - - - - - - - - - - - - - - - - - text/plain - - phone - eventlog.admx - EventLog~AT~WindowsComponents~EventLogCategory~EventLog_Application - Channel_Log_Retention_1 - LastWrite - - - - SpecifyMaximumFileSizeApplicationLog - - - - - - - - - - - - - - - - - text/plain - - phone - eventlog.admx - EventLog~AT~WindowsComponents~EventLogCategory~EventLog_Application - Channel_LogMaxSize_1 - LastWrite - - - - SpecifyMaximumFileSizeSecurityLog - - - - - - - - - - - - - - - - - text/plain - - phone - eventlog.admx - EventLog~AT~WindowsComponents~EventLogCategory~EventLog_Security - Channel_LogMaxSize_2 - LastWrite - - - - SpecifyMaximumFileSizeSystemLog - - - - - - - - - - - - - - - - - text/plain - - phone - eventlog.admx - EventLog~AT~WindowsComponents~EventLogCategory~EventLog_System - Channel_LogMaxSize_4 - LastWrite - - - - - Experience - - - - - - - - - - - - - - - - - - - AllowClipboardHistory - - - - - 1 - Allows history of clipboard items to be stored in memory. - - - - - - - - - - - text/plain - - - OSPolicy.admx - OSPolicy~AT~System~PolicyPolicies - AllowClipboardHistory - LowestValueMostSecure - - - - AllowCopyPaste - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowCortana - - - - - 1 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - AllowCortana - LowestValueMostSecure - - - - AllowDeviceDiscovery - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowFindMyDevice - - - - - 1 - - - - - - - - - - - - text/plain - - - FindMy.admx - FindMy~AT~WindowsComponents~FindMyDeviceCat - FindMy_AllowFindMyDeviceConfig - LowestValueMostSecure - - - - AllowManualMDMUnenrollment - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowSaveAsOfOfficeFiles - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowScreenCapture - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowSharingOfOfficeFiles - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowSIMErrorDialogPromptWhenNoSIM - - - - - 1 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - AllowSyncMySettings - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowTaskSwitcher - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowVoiceRecording - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowWindowsConsumerFeatures - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableWindowsConsumerFeatures - LowestValueMostSecure - - - - AllowWindowsTips - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableSoftLanding - LowestValueMostSecure - - - - DisableCloudOptimizedContent - - - - - 0 - This policy controls Windows experiences that use the cloud optimized content client component. If you enable this policy, they will present only default content. If you disable or do not configure this policy, they will be able to use cloud provided content. - - - - - - - - - - - text/plain - - - CloudContent.admx - CloudContent~AT~WindowsComponents~CloudContent - DisableCloudOptimizedContent - HighestValueMostSecure - - - - DoNotShowFeedbackNotifications - - - - - 0 - - - - - - - - - - - - text/plain - - - FeedbackNotifications.admx - FeedbackNotifications~AT~WindowsComponents~DataCollectionAndPreviewBuilds - DoNotShowFeedbackNotifications - HighestValueMostSecure - - - - DoNotSyncBrowserSettings - - - - - 0 - You can configure Microsoft Edge, when enabled, to prevent the "browser" group from using the Sync your Settings option to sync information, such as history and favorites, between user's devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable the Allow users to turn browser syncing on policy. If disabled or not configured, the Sync your Settings options are turned on in Microsoft Edge by default, and configurable by the user. - Related policy: PreventUsersFromTurningOnBrowserSyncing - 0 (default) = allow syncing, 2 = disable syncing - - - - - - - - - - - text/plain - - - SettingSync.admx - SettingSync~AT~WindowsComponents~SettingSync - DisableWebBrowserSettingSync - HighestValueMostSecure - - - - PreventUsersFromTurningOnBrowserSyncing - - - - - 1 - You can configure Microsoft Edge to allow users to turn on the Sync your Settings option to sync information, such as history and favorites, between user's devices. When enabled and you enable the Do not sync browser setting policy, browser settings sync automatically. If disabled, users have the option to sync the browser settings. - Related policy: DoNotSyncBrowserSettings - 1 (default) = Do not allow users to turn on syncing, 0 = Allows users to turn on syncing - - - - - - - - - - - text/plain - - - SettingSync.admx - CheckBox_UserOverride - SettingSync~AT~WindowsComponents~SettingSync - DisableWebBrowserSettingSync - HighestValueMostSecure - - - - ShowLockOnUserTile - - - - - 1 - Shows or hides lock from the user tile menu. -If you enable this policy setting, the lock option will be shown in the User Tile menu. - -If you disable this policy setting, the lock option will never be shown in the User Tile menu. - -If you do not configure this policy setting, users will be able to choose whether they want lock to show through the Power Options Control Panel. - - - - - - - - - - - text/plain - - - WindowsExplorer.admx - WindowsExplorer~AT~WindowsExplorer - ShowLockOption - HighestValueMostSecure - - - - - ExploitGuard - - - - - - - - - - - - - - - - - - - ExploitProtectionSettings - - - - - - - - - - - - - - - - - text/plain - - ExploitGuard.admx - ExploitProtection_Name - ExploitGuard~AT~WindowsComponents~WindowsDefenderExploitGuard~ExploitProtection - ExploitProtection_Name - LastWrite - - - - - FactoryComposer - - - - - - - - - - - - - - - - - - - BackgroundImagePath - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - OEMVersion - - - - - unset; partners can set via settings customization! - - - - - - - - - - - - text/plain - - LastWrite - - - - UserToSignIn - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - UWPLaunchOnBoot - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - - FileExplorer - - - - - - - - - - - - - - - - - - - TurnOffDataExecutionPreventionForExplorer - - - - - - - - - - - - - - - - - text/plain - - phone - Explorer.admx - Explorer~AT~WindowsExplorer - NoDataExecutionPrevention - LastWrite - - - - TurnOffHeapTerminationOnCorruption - - - - - - - - - - - - - - - - - text/plain - - phone - Explorer.admx - Explorer~AT~WindowsExplorer - NoHeapTerminationOnCorruption - LastWrite - - - - - Games - - - - - - - - - - - - - - - - - - - AllowAdvancedGamingServices - - - - - 1 - Specifies whether advanced gaming services can be used. These services may send data to Microsoft or publishers of games that use these services. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - - Handwriting - - - - - - - - - - - - - - - - - - - PanelDefaultModeDocked - - - - - 0 - Specifies whether the handwriting panel comes up floating near the text box or attached to the bottom of the screen - - - - - - - - - - - text/plain - - - phone - Handwriting.admx - Handwriting~AT~WindowsComponents~Handwriting - PanelDefaultModeDocked - LowestValueMostSecure - - - - - InternetExplorer - - - - - - - - - - - - - - - - - - - AddSearchProvider - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - AddSearchProvider - LastWrite - - - - AllowActiveXFiltering - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - TurnOnActiveXFiltering - LastWrite - - - - AllowAddOnList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - AddonManagement_AddOnList - LastWrite - - - - AllowCertificateAddressMismatchWarning - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyWarnCertMismatch - LastWrite - - - - AllowDeletingBrowsingHistoryOnExit - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory - DBHDisableDeleteOnExit - LastWrite - - - - AllowEnhancedProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_EnableEnhancedProtectedMode - LastWrite - - - - AllowEnhancedSuggestionsInAddressBar - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - AllowServicePoweredQSA - LastWrite - - - - AllowEnterpriseModeFromToolsMenu - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - EnterpriseModeEnable - LastWrite - - - - AllowEnterpriseModeSiteList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - EnterpriseModeSiteList - LastWrite - - - - AllowFallbackToSSL3 - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures - Advanced_EnableSSL3Fallback - LastWrite - - - - AllowInternetExplorer7PolicyList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView - CompatView_UsePolicyList - LastWrite - - - - AllowInternetExplorerStandardsMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView - CompatView_IntranetSites - LastWrite - - - - AllowInternetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyInternetZoneTemplate - LastWrite - - - - AllowIntranetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyIntranetZoneTemplate - LastWrite - - - - AllowLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyLocalMachineZoneTemplate - LastWrite - - - - AllowLockedDownInternetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyInternetZoneLockdownTemplate - LastWrite - - - - AllowLockedDownIntranetZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyIntranetZoneLockdownTemplate - LastWrite - - - - AllowLockedDownLocalMachineZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyLocalMachineZoneLockdownTemplate - LastWrite - - - - AllowLockedDownRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyRestrictedSitesZoneLockdownTemplate - LastWrite - - - - AllowOneWordEntry - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetSettings~Advanced~Browsing - UseIntranetSiteForOneWordEntry - LastWrite - - - - AllowSiteToZoneAssignmentList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_Zonemaps - LastWrite - - - - AllowsLockedDownTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyTrustedSitesZoneLockdownTemplate - LastWrite - - - - AllowSoftwareWhenSignatureIsInvalid - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_InvalidSignatureBlock - LastWrite - - - - AllowsRestrictedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyRestrictedSitesZoneTemplate - LastWrite - - - - AllowSuggestedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - EnableSuggestedSites - LastWrite - - - - AllowTrustedSitesZoneTemplate - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_PolicyTrustedSitesZoneTemplate - LastWrite - - - - CheckServerCertificateRevocation - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_CertificateRevocation - LastWrite - - - - CheckSignaturesOnDownloadedPrograms - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_DownloadSignatures - LastWrite - - - - ConsistentMimeHandlingInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryConsistentMimeHandling - IESF_PolicyExplorerProcesses_5 - LastWrite - - - - DisableAdobeFlash - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - DisableFlashInIE - LastWrite - - - - DisableBypassOfSmartScreenWarnings - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - DisableSafetyFilterOverride - LastWrite - - - - DisableBypassOfSmartScreenWarningsAboutUncommonFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - DisableSafetyFilterOverrideForAppRepUnknown - LastWrite - - - - DisableCompatView - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView - CompatView_DisableList - LastWrite - - - - DisableConfiguringHistory - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory - RestrictHistory - LastWrite - - - - DisableCrashDetection - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - AddonManagement_RestrictCrashDetection - LastWrite - - - - DisableCustomerExperienceImprovementProgramParticipation - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - SQM_DisableCEIP - LastWrite - - - - DisableDeletingUserVisitedWebsites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~DeleteBrowsingHistory - DBHDisableDeleteHistory - LastWrite - - - - DisableEnclosureDownloading - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~RSS_Feeds - Disable_Downloading_of_Enclosures - LastWrite - - - - DisableEncryptionSupport - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_SetWinInetProtocols - LastWrite - - - - DisableFeedsBackgroundSync - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~RSS_Feeds - Disable_Background_Syncing - LastWrite - - - - DisableFirstRunWizard - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NoFirstRunCustomise - LastWrite - - - - DisableFlipAheadFeature - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_DisableFlipAhead - LastWrite - - - - DisableGeolocation - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - GeolocationDisable - LastWrite - - - - DisableIgnoringCertificateErrors - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL - NoCertError - LastWrite - - - - DisableInPrivateBrowsing - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~CategoryPrivacy - DisableInPrivateBrowsing - LastWrite - - - - DisableProcessesInEnhancedProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_EnableEnhancedProtectedMode64Bit - LastWrite - - - - DisableProxyChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - RestrictProxy - LastWrite - - - - DisableSearchProviderChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NoSearchProvider - LastWrite - - - - DisableSecondaryHomePageChange - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - SecondaryHomePages - LastWrite - - - - DisableSecuritySettingsCheck - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Disable_Security_Settings_Check - LastWrite - - - - DisableUpdateCheck - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NoUpdateCheck - LastWrite - - - - DisableWebAddressAutoComplete - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - RestrictWebAddressSuggest - LastWrite - - - - DoNotAllowActiveXControlsInProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~AdvancedPage - Advanced_DisableEPMCompat - LastWrite - - - - DoNotAllowUsersToAddSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Security_zones_map_edit - LastWrite - - - - DoNotAllowUsersToChangePolicies - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Security_options_edit - LastWrite - - - - DoNotBlockOutdatedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDisable - LastWrite - - - - DoNotBlockOutdatedActiveXControlsOnSpecificDomains - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDomainAllowlist - LastWrite - - - - IncludeAllLocalSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_IncludeUnspecifiedLocalSites - LastWrite - - - - IncludeAllNetworkPaths - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage - IZ_UNCAsIntranet - LastWrite - - - - InternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAccessDataSourcesAcrossDomains_1 - LastWrite - - - - InternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNotificationBarActiveXURLaction_1 - LastWrite - - - - InternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNotificationBarDownloadURLaction_1 - LastWrite - - - - InternetZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowPasteViaScript_1 - LastWrite - - - - InternetZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDropOrPasteFiles_1 - LastWrite - - - - InternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyFontDownload_1 - LastWrite - - - - InternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyZoneElevationURLaction_1 - LastWrite - - - - InternetZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_XAML_1 - LastWrite - - - - InternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_1 - LastWrite - - - - InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet - LastWrite - - - - InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowTDCControl_Both_Internet - LastWrite - - - - InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_WebBrowserControl_1 - LastWrite - - - - InternetZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyWindowsRestrictionsURLaction_1 - LastWrite - - - - InternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_AllowScriptlets_1 - LastWrite - - - - InternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_Phishing_1 - LastWrite - - - - InternetZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_ScriptStatusBar_1 - LastWrite - - - - InternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyUserdataPersistence_1 - LastWrite - - - - InternetZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAllowVBScript_1 - LastWrite - - - - InternetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_1 - LastWrite - - - - InternetZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDownloadSignedActiveX_1 - LastWrite - - - - InternetZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDownloadUnsignedActiveX_1 - LastWrite - - - - InternetZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyTurnOnXSSFilter_Both_Internet - LastWrite - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet - LastWrite - - - - InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet - LastWrite - - - - InternetZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyMimeSniffingURLaction_1 - LastWrite - - - - InternetZoneEnableProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_TurnOnProtectedMode_1 - LastWrite - - - - InternetZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_LocalPathForUpload_1 - LastWrite - - - - InternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyScriptActiveXNotMarkedSafe_1 - LastWrite - - - - InternetZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyJavaPermissions_1 - LastWrite - - - - InternetZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyLaunchAppsAndFilesInIFRAME_1 - LastWrite - - - - InternetZoneLogonOptions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyLogon_1 - LastWrite - - - - InternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyNavigateSubframesAcrossDomains_1 - LastWrite - - - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicySignedFrameworkComponentsURLaction_1 - LastWrite - - - - InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_Policy_UnsafeFiles_1 - LastWrite - - - - InternetZoneUsePopupBlocker - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyBlockPopupWindows_1 - LastWrite - - - - IntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyAccessDataSourcesAcrossDomains_3 - LastWrite - - - - IntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyNotificationBarActiveXURLaction_3 - LastWrite - - - - IntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyNotificationBarDownloadURLaction_3 - LastWrite - - - - IntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyFontDownload_3 - LastWrite - - - - IntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyZoneElevationURLaction_3 - LastWrite - - - - IntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_3 - LastWrite - - - - IntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_Policy_AllowScriptlets_3 - LastWrite - - - - IntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_Policy_Phishing_3 - LastWrite - - - - IntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyUserdataPersistence_3 - LastWrite - - - - IntranetZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_3 - LastWrite - - - - IntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyScriptActiveXNotMarkedSafe_3 - LastWrite - - - - IntranetZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyJavaPermissions_3 - LastWrite - - - - IntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyNavigateSubframesAcrossDomains_3 - LastWrite - - - - LocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyAccessDataSourcesAcrossDomains_9 - LastWrite - - - - LocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyNotificationBarActiveXURLaction_9 - LastWrite - - - - LocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyNotificationBarDownloadURLaction_9 - LastWrite - - - - LocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyFontDownload_9 - LastWrite - - - - LocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyZoneElevationURLaction_9 - LastWrite - - - - LocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_9 - LastWrite - - - - LocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_Policy_AllowScriptlets_9 - LastWrite - - - - LocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_Policy_Phishing_9 - LastWrite - - - - LocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyUserdataPersistence_9 - LastWrite - - - - LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_9 - LastWrite - - - - LocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyScriptActiveXNotMarkedSafe_9 - LastWrite - - - - LocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyJavaPermissions_9 - LastWrite - - - - LocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZone - IZ_PolicyNavigateSubframesAcrossDomains_9 - LastWrite - - - - LockedDownInternetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_2 - LastWrite - - - - LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyFontDownload_2 - LastWrite - - - - LockedDownInternetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyZoneElevationURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_2 - LastWrite - - - - LockedDownInternetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_Policy_AllowScriptlets_2 - LastWrite - - - - LockedDownInternetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_Policy_Phishing_2 - LastWrite - - - - LockedDownInternetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyUserdataPersistence_2 - LastWrite - - - - LockedDownInternetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_2 - LastWrite - - - - LockedDownInternetZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyJavaPermissions_2 - LastWrite - - - - LockedDownInternetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_2 - LastWrite - - - - LockedDownIntranetJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyJavaPermissions_4 - LastWrite - - - - LockedDownIntranetZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_4 - LastWrite - - - - LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyFontDownload_4 - LastWrite - - - - LockedDownIntranetZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyZoneElevationURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_4 - LastWrite - - - - LockedDownIntranetZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_Policy_AllowScriptlets_4 - LastWrite - - - - LockedDownIntranetZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_Policy_Phishing_4 - LastWrite - - - - LockedDownIntranetZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyUserdataPersistence_4 - LastWrite - - - - LockedDownIntranetZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_4 - LastWrite - - - - LockedDownIntranetZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_4 - LastWrite - - - - LockedDownLocalMachineZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyFontDownload_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyZoneElevationURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_Policy_AllowScriptlets_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_Policy_Phishing_10 - LastWrite - - - - LockedDownLocalMachineZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyUserdataPersistence_10 - LastWrite - - - - LockedDownLocalMachineZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_10 - LastWrite - - - - LockedDownLocalMachineZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyJavaPermissions_10 - LastWrite - - - - LockedDownLocalMachineZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_LocalMachineZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_10 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyFontDownload_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyZoneElevationURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_Policy_AllowScriptlets_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_Policy_Phishing_8 - LastWrite - - - - LockedDownRestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyUserdataPersistence_8 - LastWrite - - - - LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_8 - LastWrite - - - - LockedDownRestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyJavaPermissions_8 - LastWrite - - - - LockedDownRestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_8 - LastWrite - - - - LockedDownTrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyAccessDataSourcesAcrossDomains_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyNotificationBarActiveXURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyNotificationBarDownloadURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyFontDownload_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyZoneElevationURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyUnsignedFrameworkComponentsURLaction_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_Policy_AllowScriptlets_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_Policy_Phishing_6 - LastWrite - - - - LockedDownTrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyUserdataPersistence_6 - LastWrite - - - - LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyScriptActiveXNotMarkedSafe_6 - LastWrite - - - - LockedDownTrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyJavaPermissions_6 - LastWrite - - - - LockedDownTrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZoneLockdown - IZ_PolicyNavigateSubframesAcrossDomains_6 - LastWrite - - - - MimeSniffingSafetyFeatureInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMimeSniffingSafetyFeature - IESF_PolicyExplorerProcesses_6 - LastWrite - - - - MKProtocolSecurityRestrictionInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryMKProtocolSecurityRestriction - IESF_PolicyExplorerProcesses_3 - LastWrite - - - - NewTabDefaultPage - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - NewTabAction - LastWrite - - - - NotificationBarInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryInformationBar - IESF_PolicyExplorerProcesses_10 - LastWrite - - - - PreventManagingSmartScreenFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Disable_Managing_Safety_Filter_IE9 - LastWrite - - - - PreventPerUserInstallationOfActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - DisablePerUserActiveXInstall - LastWrite - - - - ProtectionFromZoneElevationInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryProtectionFromZoneElevation - IESF_PolicyExplorerProcesses_9 - LastWrite - - - - RemoveRunThisTimeButtonForOutdatedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDisableRunThisTime - LastWrite - - - - RestrictActiveXInstallInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictActiveXInstall - IESF_PolicyExplorerProcesses_11 - LastWrite - - - - RestrictedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAccessDataSourcesAcrossDomains_7 - LastWrite - - - - RestrictedSitesZoneAllowActiveScripting - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyActiveScripting_7 - LastWrite - - - - RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNotificationBarActiveXURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNotificationBarDownloadURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowBinaryAndScriptBehaviors - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyBinaryBehaviors_7 - LastWrite - - - - RestrictedSitesZoneAllowCopyPasteViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowPasteViaScript_7 - LastWrite - - - - RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDropOrPasteFiles_7 - LastWrite - - - - RestrictedSitesZoneAllowFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyFileDownload_7 - LastWrite - - - - RestrictedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyFontDownload_7 - LastWrite - - - - RestrictedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyZoneElevationURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowLoadingOfXAMLFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_XAML_7 - LastWrite - - - - RestrictedSitesZoneAllowMETAREFRESH - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowMETAREFRESH_7 - LastWrite - - - - RestrictedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted - LastWrite - - - - RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowTDCControl_Both_Restricted - LastWrite - - - - RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_WebBrowserControl_7 - LastWrite - - - - RestrictedSitesZoneAllowScriptInitiatedWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyWindowsRestrictionsURLaction_7 - LastWrite - - - - RestrictedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_AllowScriptlets_7 - LastWrite - - - - RestrictedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_Phishing_7 - LastWrite - - - - RestrictedSitesZoneAllowUpdatesToStatusBarViaScript - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_ScriptStatusBar_7 - LastWrite - - - - RestrictedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyUserdataPersistence_7 - LastWrite - - - - RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAllowVBScript_7 - LastWrite - - - - RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_7 - LastWrite - - - - RestrictedSitesZoneDownloadSignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDownloadSignedActiveX_7 - LastWrite - - - - RestrictedSitesZoneDownloadUnsignedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDownloadUnsignedActiveX_7 - LastWrite - - - - RestrictedSitesZoneEnableCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyTurnOnXSSFilter_Both_Restricted - LastWrite - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted - LastWrite - - - - RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted - LastWrite - - - - RestrictedSitesZoneEnableMIMESniffing - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyMimeSniffingURLaction_7 - LastWrite - - - - RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_LocalPathForUpload_7 - LastWrite - - - - RestrictedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_7 - LastWrite - - - - RestrictedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyJavaPermissions_7 - LastWrite - - - - RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyLaunchAppsAndFilesInIFRAME_7 - LastWrite - - - - RestrictedSitesZoneLogonOptions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyLogon_7 - LastWrite - - - - RestrictedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNavigateSubframesAcrossDomains_7 - LastWrite - - - - RestrictedSitesZoneRunActiveXControlsAndPlugins - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyRunActiveXControls_7 - LastWrite - - - - RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicySignedFrameworkComponentsURLaction_7 - LastWrite - - - - RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyScriptActiveXMarkedSafe_7 - LastWrite - - - - RestrictedSitesZoneScriptingOfJavaApplets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyScriptingOfJavaApplets_7 - LastWrite - - - - RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_UnsafeFiles_7 - LastWrite - - - - RestrictedSitesZoneTurnOnProtectedMode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_Policy_TurnOnProtectedMode_7 - LastWrite - - - - RestrictedSitesZoneUsePopupBlocker - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyBlockPopupWindows_7 - LastWrite - - - - RestrictFileDownloadInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryRestrictFileDownload - IESF_PolicyExplorerProcesses_12 - LastWrite - - - - ScriptedWindowSecurityRestrictionsInternetExplorerProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_CategoryScriptedWindowSecurityRestrictions - IESF_PolicyExplorerProcesses_8 - LastWrite - - - - SearchProviderList - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - SpecificSearchProvider - LastWrite - - - - SecurityZonesUseOnlyMachineSettings - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - Security_HKLM_only - LastWrite - - - - SpecifyUseOfActiveXInstallerService - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer - OnlyUseAXISForActiveXInstall - LastWrite - - - - TrustedSitesZoneAllowAccessToDataSources - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAccessDataSourcesAcrossDomains_5 - LastWrite - - - - TrustedSitesZoneAllowAutomaticPromptingForActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyNotificationBarActiveXURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowAutomaticPromptingForFileDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyNotificationBarDownloadURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowFontDownloads - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyFontDownload_5 - LastWrite - - - - TrustedSitesZoneAllowLessPrivilegedSites - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyZoneElevationURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowNETFrameworkReliantComponents - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_5 - LastWrite - - - - TrustedSitesZoneAllowScriptlets - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_Policy_AllowScriptlets_5 - LastWrite - - - - TrustedSitesZoneAllowSmartScreenIE - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_Policy_Phishing_5 - LastWrite - - - - TrustedSitesZoneAllowUserDataPersistence - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyUserdataPersistence_5 - LastWrite - - - - TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 - LastWrite - - - - TrustedSitesZoneInitializeAndScriptActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 - LastWrite - - - - TrustedSitesZoneJavaPermissions - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyJavaPermissions_5 - LastWrite - - - - TrustedSitesZoneNavigateWindowsAndFrames - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyNavigateSubframesAcrossDomains_5 - LastWrite - - - - - Kerberos - - - - - - - - - - - - - - - - - - - AllowForestSearchOrder - - - - - - - - - - - - - - - - - text/plain - - phone - Kerberos.admx - Kerberos~AT~System~kerberos - ForestSearch - LastWrite - - - - KerberosClientSupportsClaimsCompoundArmor - - - - - - - - - - - - - - - - - text/plain - - phone - Kerberos.admx - Kerberos~AT~System~kerberos - EnableCbacAndArmor - LastWrite - - - - RequireKerberosArmoring - - - - - - - - - - - - - - - - - text/plain - - phone - Kerberos.admx - Kerberos~AT~System~kerberos - ClientRequireFast - LastWrite - - - - RequireStrictKDCValidation - - - - - - - - - - - - - - - - - text/plain - - phone - Kerberos.admx - Kerberos~AT~System~kerberos - ValidateKDC - LastWrite - - - - SetMaximumContextTokenSize - - - - - - - - - - - - - - - - - text/plain - - phone - Kerberos.admx - Kerberos~AT~System~kerberos - MaxTokenSize - LastWrite - - - - UPNNameHints - - - - - - Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an AAD UPN into an Active Directory Principal. - - This parameter adds a list of domains that an Azure Active Directory joined device should attempt to contact if it is otherwise unable to resolve a UPN to a principal. - - - - - - - - - - - text/plain - - phone - LastWrite - 0xF000 - - - - - KioskBrowser - - - - - - - - - - - - - - - - - - - BlockedUrlExceptions - - - - - - List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - BlockedUrls - - - - - - List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers can not navigate to. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - DefaultURL - - - - - - Configures the default URL kiosk browsers to navigate on launch and restart. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - EnableEndSessionButton - - - - - 0 - Enable/disable kiosk browser's end session button. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - EnableHomeButton - - - - - 0 - Enable/disable kiosk browser's home button. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - EnableNavigationButtons - - - - - 0 - Enable/disable kiosk browser's navigation buttons (forward/back). - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - RestartOnIdleTime - - - - - 0 - Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - - LanmanWorkstation - - - - - - - - - - - - - - - - - - - EnableInsecureGuestLogons - - - - - 0 - - - - - - - - - - - - text/plain - - - LanmanWorkstation.admx - LanmanWorkstation~AT~Network~Cat_LanmanWorkstation - Pol_EnableInsecureGuestLogons - LowestValueMostSecure - - - - - Licensing - - - - - - - - - - - - - - - - - - - AllowWindowsEntitlementReactivation - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - AVSValidationGP.admx - AVSValidationGP~AT~WindowsComponents~SoftwareProtectionPlatform - AllowWindowsEntitlementReactivation - LowestValueMostSecure - - - - DisallowKMSClientOnlineAVSValidation - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - AVSValidationGP.admx - AVSValidationGP~AT~WindowsComponents~SoftwareProtectionPlatform - NoAcquireGT - LowestValueMostSecure - - - - - LocalPoliciesSecurityOptions - - - - - - - - - - - - - - - - - - - Accounts_BlockMicrosoftAccounts - - - - - 0 - This policy setting prevents users from adding new Microsoft accounts on this computer. - -If you select the "Users can’t add Microsoft accounts" option, users will not be able to create new Microsoft accounts on this computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. - -If you select the "Users can’t add or log on with Microsoft accounts" option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator on this computer to log on and manage the system. - -If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Accounts: Block Microsoft accounts - LastWrite - - - - Accounts_EnableAdministratorAccountStatus - - - - - 0 - This security setting determines whether the local Administrator account is enabled or disabled. - -Notes - -If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. -Disabling the Administrator account can become a maintenance issue under certain circumstances. - -Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. - -Default: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Accounts: Administrator account status - LastWrite - - - - Accounts_EnableGuestAccountStatus - - - - - 0 - This security setting determines if the Guest account is enabled or disabled. - -Default: Disabled. - -Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Accounts: Guest account status - LastWrite - - - - Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly - - - - - 1 - Accounts: Limit local account use of blank passwords to console logon only - -This security setting determines whether local accounts that are not password protected can be used to log on from locations other than the physical computer console. If enabled, local accounts that are not password protected will only be able to log on at the computer's keyboard. - -Default: Enabled. - - -Warning: - -Computers that are not in physically secure locations should always enforce strong password policies for all local user accounts. Otherwise, anyone with physical access to the computer can log on by using a user account that does not have a password. This is especially important for portable computers. -If you apply this security policy to the Everyone group, no one will be able to log on through Remote Desktop Services. - -Notes - -This setting does not affect logons that use domain accounts. -It is possible for applications that use remote interactive logons to bypass this setting. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Accounts: Limit local account use of blank passwords to console logon only - LastWrite - - - - Accounts_RenameAdministratorAccount - - - - - Administrator - Accounts: Rename administrator account - -This security setting determines whether a different account name is associated with the security identifier (SID) for the account Administrator. Renaming the well-known Administrator account makes it slightly more difficult for unauthorized persons to guess this privileged user name and password combination. - -Default: Administrator. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Accounts: Rename administrator account - LastWrite - - - - Accounts_RenameGuestAccount - - - - - Guest - Accounts: Rename guest account - -This security setting determines whether a different account name is associated with the security identifier (SID) for the account "Guest." Renaming the well-known Guest account makes it slightly more difficult for unauthorized persons to guess this user name and password combination. - -Default: Guest. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Accounts: Rename guest account - LastWrite - - - - Devices_AllowedToFormatAndEjectRemovableMedia - - - - - 0 - Devices: Allowed to format and eject removable media - -This security setting determines who is allowed to format and eject removable NTFS media. This capability can be given to: - -Administrators -Administrators and Interactive Users - -Default: This policy is not defined and only Administrators have this ability. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Devices: Allowed to format and eject removable media - LastWrite - - - - Devices_AllowUndockWithoutHavingToLogon - - - - - 1 - Devices: Allow undock without having to log on -This security setting determines whether a portable computer can be undocked without having to log on. If this policy is enabled, logon is not required and an external hardware eject button can be used to undock the computer. If disabled, a user must log on and have the Remove computer from docking station privilege to undock the computer. -Default: Enabled. - -Caution -Disabling this policy may tempt users to try and physically remove the laptop from its docking station using methods other than the external hardware eject button. Since this may cause damage to the hardware, this setting, in general, should only be disabled on laptop configurations that are physically securable. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Devices: Allow undock without having to log on - LastWrite - - - - Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters - - - - - 0 - Devices: Prevent users from installing printer drivers when connecting to shared printers - -For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer. - -Default on servers: Enabled. -Default on workstations: Disabled - -Notes - -This setting does not affect the ability to add a local printer. -This setting does not affect Administrators. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Devices: Prevent users from installing printer drivers - LastWrite - - - - Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly - - - - - 0 - Devices: Restrict CD-ROM access to locally logged-on user only - -This security setting determines whether a CD-ROM is accessible to both local and remote users simultaneously. - -If this policy is enabled, it allows only the interactively logged-on user to access removable CD-ROM media. If this policy is enabled and no one is logged on interactively, the CD-ROM can be accessed over the network. - -Default: This policy is not defined and CD-ROM access is not restricted to the locally logged-on user. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Devices: Restrict CD-ROM access to locally logged-on user only - LastWrite - - - - InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked - - - - - 1 - Interactive Logon:Display user information when the session is locked -User display name, domain and user names (1) -User display name only (2) -Do not display user information (3) -Domain and user names only (4) - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Display user information when the session is locked - LastWrite - - - - InteractiveLogon_DoNotDisplayLastSignedIn - - - - - 0 - Interactive logon: Don't display last signed-in -This security setting determines whether the Windows sign-in screen will show the username of the last person who signed in on this PC. -If this policy is enabled, the username will not be shown. - -If this policy is disabled, the username will be shown. - -Default: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Don't display last signed-in - LastWrite - - - - InteractiveLogon_DoNotDisplayUsernameAtSignIn - - - - - 1 - Interactive logon: Don't display username at sign-in -This security setting determines whether the username of the person signing in to this PC appears at Windows sign-in, after credentials are entered, and before the PC desktop is shown. -If this policy is enabled, the username will not be shown. - -If this policy is disabled, the username will be shown. - -Default: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Don't display username at sign-in - LastWrite - - - - InteractiveLogon_DoNotRequireCTRLALTDEL - - - - - 1 - Interactive logon: Do not require CTRL+ALT+DEL - -This security setting determines whether pressing CTRL+ALT+DEL is required before a user can log on. - -If this policy is enabled on a computer, a user is not required to press CTRL+ALT+DEL to log on. Not having to press CTRL+ALT+DEL leaves users susceptible to attacks that attempt to intercept the users' passwords. Requiring CTRL+ALT+DEL before users log on ensures that users are communicating by means of a trusted path when entering their passwords. - -If this policy is disabled, any user is required to press CTRL+ALT+DEL before logging on to Windows. - -Default on domain-computers: Enabled: At least Windows 8/Disabled: Windows 7 or earlier. -Default on stand-alone computers: Enabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Do not require CTRL+ALT+DEL - LastWrite - - - - InteractiveLogon_MachineInactivityLimit - - - - - 0 - Interactive logon: Machine inactivity limit. - -Windows notices inactivity of a logon session, and if the amount of inactive time exceeds the inactivity limit, then the screen saver will run, locking the session. - -Default: not enforced. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Machine inactivity limit - LastWrite - - - - InteractiveLogon_MessageTextForUsersAttemptingToLogOn - - - - - - Interactive logon: Message text for users attempting to log on - -This security setting specifies a text message that is displayed to users when they log on. - -This text is often used for legal reasons, for example, to warn users about the ramifications of misusing company information or to warn them that their actions may be audited. - -Default: No message. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Message text for users attempting to log on - LastWrite - 0xF000 - - - - InteractiveLogon_MessageTitleForUsersAttemptingToLogOn - - - - - - Interactive logon: Message title for users attempting to log on - -This security setting allows the specification of a title to appear in the title bar of the window that contains the Interactive logon: Message text for users attempting to log on. - -Default: No message. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Message title for users attempting to log on - LastWrite - - - - InteractiveLogon_SmartCardRemovalBehavior - - - - - 0 - Interactive logon: Smart card removal behavior - -This security setting determines what happens when the smart card for a logged-on user is removed from the smart card reader. - -The options are: - - No Action - Lock Workstation - Force Logoff - Disconnect if a Remote Desktop Services session - -If you click Lock Workstation in the Properties dialog box for this policy, the workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session. - -If you click Force Logoff in the Properties dialog box for this policy, the user is automatically logged off when the smart card is removed. - -If you click Disconnect if a Remote Desktop Services session, removal of the smart card disconnects the session without logging the user off. This allows the user to insert the smart card and resume the session later, or at another smart card reader-equipped computer, without having to log on again. If the session is local, this policy functions identically to Lock Workstation. - -Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. - -Default: This policy is not defined, which means that the system treats it as No action. - -On Windows Vista and above: For this setting to work, the Smart Card Removal Policy service must be started. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Interactive logon: Smart card removal behavior - LastWrite - - - - MicrosoftNetworkClient_DigitallySignCommunicationsAlways - - - - - 0 - Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network client: Digitally sign communications (always) - LastWrite - - - - MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees - - - - - 1 - Microsoft network client: Digitally sign communications (if server agrees) - -This security setting determines whether the SMB client attempts to negotiate SMB packet signing. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB client component attempts to negotiate SMB packet signing when it connects to an SMB server. - -If this setting is enabled, the Microsoft network client will ask the server to perform SMB packet signing upon session setup. If packet signing has been enabled on the server, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. - -Default: Enabled. - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network client: Digitally sign communications (if server agrees) - LastWrite - - - - MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers - - - - - 0 - Microsoft network client: Send unencrypted password to connect to third-party SMB servers - -If this security setting is enabled, the Server Message Block (SMB) redirector is allowed to send plaintext passwords to non-Microsoft SMB servers that do not support password encryption during authentication. - -Sending unencrypted passwords is a security risk. - -Default: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network client: Send unencrypted password to third-party SMB servers - LastWrite - - - - MicrosoftNetworkServer_DigitallySignCommunicationsAlways - - - - - 0 - Microsoft network server: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB server component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB client is permitted. - -If this setting is enabled, the Microsoft network server will not communicate with a Microsoft network client unless that client agrees to perform SMB packet signing. If this setting is disabled, SMB packet signing is negotiated between the client and server. - -Default: - -Disabled for member servers. -Enabled for domain controllers. - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -Similarly, if client-side SMB signing is required, that client will not be able to establish a session with servers that do not have packet signing enabled. By default, server-side SMB signing is enabled only on domain controllers. -If server-side SMB signing is enabled, SMB packet signing will be negotiated with clients that have client-side SMB signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. - -Important - -For this policy to take effect on computers running Windows 2000, server-side packet signing must also be enabled. To enable server-side SMB packet signing, set the following policy: -Microsoft network server: Digitally sign communications (if server agrees) - -For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the Windows 2000 server: -HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network server: Digitally sign communications (always) - LastWrite - - - - MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees - - - - - 0 - Microsoft network server: Digitally sign communications (if client agrees) - -This security setting determines whether the SMB server will negotiate SMB packet signing with clients that request it. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether the SMB server will negotiate SMB packet signing when an SMB client requests it. - -If this setting is enabled, the Microsoft network server will negotiate SMB packet signing as requested by the client. That is, if packet signing has been enabled on the client, packet signing will be negotiated. If this policy is disabled, the SMB client will never negotiate SMB packet signing. - -Default: Enabled on domain controllers only. - -Important - -For Windows 2000 servers to negotiate signing with Windows NT 4.0 clients, the following registry value must be set to 1 on the server running Windows 2000: HKLM\System\CurrentControlSet\Services\lanmanserver\parameters\enableW9xsecuritysignature - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. For Windows 2000 and above, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -If both client-side and server-side SMB signing is enabled and the client establishes an SMB 1.0 connection to the server, SMB signing will be attempted. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. This setting only applies to SMB 1.0 connections. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network server: Digitally sign communications (if client agrees) - LastWrite - - - - NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts - - - - - 1 - Network access: Do not allow anonymous enumeration of SAM accounts - -This security setting determines what additional permissions will be granted for anonymous connections to the computer. - -Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. - -This security option allows additional restrictions to be placed on anonymous connections as follows: - -Enabled: Do not allow enumeration of SAM accounts. This option replaces Everyone with Authenticated Users in the security permissions for resources. -Disabled: No additional restrictions. Rely on default permissions. - -Default on workstations: Enabled. -Default on server:Enabled. - -Important - -This policy has no impact on domain controllers. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network access: Do not allow anonymous enumeration of SAM accounts - LastWrite - - - - NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares - - - - - 0 - Network access: Do not allow anonymous enumeration of SAM accounts and shares - -This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed. - -Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy. - -Default: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network access: Do not allow anonymous enumeration of SAM accounts and shares - LastWrite - - - - NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares - - - - - 1 - Network access: Restrict anonymous access to Named Pipes and Shares - -When enabled, this security setting restricts anonymous access to shares and pipes to the settings for: - -Network access: Named pipes that can be accessed anonymously -Network access: Shares that can be accessed anonymously -Default: Enabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network access: Restrict anonymous access to Named Pipes and Shares - LastWrite - - - - NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM - - - - - - Network access: Restrict clients allowed to make remote calls to SAM - -This policy setting allows you to restrict remote rpc connections to SAM. - -If not selected, the default security descriptor will be used. - -This policy is supported on at least Windows Server 2016. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network access: Restrict clients allowed to make remote calls to SAM - LastWrite - - - - NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM - - - - - 1 - Network security: Allow Local System to use computer identity for NTLM - -This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - -If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. - -If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. - -By default, this policy is enabled on Windows 7 and above. - -By default, this policy is disabled on Windows Vista. - -This policy is supported on at least Windows Vista or Windows Server 2008. - -Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Allow Local System to use computer identity for NTLM - LastWrite - - - - NetworkSecurity_AllowPKU2UAuthenticationRequests - - - - - 1 - Network security: Allow PKU2U authentication requests to this computer to use online identities. - -This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Allow PKU2U authentication requests to this computer to use online identities. - LastWrite - - - - NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange - - - - - 1 - Network security: Do not store LAN Manager hash value on next password change - -This security setting determines if, at the next password change, the LAN Manager (LM) hash value for the new password is stored. The LM hash is relatively weak and prone to attack, as compared with the cryptographically stronger Windows NT hash. Since the LM hash is stored on the local computer in the security database the passwords can be compromised if the security database is attacked. - - -Default on Windows Vista and above: Enabled -Default on Windows XP: Disabled. - -Important - -Windows 2000 Service Pack 2 (SP2) and above offer compatibility with authentication to previous versions of Windows, such as Microsoft Windows NT 4.0. -This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP, and the Windows Server 2003 family to communicate with computers running Windows 95 and Windows 98. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Do not store LAN Manager hash value on next password change - LastWrite - - - - NetworkSecurity_LANManagerAuthenticationLevel - - - - - 3 - Network security LAN Manager authentication level - -This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: - -Send LM and NTLM responses: Clients use LM and NTLM authentication and never use NTLMv2 session security; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send LM and NTLM - use NTLMv2 session security if negotiated: Clients use LM and NTLM authentication and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send NTLM response only: Clients use NTLM authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send NTLMv2 response only: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers accept LM, NTLM, and NTLMv2 authentication. - -Send NTLMv2 response only\refuse LM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM (accept only NTLM and NTLMv2 authentication). - -Send NTLMv2 response only\refuse LM and NTLM: Clients use NTLMv2 authentication only and use NTLMv2 session security if the server supports it; domain controllers refuse LM and NTLM (accept only NTLMv2 authentication). - -Important - -This setting can affect the ability of computers running Windows 2000 Server, Windows 2000 Professional, Windows XP Professional, and the Windows Server 2003 family to communicate with computers running Windows NT 4.0 and earlier over the network. For example, at the time of this writing, computers running Windows NT 4.0 SP4 and earlier did not support NTLMv2. Computers running Windows 95 and Windows 98 did not support NTLM. - -Default: - -Windows 2000 and windows XP: send LM and NTLM responses - -Windows Server 2003: Send NTLM response only - -Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send NTLMv2 response only - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: LAN Manager authentication level - HighestValueMostSecure - - - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients - - - - - 536870912 - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - HighestValueMostSecure - - - - NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers - - - - - 536870912 - Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - -This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if message integrity is not negotiated. -Require 128-bit encryption. The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Minimum session security for NTLM SSP based (including secure RPC) servers - HighestValueMostSecure - - - - NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication - - - - - - Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication - -This policy setting allows you to create an exception list of remote servers to which clients are allowed to use NTLM authentication if the "Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers" policy setting is configured. - -If you configure this policy setting, you can define a list of remote servers to which clients are allowed to use NTLM authentication. - -If you do not configure this policy setting, no exceptions will be applied. - -The naming format for servers on this exception list is the fully qualified domain name (FQDN) or NetBIOS server name used by the application, listed one per line. To ensure exceptions the name used by all applications needs to be in the list, and to ensure an exception is accurate, the server name should be listed in both naming formats . A single asterisk (*) can be used anywhere in the string as a wildcard character. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication - LastWrite - - - - NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic - - - - - 0 - Network security: Restrict NTLM: Audit Incoming NTLM Traffic - -This policy setting allows you to audit incoming NTLM traffic. - -If you select "Disable", or do not configure this policy setting, the server will not log events for incoming NTLM traffic. - -If you select "Enable auditing for domain accounts", the server will log events for NTLM pass-through authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all domain accounts" option. - -If you select "Enable auditing for all accounts", the server will log events for all NTLM authentication requests that would be blocked when the "Network Security: Restrict NTLM: Incoming NTLM traffic" policy setting is set to the "Deny all accounts" option. - -This policy is supported on at least Windows 7 or Windows Server 2008 R2. - -Note: Audit events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Restrict NTLM: Audit Incoming NTLM Traffic - HighestValueMostSecure - - - - NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic - - - - - 0 - Network security: Restrict NTLM: Incoming NTLM traffic - -This policy setting allows you to deny or allow incoming NTLM traffic. - -If you select "Allow all" or do not configure this policy setting, the server will allow all NTLM authentication requests. - -If you select "Deny all domain accounts," the server will deny NTLM authentication requests for domain logon and display an NTLM blocked error, but allow local account logon. - -If you select "Deny all accounts," the server will deny NTLM authentication requests from incoming traffic and display an NTLM blocked error. - -This policy is supported on at least Windows 7 or Windows Server 2008 R2. - -Note: Block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Restrict NTLM: Incoming NTLM traffic - HighestValueMostSecure - - - - NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers - - - - - 0 - Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers - -This policy setting allows you to deny or audit outgoing NTLM traffic from this Windows 7 or this Windows Server 2008 R2 computer to any Windows remote server. - -If you select "Allow all" or do not configure this policy setting, the client computer can authenticate identities to a remote server by using NTLM authentication. - -If you select "Audit all," the client computer logs an event for each NTLM authentication request to a remote server. This allows you to identify those servers receiving NTLM authentication requests from the client computer. - -If you select "Deny all," the client computer cannot authenticate identities to a remote server by using NTLM authentication. You can use the "Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication" policy setting to define a list of remote servers to which clients are allowed to use NTLM authentication. - -This policy is supported on at least Windows 7 or Windows Server 2008 R2. - -Note: Audit and block events are recorded on this computer in the "Operational" Log located under the Applications and Services Log/Microsoft/Windows/NTLM. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers - HighestValueMostSecure - - - - Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn - - - - - 1 - Shutdown: Allow system to be shut down without having to log on - -This security setting determines whether a computer can be shut down without having to log on to Windows. - -When this policy is enabled, the Shut Down command is available on the Windows logon screen. - -When this policy is disabled, the option to shut down the computer does not appear on the Windows logon screen. In this case, users must be able to log on to the computer successfully and have the Shut down the system user right before they can perform a system shutdown. - -Default on workstations: Enabled. -Default on servers: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Shutdown: Allow system to be shut down without having to log on - LastWrite - - - - Shutdown_ClearVirtualMemoryPageFile - - - - - 0 - Shutdown: Clear virtual memory pagefile - -This security setting determines whether the virtual memory pagefile is cleared when the system is shut down. - -Virtual memory support uses a system pagefile to swap pages of memory to disk when they are not used. On a running system, this pagefile is opened exclusively by the operating system, and it is well protected. However, systems that are configured to allow booting to other operating systems might have to make sure that the system pagefile is wiped clean when this system shuts down. This ensures that sensitive information from process memory that might go into the pagefile is not available to an unauthorized user who manages to directly access the pagefile. - -When this policy is enabled, it causes the system pagefile to be cleared upon clean shutdown. If you enable this security option, the hibernation file (hiberfil.sys) is also zeroed out when hibernation is disabled. - -Default: Disabled. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Shutdown: Clear virtual memory pagefile - LastWrite - - - - UserAccountControl_AllowUIAccessApplicationsToPromptForElevation - - - - - 0 - User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop. - -This policy setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. - -• Enabled: UIA programs, including Windows Remote Assistance, automatically disable the secure desktop for elevation prompts. If you do not disable the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting, the prompts appear on the interactive user's desktop instead of the secure desktop. - -• Disabled: (Default) The secure desktop can be disabled only by the user of the interactive desktop or by disabling the "User Account Control: Switch to the secure desktop when prompting for elevation" policy setting. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop - LastWrite - - - - UserAccountControl_BehaviorOfTheElevationPromptForAdministrators - - - - - 5 - User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - -This policy setting controls the behavior of the elevation prompt for administrators. - -The options are: - -• Elevate without prompting: Allows privileged accounts to perform an operation that requires elevation without requiring consent or credentials. Note: Use this option only in the most constrained environments. - -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. - -• Prompt for consent on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - -• Prompt for credentials: When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - -• Prompt for consent: When an operation requires elevation of privilege, the user is prompted to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - -• Prompt for consent for non-Windows binaries: (Default) When an operation for a non-Microsoft application requires elevation of privilege, the user is prompted on the secure desktop to select either Permit or Deny. If the user selects Permit, the operation continues with the user's highest available privilege. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode - LastWrite - - - - UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers - - - - - 3 - User Account Control: Behavior of the elevation prompt for standard users -This policy setting controls the behavior of the elevation prompt for standard users. - -The options are: - -• Prompt for credentials: (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - -• Automatically deny elevation requests: When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. - -• Prompt for credentials on the secure desktop: When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Behavior of the elevation prompt for standard users - LastWrite - - - - UserAccountControl_DetectApplicationInstallationsAndPromptForElevation - - - - - 1 - User Account Control: Detect application installations and prompt for elevation - -This policy setting controls the behavior of application installation detection for the computer. - -The options are: - -Enabled: (Default) When an application installation package is detected that requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. - -Disabled: Application installation packages are not detected and prompted for elevation. Enterprises that are running standard user desktops and use delegated installation technologies such as Group Policy Software Installation or Systems Management Server (SMS) should disable this policy setting. In this case, installer detection is unnecessary. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Detect application installations and prompt for elevation - LastWrite - - - - UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated - - - - - 0 - User Account Control: Only elevate executable files that are signed and validated - -This policy setting enforces public key infrastructure (PKI) signature checks for any interactive applications that request elevation of privilege. Enterprise administrators can control which applications are allowed to run by adding certificates to the Trusted Publishers certificate store on local computers. - -The options are: - -• Enabled: Enforces the PKI certification path validation for a given executable file before it is permitted to run. - -• Disabled: (Default) Does not enforce PKI certification path validation before a given executable file is permitted to run. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Only elevate executables that are signed and validated - LastWrite - - - - UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations - - - - - 1 - User Account Control: Only elevate UIAccess applications that are installed in secure locations - -This policy setting controls whether applications that request to run with a User Interface Accessibility (UIAccess) integrity level must reside in a secure location in the file system. Secure locations are limited to the following: - -- …\Program Files\, including subfolders -- …\Windows\system32\ -- …\Program Files (x86)\, including subfolders for 64-bit versions of Windows - -Note: Windows enforces a public key infrastructure (PKI) signature check on any interactive application that requests to run with a UIAccess integrity level regardless of the state of this security setting. - -The options are: - -• Enabled: (Default) If an application resides in a secure location in the file system, it runs only with UIAccess integrity. - -• Disabled: An application runs with UIAccess integrity even if it does not reside in a secure location in the file system. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Only elevate UIAccess applications that are installed in secure locations - LastWrite - - - - UserAccountControl_RunAllAdministratorsInAdminApprovalMode - - - - - 1 - User Account Control: Turn on Admin Approval Mode - -This policy setting controls the behavior of all User Account Control (UAC) policy settings for the computer. If you change this policy setting, you must restart your computer. - -The options are: - -• Enabled: (Default) Admin Approval Mode is enabled. This policy must be enabled and related UAC policy settings must also be set appropriately to allow the built-in Administrator account and all other users who are members of the Administrators group to run in Admin Approval Mode. - -• Disabled: Admin Approval Mode and all related UAC policy settings are disabled. Note: If this policy setting is disabled, the Security Center notifies you that the overall security of the operating system has been reduced. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Run all administrators in Admin Approval Mode - LastWrite - - - - UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation - - - - - 1 - User Account Control: Switch to the secure desktop when prompting for elevation - -This policy setting controls whether the elevation request prompt is displayed on the interactive user's desktop or the secure desktop. - -The options are: - -• Enabled: (Default) All elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users. - -• Disabled: All elevation requests go to the interactive user's desktop. Prompt behavior policy settings for administrators and standard users are used. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Switch to the secure desktop when prompting for elevation - LastWrite - - - - UserAccountControl_UseAdminApprovalMode - - - - - 0 - User Account Control: Use Admin Approval Mode for the built-in Administrator account - -This policy setting controls the behavior of Admin Approval Mode for the built-in Administrator account. - -The options are: - -• Enabled: The built-in Administrator account uses Admin Approval Mode. By default, any operation that requires elevation of privilege will prompt the user to approve the operation. - -• Disabled: (Default) The built-in Administrator account runs all applications with full administrative privilege. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Admin Approval Mode for the Built-in Administrator account - LastWrite - - - - UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations - - - - - 1 - User Account Control: Virtualize file and registry write failures to per-user locations - -This policy setting controls whether application write failures are redirected to defined registry and file system locations. This policy setting mitigates applications that run as administrator and write run-time application data to %ProgramFiles%, %Windir%, %Windir%\system32, or HKLM\Software. - -The options are: - -• Enabled: (Default) Application write failures are redirected at run time to defined user locations for both the file system and registry. - -• Disabled: Applications that write data to protected locations fail. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - User Account Control: Virtualize file and registry write failures to per-user locations - LastWrite - - - - - LocalUsersAndGroups - - - - - - - - - - - - - - - - - - - Configure - - - - - - This Setting allows an administrator to manage local groups on a Device. - Possible settings: - 1. Update Group Membership: Update a group and add and/or remove members though the 'U' action. - When using Update, existing group members that are not specified in the policy remain untouched. - 2. Replace Group Membership: Restrict a group by replacing group membership through the 'R' action. - When using Replace, existing group membership is replaced by the list of members specified in - the add member section. This option works in the same way as a Restricted Group and any group - members that are not specified in the policy are removed. - Caution: If the same group is configured with both Replace and Update, then Replace will win. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - - - - - - - - - Group Configuration Action - - - - - - - - Group Member to Add - - - - - - - - Group Member to Remove - - - - - - - - Group property to configure - - - - - - - - - - - - - - - - Local Group Configuration - - - - - - - - - - - LockDown - - - - - - - - - - - - - - - - - - - AllowEdgeSwipe - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - EdgeUI.admx - EdgeUI~AT~WindowsComponents~EdgeUI - AllowEdgeSwipe - LowestValueMostSecure - - - - - Maps - - - - - - - - - - - - - - - - - - - AllowOfflineMapsDownloadOverMeteredConnection - - - - - 65535 - - - - - - - - - - - - text/plain - - - LastWrite - - - - EnableOfflineMapsAutoUpdate - - - - - 65535 - - - - - - - - - - - - text/plain - - - WinMaps.admx - WinMaps~AT~WindowsComponents~Maps - TurnOffAutoUpdate - LastWrite - - - - - Messaging - - - - - - - - - - - - - - - - - - - AllowMessageSync - - - - - 1 - This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. - - - - - - - - - - - text/plain - - - messaging.admx - messaging~AT~WindowsComponents~Messaging_Category - AllowMessageSync - LowestValueMostSecure - - - - AllowMMS - - - - - 1 - This policy setting allows you to enable or disable the sending and receiving cellular MMS messages. - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowRCS - - - - - 1 - This policy setting allows you to enable or disable the sending and receiving of cellular RCS (Rich Communication Services) messages. - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - - MixedReality - - - - - - - - - - - - - - - - - - - AADGroupMembershipCacheValidityInDays - - - - - 0 - - - - - - - - - - - - text/plain - - - LastWrite - - - - BrightnessButtonDisabled - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - FallbackDiagnostics - - - - - 2 - - - - - - - - - - - - text/plain - - - LastWrite - - - - MicrophoneDisabled - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - VolumeButtonDisabled - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - - MSSecurityGuide - - - - - - - - - - - - - - - - - - - ApplyUACRestrictionsToLocalAccountsOnNetworkLogon - - - - - - - - - - - - - - - - - text/plain - - phone - SecGuide.admx - SecGuide~AT~Cat_SecGuide - Pol_SecGuide_0201_LATFP - LastWrite - - - - ConfigureSMBV1ClientDriver - - - - - - - - - - - - - - - - - text/plain - - phone - SecGuide.admx - SecGuide~AT~Cat_SecGuide - Pol_SecGuide_0002_SMBv1_ClientDriver - LastWrite - - - - ConfigureSMBV1Server - - - - - - - - - - - - - - - - - text/plain - - phone - SecGuide.admx - SecGuide~AT~Cat_SecGuide - Pol_SecGuide_0001_SMBv1_Server - LastWrite - - - - EnableStructuredExceptionHandlingOverwriteProtection - - - - - - - - - - - - - - - - - text/plain - - phone - SecGuide.admx - SecGuide~AT~Cat_SecGuide - Pol_SecGuide_0102_SEHOP - LastWrite - - - - TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications - - - - - - - - - - - - - - - - - text/plain - - phone - SecGuide.admx - SecGuide~AT~Cat_SecGuide - Pol_SecGuide_0101_WDPUA - LastWrite - - - - WDigestAuthentication - - - - - - - - - - - - - - - - - text/plain - - phone - SecGuide.admx - SecGuide~AT~Cat_SecGuide - Pol_SecGuide_0202_WDigestAuthn - LastWrite - - - - - MSSLegacy - - - - - - - - - - - - - - - - - - - AllowICMPRedirectsToOverrideOSPFGeneratedRoutes - - - - - - - - - - - - - - - - - text/plain - - phone - mss-legacy.admx - Mss-legacy~AT~Cat_MSS - Pol_MSS_EnableICMPRedirect - LastWrite - - - - AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers - - - - - - - - - - - - - - - - - text/plain - - phone - mss-legacy.admx - Mss-legacy~AT~Cat_MSS - Pol_MSS_NoNameReleaseOnDemand - LastWrite - - - - IPSourceRoutingProtectionLevel - - - - - - - - - - - - - - - - - text/plain - - phone - mss-legacy.admx - Mss-legacy~AT~Cat_MSS - Pol_MSS_DisableIPSourceRouting - LastWrite - - - - IPv6SourceRoutingProtectionLevel - - - - - - - - - - - - - - - - - text/plain - - phone - mss-legacy.admx - Mss-legacy~AT~Cat_MSS - Pol_MSS_DisableIPSourceRoutingIPv6 - LastWrite - - - - - NetworkIsolation - - - - - - - - - - - - - - - - - - - EnterpriseCloudResources - - - - - - - - - - - - - - - - - text/plain - - NetworkIsolation.admx - WF_NetIsolation_EnterpriseCloudResourcesBox - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_EnterpriseCloudResources - LastWrite - - - - EnterpriseInternalProxyServers - - - - - - - - - - - - - - - - - text/plain - - NetworkIsolation.admx - WF_NetIsolation_Intranet_ProxiesBox - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_Intranet_Proxies - LastWrite - - - - EnterpriseIPRange - - - - - - - - - - - - - - - - - text/plain - - NetworkIsolation.admx - WF_NetIsolation_PrivateSubnetBox - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_PrivateSubnet - LastWrite - - - - EnterpriseIPRangesAreAuthoritative - - - - - 0 - - - - - - - - - - - - text/plain - - - NetworkIsolation.admx - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_Authoritative_Subnet - LastWrite - - - - EnterpriseNetworkDomainNames - - - - - - - - - - - - - - - - - text/plain - - LastWrite - - - - EnterpriseProxyServers - - - - - - - - - - - - - - - - - text/plain - - NetworkIsolation.admx - WF_NetIsolation_Domain_ProxiesBox - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_Domain_Proxies - LastWrite - - - - EnterpriseProxyServersAreAuthoritative - - - - - 0 - - - - - - - - - - - - text/plain - - - NetworkIsolation.admx - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_Authoritative_Proxies - LastWrite - - - - NeutralResources - - - - - - - - - - - - - - - - - text/plain - - NetworkIsolation.admx - WF_NetIsolation_NeutralResourcesBox - NetworkIsolation~AT~Network~WF_Isolation - WF_NetIsolation_NeutralResources - LastWrite - - - - - Notifications - - - - - - - - - - - - - - - - - - - DisallowCloudNotification - - - - - 0 - - - - - - - - - - - - text/plain - - - WPN.admx - WPN~AT~StartMenu~NotificationsCategory - NoCloudNotification - LowestValueMostSecure - - - - - Power - - - - - - - - - - - - - - - - - - - AllowStandbyStatesWhenSleepingOnBattery - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - AllowStandbyStatesDC_2 - LastWrite - - - - AllowStandbyWhenSleepingPluggedIn - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - AllowStandbyStatesAC_2 - LastWrite - - - - DisplayOffTimeoutOnBattery - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerVideoSettingsCat - VideoPowerDownTimeOutDC_2 - LastWrite - - - - DisplayOffTimeoutPluggedIn - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerVideoSettingsCat - VideoPowerDownTimeOutAC_2 - LastWrite - - - - EnergySaverBatteryThresholdOnBattery - - - - - 0 - This policy setting allows you to specify battery charge level at which Energy Saver is turned on. - -If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. - -If you disable or do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - Power.admx - EnterEsBattThreshold - Power~AT~System~PowerManagementCat~EnergySaverSettingsCat - EsBattThresholdDC - LastWrite - - - - EnergySaverBatteryThresholdPluggedIn - - - - - 0 - This policy setting allows you to specify battery charge level at which Energy Saver is turned on. - -If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. - -If you disable or do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - Power.admx - EnterEsBattThreshold - Power~AT~System~PowerManagementCat~EnergySaverSettingsCat - EsBattThresholdAC - LastWrite - - - - HibernateTimeoutOnBattery - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - DCHibernateTimeOut_2 - LastWrite - - - - HibernateTimeoutPluggedIn - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - ACHibernateTimeOut_2 - LastWrite - - - - RequirePasswordWhenComputerWakesOnBattery - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - DCPromptForPasswordOnResume_2 - LastWrite - - - - RequirePasswordWhenComputerWakesPluggedIn - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - ACPromptForPasswordOnResume_2 - LastWrite - - - - SelectLidCloseActionOnBattery - - - - - 1 - This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - Power.admx - SelectDCSystemLidAction - Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat - DCSystemLidAction_2 - LastWrite - - - - SelectLidCloseActionPluggedIn - - - - - 1 - This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - Power.admx - SelectACSystemLidAction - Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat - ACSystemLidAction_2 - LastWrite - - - - SelectPowerButtonActionOnBattery - - - - - 1 - This policy setting specifies the action that Windows takes when a user presses the power button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - Power.admx - SelectDCPowerButtonAction - Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat - DCPowerButtonAction_2 - LastWrite - - - - SelectPowerButtonActionPluggedIn - - - - - 1 - This policy setting specifies the action that Windows takes when a user presses the power button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - Power.admx - SelectACPowerButtonAction - Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat - ACPowerButtonAction_2 - LastWrite - - - - SelectSleepButtonActionOnBattery - - - - - 1 - This policy setting specifies the action that Windows takes when a user presses the sleep button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - Power.admx - SelectDCSleepButtonAction - Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat - DCSleepButtonAction_2 - LastWrite - - - - SelectSleepButtonActionPluggedIn - - - - - 1 - This policy setting specifies the action that Windows takes when a user presses the sleep button. - -Possible actions include: -0 - Take no action -1 - Sleep -2 - Hibernate -3 - Shut down - -If you enable this policy setting, you must select the desired action. - -If you disable this policy setting or do not configure it, users can see and change this setting. - - - - - - - - - - - text/plain - - - Power.admx - SelectACSleepButtonAction - Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat - ACSleepButtonAction_2 - LastWrite - - - - StandbyTimeoutOnBattery - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - DCStandbyTimeOut_2 - LastWrite - - - - StandbyTimeoutPluggedIn - - - - - - - - - - - - - - - - - text/plain - - phone - power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - ACStandbyTimeOut_2 - LastWrite - - - - TurnOffHybridSleepOnBattery - - - - - 0 - This policy setting allows you to turn off hybrid sleep. - -If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). - -If you do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - Power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - DCStandbyWithHiberfileEnable_2 - LastWrite - - - - TurnOffHybridSleepPluggedIn - - - - - 0 - This policy setting allows you to turn off hybrid sleep. - -If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). - -If you do not configure this policy setting, users control this setting. - - - - - - - - - - - text/plain - - - Power.admx - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - ACStandbyWithHiberfileEnable_2 - LastWrite - - - - UnattendedSleepTimeoutOnBattery - - - - - 0 - This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. - -If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. - -If you disable or do not configure this policy setting, users control this setting. - -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - - - - - - - - - - - text/plain - - - Power.admx - EnterUnattendedSleepTimeOut - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - UnattendedSleepTimeOutDC - LastWrite - - - - UnattendedSleepTimeoutPluggedIn - - - - - 0 - This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. - -If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. - -If you disable or do not configure this policy setting, users control this setting. - -If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - - - - - - - - - - - text/plain - - - Power.admx - EnterUnattendedSleepTimeOut - Power~AT~System~PowerManagementCat~PowerSleepSettingsCat - UnattendedSleepTimeOutAC - LastWrite - - - - - Printers - - - - - - - - - - - - - - - - - - - PointAndPrintRestrictions - - - - - - - - - - - - - - - - - text/plain - - phone - Printing.admx - Printing~AT~ControlPanel~CplPrinters - PointAndPrint_Restrictions_Win7 - LastWrite - - - - PublishPrinters - - - - - - - - - - - - - - - - - text/plain - - phone - Printing2.admx - Printing2~AT~Printers - PublishPrinters - LastWrite - - - - - Privacy - - - - - - - - - - - - - - - - - - - AllowAutoAcceptPairingAndPrivacyConsentPrompts - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowCrossDeviceClipboard - - - - - 1 - Allows syncing of Clipboard across devices under the same Microsoft account. - - - - - - - - - - - text/plain - - - OSPolicy.admx - OSPolicy~AT~System~PolicyPolicies - AllowCrossDeviceClipboard - LowestValueMostSecure - - - - AllowInputPersonalization - - - - - 1 - - - - - - - - - - - - text/plain - - - 10.0.10240 - Globalization.admx - Globalization~AT~ControlPanel~RegionalOptions - AllowInputPersonalization - LowestValueMostSecure - - - - DisableAdvertisingId - - - - - 65535 - - - - - - - - - - - - text/plain - - - UserProfiles.admx - UserProfiles~AT~System~UserProfiles - DisableAdvertisingId - LowestValueMostSecureZeroHasNoLimits - - - - DisablePrivacyExperience - - - - - 0 - Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. - - - - - - - - - - - text/plain - - - phone - OOBE.admx - OOBE~AT~WindowsComponents~OOBE - DisablePrivacyExperience - LowestValueMostSecure - - - - EnableActivityFeed - - - - - 1 - Enables ActivityFeed, which is responsible for mirroring different activity types (as applicable) across device graph of the user. - - - - - - - - - - - text/plain - - - OSPolicy.admx - OSPolicy~AT~System~PolicyPolicies - EnableActivityFeed - HighestValueMostSecure - - - - LetAppsAccessAccountInfo - - - - - 0 - This policy setting specifies whether Windows apps can access account information. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessAccountInfo_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessAccountInfo - HighestValueMostSecure - - - - LetAppsAccessAccountInfo_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessAccountInfo_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessAccountInfo - LastWrite - ; - - - - LetAppsAccessAccountInfo_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessAccountInfo_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessAccountInfo - LastWrite - ; - - - - LetAppsAccessAccountInfo_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessAccountInfo_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessAccountInfo - LastWrite - ; - - - - LetAppsAccessBackgroundSpatialPerception - - - - - 0 - This policy setting specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - LetAppsAccessCalendar - - - - - 0 - This policy setting specifies whether Windows apps can access the calendar. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessCalendar_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCalendar - HighestValueMostSecure - - - - LetAppsAccessCalendar_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCalendar_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCalendar - LastWrite - ; - - - - LetAppsAccessCalendar_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCalendar_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCalendar - LastWrite - ; - - - - LetAppsAccessCalendar_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCalendar_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCalendar - LastWrite - ; - - - - LetAppsAccessCallHistory - - - - - 0 - This policy setting specifies whether Windows apps can access call history. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessCallHistory_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCallHistory - HighestValueMostSecure - - - - LetAppsAccessCallHistory_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCallHistory_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCallHistory - LastWrite - ; - - - - LetAppsAccessCallHistory_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCallHistory_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCallHistory - LastWrite - ; - - - - LetAppsAccessCallHistory_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCallHistory_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCallHistory - LastWrite - ; - - - - LetAppsAccessCamera - - - - - 0 - This policy setting specifies whether Windows apps can access the camera. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessCamera_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCamera - HighestValueMostSecure - - - - LetAppsAccessCamera_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCamera_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCamera - LastWrite - ; - - - - LetAppsAccessCamera_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCamera_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCamera - LastWrite - ; - - - - LetAppsAccessCamera_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessCamera_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessCamera - LastWrite - ; - - - - LetAppsAccessContacts - - - - - 0 - This policy setting specifies whether Windows apps can access contacts. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessContacts_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessContacts - HighestValueMostSecure - - - - LetAppsAccessContacts_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessContacts_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessContacts - LastWrite - ; - - - - LetAppsAccessContacts_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessContacts_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessContacts - LastWrite - ; - - - - LetAppsAccessContacts_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessContacts_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessContacts - LastWrite - ; - - - - LetAppsAccessEmail - - - - - 0 - This policy setting specifies whether Windows apps can access email. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessEmail_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessEmail - HighestValueMostSecure - - - - LetAppsAccessEmail_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessEmail_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessEmail - LastWrite - ; - - - - LetAppsAccessEmail_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessEmail_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessEmail - LastWrite - ; - - - - LetAppsAccessEmail_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessEmail_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessEmail - LastWrite - ; - - - - LetAppsAccessGazeInput - - - - - 0 - This policy setting specifies whether Windows apps can access the eye tracker. - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - LetAppsAccessGazeInput_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - LetAppsAccessGazeInput_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - LetAppsAccessGazeInput_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - text/plain - - LastWrite - ; - - - - LetAppsAccessLocation - - - - - 0 - This policy setting specifies whether Windows apps can access location. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessLocation_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessLocation - HighestValueMostSecure - - - - LetAppsAccessLocation_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessLocation_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessLocation - LastWrite - ; - - - - LetAppsAccessLocation_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessLocation_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessLocation - LastWrite - ; - - - - LetAppsAccessLocation_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessLocation_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessLocation - LastWrite - ; - - - - LetAppsAccessMessaging - - - - - 0 - This policy setting specifies whether Windows apps can read or send messages (text or MMS). - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessMessaging_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMessaging - HighestValueMostSecure - - - - LetAppsAccessMessaging_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMessaging_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMessaging - LastWrite - ; - - - - LetAppsAccessMessaging_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMessaging_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMessaging - LastWrite - ; - - - - LetAppsAccessMessaging_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMessaging_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMessaging - LastWrite - ; - - - - LetAppsAccessMicrophone - - - - - 0 - This policy setting specifies whether Windows apps can access the microphone. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessMicrophone_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMicrophone - HighestValueMostSecure - - - - LetAppsAccessMicrophone_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMicrophone_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMicrophone - LastWrite - ; - - - - LetAppsAccessMicrophone_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMicrophone_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMicrophone - LastWrite - ; - - - - LetAppsAccessMicrophone_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMicrophone_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMicrophone - LastWrite - ; - - - - LetAppsAccessMotion - - - - - 0 - This policy setting specifies whether Windows apps can access motion data. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessMotion_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMotion - HighestValueMostSecure - - - - LetAppsAccessMotion_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMotion_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMotion - LastWrite - ; - - - - LetAppsAccessMotion_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMotion_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMotion - LastWrite - ; - - - - LetAppsAccessMotion_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessMotion_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessMotion - LastWrite - ; - - - - LetAppsAccessNotifications - - - - - 0 - This policy setting specifies whether Windows apps can access notifications. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessNotifications_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessNotifications - HighestValueMostSecure - - - - LetAppsAccessNotifications_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessNotifications_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessNotifications - LastWrite - ; - - - - LetAppsAccessNotifications_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessNotifications_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessNotifications - LastWrite - ; - - - - LetAppsAccessNotifications_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessNotifications_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessNotifications - LastWrite - ; - - - - LetAppsAccessPhone - - - - - 0 - This policy setting specifies whether Windows apps can make phone calls - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessPhone_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessPhone - HighestValueMostSecure - - - - LetAppsAccessPhone_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessPhone_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessPhone - LastWrite - ; - - - - LetAppsAccessPhone_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessPhone_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessPhone - LastWrite - ; - - - - LetAppsAccessPhone_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessPhone_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessPhone - LastWrite - ; - - - - LetAppsAccessRadios - - - - - 0 - This policy setting specifies whether Windows apps have access to control radios. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessRadios_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessRadios - HighestValueMostSecure - - - - LetAppsAccessRadios_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessRadios_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessRadios - LastWrite - ; - - - - LetAppsAccessRadios_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessRadios_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessRadios - LastWrite - ; - - - - LetAppsAccessRadios_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessRadios_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessRadios - LastWrite - ; - - - - LetAppsAccessTasks - - - - - 0 - This policy setting specifies whether Windows apps can access tasks. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessTasks_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTasks - HighestValueMostSecure - - - - LetAppsAccessTasks_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessTasks_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTasks - LastWrite - ; - - - - LetAppsAccessTasks_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessTasks_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTasks - LastWrite - ; - - - - LetAppsAccessTasks_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessTasks_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTasks - LastWrite - ; - - - - LetAppsAccessTrustedDevices - - - - - 0 - This policy setting specifies whether Windows apps can access trusted devices. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsAccessTrustedDevices_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTrustedDevices - HighestValueMostSecure - - - - LetAppsAccessTrustedDevices_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessTrustedDevices_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTrustedDevices - LastWrite - ; - - - - LetAppsAccessTrustedDevices_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessTrustedDevices_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTrustedDevices - LastWrite - ; - - - - LetAppsAccessTrustedDevices_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsAccessTrustedDevices - LastWrite - ; - - - - LetAppsActivateWithVoice - - - - - 0 - This policy setting specifies whether Windows apps can be activated by voice. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsActivateWithVoice_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsActivateWithVoice - HighestValueMostSecure - - - - LetAppsActivateWithVoiceAboveLock - - - - - 0 - This policy setting specifies whether Windows apps can be activated by voice while the system is locked. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsActivateWithVoiceAboveLock_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsActivateWithVoiceAboveLock - HighestValueMostSecure - - - - LetAppsGetDiagnosticInfo - - - - - 0 - This policy setting specifies whether Windows apps can get diagnostic information about other apps, including user names. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsGetDiagnosticInfo_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsGetDiagnosticInfo - HighestValueMostSecure - - - - LetAppsGetDiagnosticInfo_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsGetDiagnosticInfo - LastWrite - ; - - - - LetAppsGetDiagnosticInfo_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to get diagnostic information about other apps, including user names. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsGetDiagnosticInfo - LastWrite - ; - - - - LetAppsGetDiagnosticInfo_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the app diagnostics privacy setting for the listed Windows apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsGetDiagnosticInfo - LastWrite - ; - - - - LetAppsRunInBackground - - - - - 0 - This policy setting specifies whether Windows apps can run in the background. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsRunInBackground_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsRunInBackground - HighestValueMostSecure - - - - LetAppsRunInBackground_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsRunInBackground_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsRunInBackground - LastWrite - ; - - - - LetAppsRunInBackground_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are not allowed to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsRunInBackground_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsRunInBackground - LastWrite - ; - - - - LetAppsRunInBackground_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the background apps privacy setting for the listed Windows apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified Windows apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsRunInBackground_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsRunInBackground - LastWrite - ; - - - - LetAppsSyncWithDevices - - - - - 0 - This policy setting specifies whether Windows apps can communicate with unpaired wireless devices. - - - - - - - - - - - text/plain - - - AppPrivacy.admx - LetAppsSyncWithDevices_Enum - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsSyncWithDevices - HighestValueMostSecure - - - - LetAppsSyncWithDevices_ForceAllowTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsSyncWithDevices_ForceAllowTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsSyncWithDevices - LastWrite - ; - - - - LetAppsSyncWithDevices_ForceDenyTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsSyncWithDevices_ForceDenyTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsSyncWithDevices - LastWrite - ; - - - - LetAppsSyncWithDevices_UserInControlOfTheseApps - - - - - - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - - - - - - - - - text/plain - - AppPrivacy.admx - LetAppsSyncWithDevices_UserInControlOfTheseApps_List - AppPrivacy~AT~WindowsComponents~AppPrivacy - LetAppsSyncWithDevices - LastWrite - ; - - - - PublishUserActivities - - - - - 1 - Allows apps/system to publish 'User Activities' into ActivityFeed. - - - - - - - - - - - text/plain - - - OSPolicy.admx - OSPolicy~AT~System~PolicyPolicies - PublishUserActivities - HighestValueMostSecure - - - - UploadUserActivities - - - - - 1 - Allows ActivityFeed to upload published 'User Activities'. - - - - - - - - - - - text/plain - - - OSPolicy.admx - OSPolicy~AT~System~PolicyPolicies - UploadUserActivities - HighestValueMostSecure - - - - - RemoteAssistance - - - - - - - - - - - - - - - - - - - CustomizeWarningMessages - - - - - - - - - - - - - - - - - text/plain - - phone - remoteassistance.admx - RemoteAssistance~AT~System~RemoteAssist - RA_Options - LastWrite - - - - SessionLogging - - - - - - - - - - - - - - - - - text/plain - - phone - remoteassistance.admx - RemoteAssistance~AT~System~RemoteAssist - RA_Logging - LastWrite - - - - SolicitedRemoteAssistance - - - - - - - - - - - - - - - - - text/plain - - phone - remoteassistance.admx - RemoteAssistance~AT~System~RemoteAssist - RA_Solicit - LastWrite - - - - UnsolicitedRemoteAssistance - - - - - - - - - - - - - - - - - text/plain - - phone - remoteassistance.admx - RemoteAssistance~AT~System~RemoteAssist - RA_Unsolicit - LastWrite - - - - - RemoteDesktopServices - - - - - - - - - - - - - - - - - - - AllowUsersToConnectRemotely - - - - - - - - - - - - - - - - - text/plain - - phone - terminalserver.admx - TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_CONNECTIONS - TS_DISABLE_CONNECTIONS - LastWrite - - - - ClientConnectionEncryptionLevel - - - - - - - - - - - - - - - - - text/plain - - phone - terminalserver.admx - TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_SECURITY - TS_ENCRYPTION_POLICY - LastWrite - - - - DoNotAllowDriveRedirection - - - - - - - - - - - - - - - - - text/plain - - phone - terminalserver.admx - TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_REDIRECTION - TS_CLIENT_DRIVE_M - LastWrite - - - - DoNotAllowPasswordSaving - - - - - - - - - - - - - - - - - text/plain - - phone - terminalserver.admx - TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_CLIENT - TS_CLIENT_DISABLE_PASSWORD_SAVING_2 - LastWrite - - - - PromptForPasswordUponConnection - - - - - - - - - - - - - - - - - text/plain - - phone - terminalserver.admx - TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_SECURITY - TS_PASSWORD - LastWrite - - - - RequireSecureRPCCommunication - - - - - - - - - - - - - - - - - text/plain - - phone - terminalserver.admx - TerminalServer~AT~WindowsComponents~TS_GP_NODE~TS_TERMINAL_SERVER~TS_SECURITY - TS_RPC_ENCRYPTION - LastWrite - - - - - RemoteManagement - - - - - - - - - - - - - - - - - - - AllowBasicAuthentication_Client - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient - AllowBasic_2 - LastWrite - - - - AllowBasicAuthentication_Service - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - AllowBasic_1 - LastWrite - - - - AllowCredSSPAuthenticationClient - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRMClient - AllowCredSSP_2 - LastWrite - - - - AllowCredSSPAuthenticationService - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - AllowCredSSP_1 - LastWrite - - - - AllowRemoteServerManagement - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - AllowAutoConfig - LastWrite - - - - AllowUnencryptedTraffic_Client - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient - AllowUnencrypted_2 - LastWrite - - - - AllowUnencryptedTraffic_Service - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - AllowUnencrypted_1 - LastWrite - - - - DisallowDigestAuthentication - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient - DisallowDigest - LastWrite - - - - DisallowNegotiateAuthenticationClient - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient - DisallowNegotiate_2 - LastWrite - - - - DisallowNegotiateAuthenticationService - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - DisallowNegotiate_1 - LastWrite - - - - DisallowStoringOfRunAsCredentials - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - DisableRunAs - LastWrite - - - - SpecifyChannelBindingTokenHardeningLevel - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - CBTHardeningLevel_1 - LastWrite - - - - TrustedHosts - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMClient - TrustedHosts - LastWrite - - - - TurnOnCompatibilityHTTPListener - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - HttpCompatibilityListener - LastWrite - - - - TurnOnCompatibilityHTTPSListener - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteManagement.admx - WindowsRemoteManagement~AT~WindowsComponents~WinRM~WinRMService - HttpsCompatibilityListener - LastWrite - - - - - RemoteProcedureCall - - - - - - - - - - - - - - - - - - - RestrictUnauthenticatedRPCClients - - - - - - - - - - - - - - - - - text/plain - - phone - rpc.admx - RPC~AT~System~Rpc - RpcRestrictRemoteClients - LastWrite - - - - RPCEndpointMapperClientAuthentication - - - - - - - - - - - - - - - - - text/plain - - phone - rpc.admx - RPC~AT~System~Rpc - RpcEnableAuthEpResolution - LastWrite - - - - - RemoteShell - - - - - - - - - - - - - - - - - - - AllowRemoteShellAccess - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - AllowRemoteShellAccess - LastWrite - - - - MaxConcurrentUsers - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - MaxConcurrentUsers - LastWrite - - - - SpecifyIdleTimeout - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - IdleTimeout - LastWrite - - - - SpecifyMaxMemory - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - MaxMemoryPerShellMB - LastWrite - - - - SpecifyMaxProcesses - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - MaxProcessesPerShell - LastWrite - - - - SpecifyMaxRemoteShells - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - MaxShellsPerUser - LastWrite - - - - SpecifyShellTimeout - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsRemoteShell.admx - WindowsRemoteShell~AT~WindowsComponents~WinRS - ShellTimeOut - LastWrite - - - - - RestrictedGroups - - - - - - - - - - - - - - - - - - - ConfigureGroupMembership - - - - - - This security setting allows an administrator to define the members of a security-sensitive (restricted) group. When a Restricted Groups Policy is enforced, any current member of a restricted group that is not on the Members list is removed. Any user on the Members list who is not currently a member of the restricted group is added. You can use Restricted Groups policy to control group membership. Using the policy, you can specify what members are part of a group. Any members that are not specified in the policy are removed during configuration or refresh. For example, you can create a Restricted Groups policy to only allow specified users (for example, Alice and John) to be members of the Administrators group. When policy is refreshed, only Alice and John will remain as members of the Administrators group. -Caution: If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - - - - - - - - - Restricted Group Member - - - - - - - - - - - - - - - Restricted Group - - - - - - ]]> - - - - - Search - - - - - - - - - - - - - - - - - - - AllowCloudSearch - - - - - 2 - - - - - - - - - - - - text/plain - - - Search.admx - AllowCloudSearch_Dropdown - Search~AT~WindowsComponents~Search - AllowCloudSearch - LowestValueMostSecure - - - - AllowCortanaInAAD - - - - - 0 - This features allows you to show the cortana opt-in page during Windows Setup - - - - - - - - - - - text/plain - - - phone - Search.admx - Search~AT~WindowsComponents~Search - AllowCortanaInAAD - LowestValueMostSecure - - - - AllowFindMyFiles - - - - - 1 - This feature allows you to disable find my files completely on the machine - - - - - - - - - - - text/plain - - - phone - Search.admx - Search~AT~WindowsComponents~Search - AllowFindMyFiles - LowestValueMostSecure - - - - AllowIndexingEncryptedStoresOrItems - - - - - 0 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - AllowIndexingEncryptedStoresOrItems - LowestValueMostSecure - - - - AllowSearchToUseLocation - - - - - 1 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - AllowSearchToUseLocation - LowestValueMostSecure - - - - AllowStoringImagesFromVisionSearch - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowUsingDiacritics - - - - - 0 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - AllowUsingDiacritics - HighestValueMostSecure - - - - AllowWindowsIndexer - - - - - 3 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AlwaysUseAutoLangDetection - - - - - 0 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - AlwaysUseAutoLangDetection - HighestValueMostSecure - - - - DisableBackoff - - - - - 0 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - DisableBackoff - HighestValueMostSecure - - - - DisableRemovableDriveIndexing - - - - - 0 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - DisableRemovableDriveIndexing - HighestValueMostSecure - - - - DoNotUseWebResults - - - - - 1 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - DoNotUseWebResults - LowestValueMostSecure - - - - PreventIndexingLowDiskSpaceMB - - - - - 1 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - StopIndexingOnLimitedHardDriveSpace - HighestValueMostSecure - - - - PreventRemoteQueries - - - - - 1 - - - - - - - - - - - - text/plain - - - Search.admx - Search~AT~WindowsComponents~Search - PreventRemoteQueries - HighestValueMostSecure - - - - SafeSearchPermissions - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - HighestValueMostSecure - - - - - Security - - - - - - - - - - - - - - - - - - - AllowAddProvisioningPackage - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowManualRootCertificateInstallation - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - AllowRemoveProvisioningPackage - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AntiTheftMode - - - - - 1 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - ClearTPMIfNotReady - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - TPM.admx - TPM~AT~System~TPMCategory - ClearTPMIfNotReady_Name - HighestValueMostSecure - - - - ConfigureWindowsPasswords - - - - - 2 - Configures the use of passwords for Windows features - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - PreventAutomaticDeviceEncryptionForAzureADJoinedDevices - - - - - 0 - - - - - - - - - - - - text/plain - - - LastWrite - - - - RecoveryEnvironmentAuthentication - - - - - 0 - This policy controls the requirement of Admin Authentication in RecoveryEnvironment. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - RequireDeviceEncryption - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - RequireProvisioningPackageSignature - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - RequireRetrieveHealthCertificateOnBoot - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - - ServiceControlManager - - - - - - - - - - - - - - - - - - - SvchostProcessMitigation - - - - - - - - - - - - - - - - - text/plain - - phone - ServiceControlManager.admx - ServiceControlManager~AT~System~ServiceControlManagerCat~ServiceControlManagerSecurityCat - SvchostProcessMitigationEnable - LastWrite - - - - - Settings - - - - - - - - - - - - - - - - - - - AllowAutoPlay - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowDataSense - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowDateTime - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowEditDeviceName - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowLanguage - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowOnlineTips - - - - - 1 - - - - - - - - - - - - text/plain - - - ControlPanel.admx - CheckBox_AllowOnlineTips - ControlPanel~AT~ControlPanel - AllowOnlineTips - LowestValueMostSecure - - - - AllowPowerSleep - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowRegion - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowSignInOptions - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowVPN - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowWorkplace - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowYourAccount - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - PageVisibilityList - - - - - - - - - - - - - - - - - text/plain - - ControlPanel.admx - SettingsPageVisibilityBox - ControlPanel~AT~ControlPanel - SettingsPageVisibility - LastWrite - - - - - SmartScreen - - - - - - - - - - - - - - - - - - - EnableAppInstallControl - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - SmartScreen.admx - SmartScreen~AT~WindowsComponents~SmartScreen~Shell - ConfigureAppInstallControl - LastWrite - - - - EnableSmartScreenInShell - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - SmartScreen.admx - SmartScreen~AT~WindowsComponents~SmartScreen~Shell - ShellConfigureSmartScreen - HighestValueMostSecure - - - - PreventOverrideForFilesInShell - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - SmartScreen.admx - ShellConfigureSmartScreen_Dropdown - SmartScreen~AT~WindowsComponents~SmartScreen~Shell - ShellConfigureSmartScreen - HighestValueMostSecure - - - - - Speech - - - - - - - - - - - - - - - - - - - AllowSpeechModelUpdate - - - - - 1 - - - - - - - - - - - - text/plain - - - Speech.admx - Speech~AT~WindowsComponents~Speech - AllowSpeechModelUpdate - LowestValueMostSecure - - - - - Start - - - - - - - - - - - - - - - - - - - AllowPinnedFolderDocuments - - - - - 65535 - This policy controls the visibility of the Documents shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderDownloads - - - - - 65535 - This policy controls the visibility of the Downloads shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderFileExplorer - - - - - 65535 - This policy controls the visibility of the File Explorer shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderHomeGroup - - - - - 65535 - This policy controls the visibility of the HomeGroup shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderMusic - - - - - 65535 - This policy controls the visibility of the Music shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderNetwork - - - - - 65535 - This policy controls the visibility of the Network shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderPersonalFolder - - - - - 65535 - This policy controls the visibility of the PersonalFolder shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderPictures - - - - - 65535 - This policy controls the visibility of the Pictures shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderSettings - - - - - 65535 - This policy controls the visibility of the Settings shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowPinnedFolderVideos - - - - - 65535 - This policy controls the visibility of the Videos shortcut on the Start menu. The possible values are 0 - means that the shortcut should be hidden and grays out the corresponding toggle in the Settings app, 1 - means that the shortcut should be visible and grays out the corresponding toggle in the Settings app, 65535 - means that there is no enforced configuration and the setting can be changed by the user. - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - DisableContextMenus - - - - - 0 - Enabling this policy prevents context menus from being invoked in the Start Menu. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - DisableContextMenusInStart - LowestValueMostSecure - - - - ForceStartSize - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - ForceStartSize - LastWrite - - - - HideAppList - - - - - 0 - Setting the value of this policy to 1 or 2 collapses the app list. Setting the value of this policy to 3 removes the app list entirely. Setting the value of this policy to 2 or 3 disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - HideChangeAccountSettings - - - - - 0 - Enabling this policy hides "Change account settings" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideFrequentlyUsedApps - - - - - 0 - Enabling this policy hides the most used apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - NoFrequentUsedPrograms - LowestValueMostSecure - - - - HideHibernate - - - - - 0 - Enabling this policy hides "Hibernate" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideLock - - - - - 0 - Enabling this policy hides "Lock" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HidePowerButton - - - - - 0 - Enabling this policy hides the power button from appearing in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideRecentJumplists - - - - - 0 - Enabling this policy hides recent jumplists from appearing on the start menu/taskbar and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - NoRecentDocsHistory - LowestValueMostSecure - - - - HideRecentlyAddedApps - - - - - 0 - Enabling this policy hides recently added apps from appearing on the start menu and disables the corresponding toggle in the Settings app. - - - - - - - - - - - text/plain - - - phone - StartMenu.admx - StartMenu~AT~StartMenu - HideRecentlyAddedApps - LowestValueMostSecure - - - - HideRestart - - - - - 0 - Enabling this policy hides "Restart/Update and restart" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideShutDown - - - - - 0 - Enabling this policy hides "Shut down/Update and shut down" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideSignOut - - - - - 0 - Enabling this policy hides "Sign out" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideSleep - - - - - 0 - Enabling this policy hides "Sleep" from appearing in the power button in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideSwitchAccount - - - - - 0 - Enabling this policy hides "Switch account" from appearing in the user tile in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - HideUserTile - - - - - 0 - Enabling this policy hides the user tile from appearing in the start menu. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - ImportEdgeAssets - - - - - - This policy setting allows you to import Edge assets to be used with StartLayout policy. Start layout can contain secondary tile from Edge app which looks for Edge local asset file. Edge local asset would not exist and cause Edge secondary tile to appear empty in this case. This policy only gets applied when StartLayout policy is modified. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - NoPinningToTaskbar - - - - - 0 - This policy setting allows you to control pinning programs to the Taskbar. If you enable this policy setting, users cannot change the programs currently pinned to the Taskbar. If any programs are already pinned to the Taskbar, these programs continue to show in the Taskbar. However, users cannot unpin these programs already pinned to the Taskbar, and they cannot pin new programs to the Taskbar. If you disable or do not configure this policy setting, users can change the programs currently pinned to the Taskbar. - - - - - - - - - - - text/plain - - - phone - HighestValueMostSecure - - - - StartLayout - - - - - - - - - - - - - - - - - text/plain - - phone - StartMenu.admx - StartMenu~AT~StartMenu - LockedStartLayout - LastWrite - - - - - Storage - - - - - - - - - - - - - - - - - - - AllowDiskHealthModelUpdates - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - StorageHealth.admx - StorageHealth~AT~System~StorageHealth - SH_AllowDiskHealthModelUpdates - LastWrite - - - - AllowStorageSenseGlobal - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - StorageSense.admx - StorageSense~AT~System~StorageSense - SS_AllowStorageSenseGlobal - LastWrite - - - - AllowStorageSenseTemporaryFilesCleanup - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - StorageSense.admx - StorageSense~AT~System~StorageSense - SS_AllowStorageSenseTemporaryFilesCleanup - LastWrite - - - - ConfigStorageSenseCloudContentDehydrationThreshold - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - StorageSense.admx - StorageSense~AT~System~StorageSense - SS_ConfigStorageSenseCloudContentDehydrationThreshold - LastWrite - - - - ConfigStorageSenseDownloadsCleanupThreshold - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - StorageSense.admx - StorageSense~AT~System~StorageSense - SS_ConfigStorageSenseDownloadsCleanupThreshold - LastWrite - - - - ConfigStorageSenseGlobalCadence - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - StorageSense.admx - StorageSense~AT~System~StorageSense - SS_ConfigStorageSenseGlobalCadence - LastWrite - - - - ConfigStorageSenseRecycleBinCleanupThreshold - - - - - 30 - - - - - - - - - - - - text/plain - - - phone - StorageSense.admx - StorageSense~AT~System~StorageSense - SS_ConfigStorageSenseRecycleBinCleanupThreshold - LastWrite - - - - EnhancedStorageDevices - - - - - - - - - - - - - - - - - text/plain - - phone - enhancedstorage.admx - EnhancedStorage~AT~System~EnStorDeviceAccess - TCGSecurityActivationDisabled - LastWrite - - - - RemovableDiskDenyWriteAccess - - - - - 0 - If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. Note: To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." - - - - - - - - - - - text/plain - - - RemovableStorage.admx - RemovableDisks_DenyWrite_Access_2 - RemovableStorage~AT~System~DeviceAccess - RemovableDisks_DenyWrite_Access_2 - HighestValueMostSecure - - - - - System - - - - - - - - - - - - - - - - - - - AllowBuildPreview - - - - - 2 - - - - - - - - - - - - text/plain - - - AllowBuildPreview.admx - AllowBuildPreview~AT~WindowsComponents~DataCollectionAndPreviewBuilds - AllowBuildPreview - LowestValueMostSecure - - - - AllowCommercialDataPipeline - - - - - 0 - - - - - - - - - - - - text/plain - - - DataCollection.admx - AllowCommercialDataPipeline - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - AllowCommercialDataPipeline - HighestValueMostSecure - - - - AllowDeviceNameInDiagnosticData - - - - - 0 - This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. - - - - - - - - - - - text/plain - - - DataCollection.admx - AllowDeviceNameInDiagnosticData - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - AllowDeviceNameInDiagnosticData - LowestValueMostSecure - - - - AllowEmbeddedMode - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowExperimentation - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowFontProviders - - - - - 1 - - - - - - - - - - - - text/plain - - - GroupPolicy.admx - GroupPolicy~AT~Network~NetworkFonts - EnableFontProviders - LowestValueMostSecure - - - - AllowLocation - - - - - 1 - - - - - - - - - - - - text/plain - - - Sensors.admx - Sensors~AT~LocationAndSensors - DisableLocation_2 - LowestValueMostSecure - - - - AllowStorageCard - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowTelemetry - - - - - 3 - - - - - - - - - - - - text/plain - - - DataCollection.admx - AllowTelemetry - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - AllowTelemetry - LowestValueMostSecure - - - - AllowUserToResetPhone - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - BootStartDriverInitialization - - - - - - - - - - - - - - - - - text/plain - - phone - earlylauncham.admx - EarlyLaunchAM~AT~System~ELAMCategory - POL_DriverLoadPolicy_Name - LastWrite - - - - ConfigureMicrosoft365UploadEndpoint - - - - - - - - - - - - - - - - - text/plain - - DataCollection.admx - ConfigureMicrosoft365UploadEndpoint - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - ConfigureMicrosoft365UploadEndpoint - LastWrite - - - - ConfigureTelemetryOptInChangeNotification - - - - - 0 - - - - - - - - - - - - text/plain - - - DataCollection.admx - ConfigureTelemetryOptInChangeNotification - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - ConfigureTelemetryOptInChangeNotification - HighestValueMostSecure - - - - ConfigureTelemetryOptInSettingsUx - - - - - 0 - - - - - - - - - - - - text/plain - - - DataCollection.admx - ConfigureTelemetryOptInSettingsUx - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - ConfigureTelemetryOptInSettingsUx - HighestValueMostSecure - - - - DisableDeviceDelete - - - - - 0 - - - - - - - - - - - - text/plain - - - DataCollection.admx - DisableDeviceDelete - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - DisableDeviceDelete - HighestValueMostSecure - - - - DisableDiagnosticDataViewer - - - - - 0 - - - - - - - - - - - - text/plain - - - DataCollection.admx - DisableDiagnosticDataViewer - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - DisableDiagnosticDataViewer - HighestValueMostSecure - - - - DisableDirectXDatabaseUpdate - - - - - 0 - This group policy allows control over whether the DirectX Database Updater task will be run on the system. - - - - - - - - - - - text/plain - - - GroupPolicy.admx - GroupPolicy~AT~Network~DirectXDatabase - DisableDirectXDatabaseUpdate - HighestValueMostSecure - - - - DisableEnterpriseAuthProxy - - - - - 0 - This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. - - - - - - - - - - - text/plain - - - DataCollection.admx - DisableEnterpriseAuthProxy - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - DisableEnterpriseAuthProxy - LastWrite - - - - DisableOneDriveFileSync - - - - - 0 - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. - - - - - - - - - - - text/plain - - - SkyDrive.admx - SkyDrive~AT~WindowsComponents~OneDrive - PreventOnedriveFileSync - HighestValueMostSecure - - - - DisableSystemRestore - - - - - - - - - - - - - - - - - text/plain - - phone - systemrestore.admx - SystemRestore~AT~System~SR - SR_DisableSR - LastWrite - - - - FeedbackHubAlwaysSaveDiagnosticsLocally - - - - - 0 - Diagnostic files created when a feedback is filed in the Feedback Hub app will always be saved locally. If this policy is not present or set to false, users will be presented with the option to save locally. The default is to not save locally. - - - - - - - - - - - text/plain - - - LastWrite - - - - LimitEnhancedDiagnosticDataWindowsAnalytics - - - - - 0 - This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. By configuring this setting, you're not stopping people from changing their Telemetry Settings; however, you are stopping them from choosing a higher level than you've set for the organization. To enable this behavior, you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced).If you configure these policy settings together, you'll send the Basic level of diagnostic data plus any additional events that are required for Windows Analytics, to Microsoft. The additional events are documented here: https://go.Microsoft.com/fwlink/?linked=847594. If you enable Enhanced diagnostic data in the Allow Telemetry policy setting, but you don't configure this policy setting, you'll send the required events for Windows Analytics, plus any additional Enhanced level telemetry data to Microsoft. This setting has no effect on computers configured to send Full, Basic, or Security level diagnostic data to Microsoft. If you disable or don't configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy setting. - - - - - - - - - - - text/plain - - - DataCollection.admx - LimitEnhancedDiagnosticDataWindowsAnalytics - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - LimitEnhancedDiagnosticDataWindowsAnalytics - LowestValueMostSecure - - - - TelemetryProxy - - - - - - - - - - - - - - - - - text/plain - - DataCollection.admx - TelemetryProxyName - DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds - TelemetryProxy - LastWrite - - - - TurnOffFileHistory - - - - - 0 - This policy setting allows you to turn off File History. - -If you enable this policy setting, File History cannot be activated to create regular, automatic backups. - -If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. - - - - - - - - - - - text/plain - - - FileHistory.admx - FileHistory~AT~WindowsComponents~FileHistory - DisableFileHistory - LowestValueMostSecure - - - - - SystemServices - - - - - - - - - - - - - - - - - - - ConfigureHomeGroupListenerServiceStartupMode - - - - - 3 - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~System Services - HomeGroup Listener - LastWrite - - - - ConfigureHomeGroupProviderServiceStartupMode - - - - - 3 - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~System Services - HomeGroup Provider - LastWrite - - - - ConfigureXboxAccessoryManagementServiceStartupMode - - - - - 3 - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~System Services - Xbox Accessory Management Service - LastWrite - - - - ConfigureXboxLiveAuthManagerServiceStartupMode - - - - - 3 - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~System Services - Xbox Live Auth Manager - LastWrite - - - - ConfigureXboxLiveGameSaveServiceStartupMode - - - - - 3 - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~System Services - Xbox Live Game Save - LastWrite - - - - ConfigureXboxLiveNetworkingServiceStartupMode - - - - - 3 - This setting determines whether the service's start type is Automatic(2), Manual(3), Disabled(4). Default: Manual. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~System Services - Xbox Live Networking Service - LastWrite - - - - - TaskManager - - - - - - - - - - - - - - - - - - - AllowEndTask - - - - - 1 - This setting determines whether non-administrators can use Task Manager to end tasks - enabled (1) or disabled (0). Default: enabled - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - - TaskScheduler - - - - - - - - - - - - - - - - - - - EnableXboxGameSaveTask - - - - - 0 - This setting determines whether the specific task is enabled (1) or disabled (0). Default: Enabled. - - - - - - - - - - - text/plain - - - phone - LastWrite - - - - - TextInput - - - - - - - - - - - - - - - - - - - AllowHardwareKeyboardTextSuggestions - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowIMELogging - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowIMENetworkAccess - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowInputPanel - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowJapaneseIMESurrogatePairCharacters - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - HighestValueMostSecure - - - - AllowJapaneseIVSCharacters - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowJapaneseNonPublishingStandardGlyph - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowJapaneseUserDictionary - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - LowestValueMostSecure - - - - AllowKeyboardTextSuggestions - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowLanguageFeaturesUninstall - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - TextInput.admx - TextInput~AT~WindowsComponents~TextInput - AllowLanguageFeaturesUninstall - LowestValueMostSecure - - - - AllowLinguisticDataCollection - - - - - 1 - - - - - - - - - - - - text/plain - - - TextInput.admx - TextInput~AT~WindowsComponents~TextInput - AllowLinguisticDataCollection - LowestValueMostSecure - - - - ConfigureJapaneseIMEVersion - - - - - 0 - This policy allows the IT admin to configure the Microsoft Japanese IME version in the desktop. -The following list shows the supported values: -0 (default) – The new Microsoft Japanese IME is on by default. Allow to control Microsoft Japanese IME version to use. -1 - The previous version of Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. -2 - The new Microsoft Japanese IME is always selected. Not allowed to control Microsoft Japanese IME version to use. - - - - - - - - - - - text/plain - - - EAIME.admx - EAIME~AT~WindowsComponents~L_IME - L_ConfigureJapaneseImeVersion - LowestValueMostSecure - - - - ConfigureSimplifiedChineseIMEVersion - - - - - 0 - This policy allows the IT admin to configure the Microsoft Simplified Chinese IME version in the desktop. -The following list shows the supported values: -0 (default) – The new Microsoft Simplified Chinese IME is on by default. Allow to control Microsoft Simplified Chinese IME version to use. -1 - The previous version of Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. -2 - The new Microsoft Simplified Chinese IME is always selected. Not allowed to control Microsoft Simplified Chinese IME version to use. - - - - - - - - - - - text/plain - - - EAIME.admx - EAIME~AT~WindowsComponents~L_IME - L_ConfigureSimplifiedChineseImeVersion - LowestValueMostSecure - - - - ConfigureTraditionalChineseIMEVersion - - - - - 0 - This policy allows the IT admin to configure the Microsoft Traditional Chinese IME version in the desktop. -The following list shows the supported values: -0 (default) – The new Microsoft Traditional Chinese IME is on by default. Allow to control Microsoft Traditional Chinese IME version to use. -1 - The previous version of Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. -2 - The new Microsoft Traditional Chinese IME is always selected. Not allowed to control Microsoft Traditional Chinese IME version to use. - - - - - - - - - - - text/plain - - - EAIME.admx - EAIME~AT~WindowsComponents~L_IME - L_ConfigureTraditionalChineseImeVersion - LowestValueMostSecure - - - - EnableTouchKeyboardAutoInvokeInDesktopMode - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - ExcludeJapaneseIMEExceptJIS0208 - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - ExcludeJapaneseIMEExceptJIS0208andEUDC - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - HighestValueMostSecure - - - - ExcludeJapaneseIMEExceptShiftJIS - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - HighestValueMostSecure - - - - ForceTouchKeyboardDockedState - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardDictationButtonAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardEmojiButtonAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardFullModeAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardHandwritingModeAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardNarrowModeAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardSplitModeAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - TouchKeyboardWideModeAvailability - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - - TimeLanguageSettings - - - - - - - - - - - - - - - - - - - AllowSet24HourClock - - - - - 0 - - - - - - - - - - - - text/plain - - - desktop - LowestValueMostSecure - - - - ConfigureTimeZone - - - - - - Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. - - - - - - - - - - - text/plain - - phone - LastWrite - - - - - Troubleshooting - - - - - - - - - - - - - - - - - - - AllowRecommendations - - - - - 1 - This policy setting applies recommended troubleshooting for known problems on the device and lets administrators configure how it's applied to their domains/IT environments. -Not configuring this policy setting will allow the user to configure if and how recommended troubleshooting is applied. - -Enabling this policy allows you to configure how recommended troubleshooting is applied on the user's device. You can select from one of the following values: -0 = Turn this feature off. -1 = Turn this feature off but still apply critical troubleshooting. -2 = Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. -3 = Run recommended troubleshooting automatically and notify the user after it's been successfully run. -4 = Run recommended troubleshooting automatically without notifying the user. -5 = Allow the user to choose their own recommended troubleshooting settings. - - - - - - - - - - - text/plain - - - phone - MSDT.admx - MSDT~AT~System~Troubleshooting~WdiScenarioCategory - TroubleshootingAllowRecommendations - LowestValueMostSecure - - - - - Update - - - - - - - - - - - - - - - - - - - ActiveHoursEnd - - - - - 17 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ActiveHoursEndTime - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ActiveHours - LastWrite - - - - ActiveHoursMaxRange - - - - - 18 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ActiveHoursMaxRange - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ActiveHoursMaxRange - LastWrite - - - - ActiveHoursStart - - - - - 8 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ActiveHoursStartTime - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ActiveHours - LastWrite - - - - AllowAutoUpdate - - - - - 6 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoUpdateMode - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - AllowAutoWindowsUpdateDownloadOverMeteredNetwork - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AllowAutoWindowsUpdateDownloadOverMeteredNetwork - LastWrite - - - - AllowMUUpdateService - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsUpdate.admx - AllowMUUpdateServiceId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - AllowNonMicrosoftSignedUpdate - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowUpdateService - - - - - 1 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - CorpWuURL - LowestValueMostSecure - - - - AutomaticMaintenanceWakeUp - - - - - 1 - This policy setting allows you to configure Automatic Maintenance wake up policy. - -The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. - -If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. - -If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. - - - - - - - - - - - text/plain - - - msched.admx - msched~AT~WindowsComponents~MaintenanceScheduler - WakeUpPolicy - HighestValueMostSecure - - - - AutoRestartDeadlinePeriodInDays - - - - - 7 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoRestartDeadline - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoRestartDeadline - LastWrite - - - - AutoRestartDeadlinePeriodInDaysForFeatureUpdates - - - - - 7 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoRestartDeadlineForFeatureUpdates - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoRestartDeadline - LastWrite - - - - AutoRestartNotificationSchedule - - - - - 15 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoRestartNotificationSchd - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoRestartNotificationConfig - LastWrite - - - - AutoRestartRequiredNotificationDismissal - - - - - 1 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoRestartRequiredNotificationDismissal - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoRestartRequiredNotificationDismissal - LastWrite - - - - BranchReadinessLevel - - - - - 16 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - BranchReadinessLevelId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferFeatureUpdates - LastWrite - - - - ConfigureDeadlineForFeatureUpdates - - - - - 7 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ConfigureDeadlineForFeatureUpdates - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ConfigureDeadlineForFeatureUpdates - LastWrite - - - - ConfigureDeadlineForQualityUpdates - - - - - 7 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ConfigureDeadlineForQualityUpdates - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ConfigureDeadlineForQualityUpdates - LastWrite - - - - ConfigureDeadlineGracePeriod - - - - - 2 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ConfigureDeadlineGracePeriod - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ConfigureDeadlineGracePeriod - LastWrite - - - - ConfigureDeadlineNoAutoReboot - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ConfigureDeadlineNoAutoReboot - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - ConfigureDeadlineNoAutoReboot - HighestValueMostSecure - - - - ConfigureFeatureUpdateUninstallPeriod - - - - - 10 - Enable enterprises/IT admin to configure feature update uninstall period - - - - - - - - - - - text/plain - - - LastWrite - - - - DeferFeatureUpdatesPeriodInDays - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - DeferFeatureUpdatesPeriodId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferFeatureUpdates - LastWrite - - - - DeferQualityUpdatesPeriodInDays - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - DeferQualityUpdatesPeriodId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferQualityUpdates - LastWrite - - - - DeferUpdatePeriod - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - DeferUpdatePeriodId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - DeferUpgrade - LastWrite - - - - DeferUpgradePeriod - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - DeferUpgradePeriodId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - DeferUpgrade - LastWrite - - - - DetectionFrequency - - - - - 22 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - DetectionFrequency_Hour2 - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - DetectionFrequency_Title - LastWrite - - - - DisableDualScan - - - - - 0 - Do not allow update deferral policies to cause scans against Windows Update - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - DisableDualScan - LastWrite - - - - DisableWUfBSafeguards - - - - - 0 - - - - - - - - - - - - text/plain - - - LastWrite - - - - EngagedRestartDeadline - - - - - 14 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - EngagedRestartDeadline - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - EngagedRestartTransitionSchedule - LastWrite - - - - EngagedRestartDeadlineForFeatureUpdates - - - - - 14 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - EngagedRestartDeadlineForFeatureUpdates - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - EngagedRestartTransitionSchedule - LastWrite - - - - EngagedRestartSnoozeSchedule - - - - - 3 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - EngagedRestartSnoozeSchedule - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - EngagedRestartTransitionSchedule - LastWrite - - - - EngagedRestartSnoozeScheduleForFeatureUpdates - - - - - 3 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - EngagedRestartSnoozeScheduleForFeatureUpdates - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - EngagedRestartTransitionSchedule - LastWrite - - - - EngagedRestartTransitionSchedule - - - - - 7 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - EngagedRestartTransitionSchedule - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - EngagedRestartTransitionSchedule - LastWrite - - - - EngagedRestartTransitionScheduleForFeatureUpdates - - - - - 7 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - EngagedRestartTransitionScheduleForFeatureUpdates - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - EngagedRestartTransitionSchedule - LastWrite - - - - ExcludeWUDriversInQualityUpdate - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - ExcludeWUDriversInQualityUpdate - LastWrite - - - - FillEmptyContentUrls - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - CorpWUFillEmptyContentUrls - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - CorpWuURL - LastWrite - - - - IgnoreMOAppDownloadLimit - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - IgnoreMOUpdateDownloadLimit - - - - - 0 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - ManagePreviewBuilds - - - - - 3 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ManagePreviewBuildsId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - ManagePreviewBuilds - LastWrite - - - - PauseDeferrals - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - PauseDeferralsId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - DeferUpgrade - LastWrite - - - - PauseFeatureUpdates - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - PauseFeatureUpdatesId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferFeatureUpdates - LastWrite - - - - PauseFeatureUpdatesStartTime - - - - - - - - - - - - - - - - - text/plain - - WindowsUpdate.admx - PauseFeatureUpdatesStartId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferFeatureUpdates - LastWrite - - - - PauseQualityUpdates - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - PauseQualityUpdatesId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferQualityUpdates - LastWrite - - - - PauseQualityUpdatesStartTime - - - - - - - - - - - - - - - - - text/plain - - WindowsUpdate.admx - PauseQualityUpdatesStartId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - DeferQualityUpdates - LastWrite - - - - PhoneUpdateRestrictions - - - - - 4 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - RequireDeferUpgrade - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - DeferUpgradePeriodId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - DeferUpgrade - LastWrite - - - - RequireUpdateApproval - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecure - - - - ScheduledInstallDay - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoUpdateSchDay - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduledInstallEveryWeek - - - - - 1 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoUpdateSchEveryWeek - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduledInstallFirstWeek - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoUpdateSchFirstWeek - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduledInstallFourthWeek - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ScheduledInstallFourthWeek - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduledInstallSecondWeek - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ScheduledInstallSecondWeek - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduledInstallThirdWeek - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - ScheduledInstallThirdWeek - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduledInstallTime - - - - - 3 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoUpdateSchTime - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoUpdateCfg - LowestValueMostSecure - - - - ScheduleImminentRestartWarning - - - - - 15 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - RestartWarn - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - RestartWarnRemind - LastWrite - - - - ScheduleRestartWarning - - - - - 4 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - RestartWarnRemind - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - RestartWarnRemind - LastWrite - - - - SetAutoRestartNotificationDisable - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - AutoRestartNotificationSchd - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - AutoRestartNotificationDisable - LastWrite - - - - SetDisablePauseUXAccess - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - SetDisablePauseUXAccess - LastWrite - - - - SetDisableUXWUAccess - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - SetDisableUXWUAccess - LastWrite - - - - SetEDURestart - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - SetEDURestart - LastWrite - - - - SetProxyBehaviorForUpdateDetection - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - SetProxyBehaviorForUpdateDetection - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - CorpWuURL - LastWrite - - - - TargetReleaseVersion - - - - - - - - - - - - - - - - - text/plain - - WindowsUpdate.admx - TargetReleaseVersionId - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat - TargetReleaseVersion - LastWrite - - - - UpdateNotificationLevel - - - - - 0 - - - - - - - - - - - - text/plain - - - WindowsUpdate.admx - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - UpdateNotificationLevel - LastWrite - - - - UpdateServiceUrl - - - - - CorpWSUS - - - - - - - - - - - - text/plain - - WindowsUpdate.admx - CorpWUURL_Name - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - CorpWuURL - LastWrite - - - - UpdateServiceUrlAlternate - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsUpdate.admx - CorpWUContentHost_Name - WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - CorpWuURL - LastWrite - - - - - UserRights - - - - - - - - - - - - - - - - - - - AccessCredentialManagerAsTrustedCaller - - - - - - This user right is used by Credential Manager during Backup/Restore. No accounts should have this privilege, as it is only assigned to Winlogon. Users' saved credentials might be compromised if this privilege is given to other entities. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Access Credential Manager ase a trusted caller - LastWrite - 0xF000 - - - - AccessFromNetwork - - - - - - This user right determines which users and groups are allowed to connect to the computer over the network. Remote Desktop Services are not affected by this user right.Note: Remote Desktop Services was called Terminal Services in previous versions of Windows Server. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Access this computer from the network - LastWrite - 0xF000 - - - - ActAsPartOfTheOperatingSystem - - - - - - This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. Processes that require this privilege should use the LocalSystem account, which already includes this privilege, rather than using a separate user account with this privilege specially assigned. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Act as part of the operating system - LastWrite - 0xF000 - - - - AllowLocalLogOn - - - - - - This user right determines which users can log on to the computer. Note: Modifying this setting may affect compatibility with clients, services, and applications. For compatibility information about this setting, see Allow log on locally (https://go.microsoft.com/fwlink/?LinkId=24268 ) at the Microsoft website. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Allow log on locally - LastWrite - 0xF000 - - - - BackupFilesAndDirectories - - - - - - This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when backing up files and directories.Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Read. Caution: Assigning this user right can be a security risk. Since users with this user right can read any registry settings and files, only assign this user right to trusted users - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Back up files and directories - LastWrite - 0xF000 - - - - ChangeSystemTime - - - - - - This user right determines which users and groups can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Change the system time - LastWrite - 0xF000 - - - - CreateGlobalObjects - - - - - - This security setting determines whether users can create global objects that are available to all sessions. Users can still create objects that are specific to their own session if they do not have this user right. Users who can create global objects could affect processes that run under other users' sessions, which could lead to application failure or data corruption. Caution: Assigning this user right can be a security risk. Assign this user right only to trusted users. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Create global objects - LastWrite - 0xF000 - - - - CreatePageFile - - - - - - This user right determines which users and groups can call an internal application programming interface (API) to create and change the size of a page file. This user right is used internally by the operating system and usually does not need to be assigned to any users - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Create a pagefile - LastWrite - 0xF000 - - - - CreatePermanentSharedObjects - - - - - - This user right determines which accounts can be used by processes to create a directory object using the object manager. This user right is used internally by the operating system and is useful to kernel-mode components that extend the object namespace. Because components that are running in kernel mode already have this user right assigned to them, it is not necessary to specifically assign it. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Create permanent shared objects - LastWrite - 0xF000 - - - - CreateSymbolicLinks - - - - - - This user right determines if the user can create a symbolic link from the computer he is logged on to. Caution: This privilege should only be given to trusted users. Symbolic links can expose security vulnerabilities in applications that aren't designed to handle them. Note: This setting can be used in conjunction a symlink filesystem setting that can be manipulated with the command line utility to control the kinds of symlinks that are allowed on the machine. Type 'fsutil behavior set symlinkevaluation /?' at the command line to get more information about fsutil and symbolic links. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Create symbolic links - LastWrite - 0xF000 - - - - CreateToken - - - - - - This user right determines which accounts can be used by processes to create a token that can then be used to get access to any local resources when the process uses an internal application programming interface (API) to create an access token. This user right is used internally by the operating system. Unless it is necessary, do not assign this user right to a user, group, or process other than Local System. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Create a token object - LastWrite - 0xF000 - - - - DebugPrograms - - - - - - This user right determines which users can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need to be assigned this user right. Developers who are debugging new system components will need this user right to be able to do so. This user right provides complete access to sensitive and critical operating system components. Caution:Assigning this user right can be a security risk. Only assign this user right to trusted users. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Debug programs - LastWrite - 0xF000 - - - - DenyAccessFromNetwork - - - - - - This user right determines which users are prevented from accessing a computer over the network. This policy setting supersedes the Access this computer from the network policy setting if a user account is subject to both policies. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Deny access to this computer from the network - LastWrite - 0xF000 - - - - DenyLocalLogOn - - - - - - This security setting determines which service accounts are prevented from registering a process as a service. Note: This security setting does not apply to the System, Local Service, or Network Service accounts. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Deny log on as a service - LastWrite - 0xF000 - - - - DenyRemoteDesktopServicesLogOn - - - - - - This user right determines which users and groups are prohibited from logging on as a Remote Desktop Services client. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Deny log on through Remote Desktop Services - LastWrite - 0xF000 - - - - EnableDelegation - - - - - - This user right determines which users can set the Trusted for Delegation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using delegated credentials of a client, as long as the client account does not have the Account cannot be delegated account control flag set. Caution: Misuse of this user right, or of the Trusted for Delegation setting, could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Enable computer and user accounts to be trusted for delegation - LastWrite - 0xF000 - - - - GenerateSecurityAudits - - - - - - This user right determines which accounts can be used by a process to add entries to the security log. The security log is used to trace unauthorized system access. Misuse of this user right can result in the generation of many auditing events, potentially hiding evidence of an attack or causing a denial of service. Shut down system immediately if unable to log security audits security policy setting is enabled. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Generate security audits - LastWrite - 0xF000 - - - - ImpersonateClient - - - - - - Assigning this user right to a user allows programs running on behalf of that user to impersonate a client. Requiring this user right for this kind of impersonation prevents an unauthorized user from convincing a client to connect (for example, by remote procedure call (RPC) or named pipes) to a service that they have created and then impersonating that client, which can elevate the unauthorized user's permissions to administrative or system levels. Caution: Assigning this user right can be a security risk. Only assign this user right to trusted users. Note: By default, services that are started by the Service Control Manager have the built-in Service group added to their access tokens. Component Object Model (COM) servers that are started by the COM infrastructure and that are configured to run under a specific account also have the Service group added to their access tokens. As a result, these services get this user right when they are started. In addition, a user can also impersonate an access token if any of the following conditions exist. -1) The access token that is being impersonated is for this user. -2) The user, in this logon session, created the access token by logging on to the network with explicit credentials. -3) The requested level is less than Impersonate, such as Anonymous or Identify. -Because of these factors, users do not usually need this user right. Warning: If you enable this setting, programs that previously had the Impersonate privilege may lose it, and they may not run. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Impersonate a client after authentication - LastWrite - 0xF000 - - - - IncreaseSchedulingPriority - - - - - - This user right determines which accounts can use a process with Write Property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Increase scheduling priority - LastWrite - 0xF000 - - - - LoadUnloadDeviceDrivers - - - - - - This user right determines which users can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. It is recommended that you do not assign this privilege to other users. Caution: Assigning this user right can be a security risk. Do not assign this user right to any user, group, or process that you do not want to take over the system. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Load and unload device drivers - LastWrite - 0xF000 - - - - LockMemory - - - - - - This user right determines which accounts can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Lock pages in memory - LastWrite - 0xF000 - - - - ManageAuditingAndSecurityLog - - - - - - This user right determines which users can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. This security setting does not allow a user to enable file and object access auditing in general. You can view audited events in the security log of the Event Viewer. A user with this privilege can also view and clear the security log. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Manage auditing and security log - LastWrite - 0xF000 - - - - ManageVolume - - - - - - This user right determines which users and groups can run maintenance tasks on a volume, such as remote defragmentation. Use caution when assigning this user right. Users with this user right can explore disks and extend files in to memory that contains other data. When the extended files are opened, the user might be able to read and modify the acquired data. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Perform volume maintenance tasks - LastWrite - 0xF000 - - - - ModifyFirmwareEnvironment - - - - - - This user right determines who can modify firmware environment values. Firmware environment variables are settings stored in the nonvolatile RAM of non-x86-based computers. The effect of the setting depends on the processor.On x86-based computers, the only firmware environment value that can be modified by assigning this user right is the Last Known Good Configuration setting, which should only be modified by the system. On Itanium-based computers, boot information is stored in nonvolatile RAM. Users must be assigned this user right to run bootcfg.exe and to change the Default Operating System setting on Startup and Recovery in System Properties. On all computers, this user right is required to install or upgrade Windows.Note: This security setting does not affect who can modify the system environment variables and user environment variables that are displayed on the Advanced tab of System Properties. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Modify firmware environment values - LastWrite - 0xF000 - - - - ModifyObjectLabel - - - - - - This user right determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Modify an object label - LastWrite - 0xF000 - - - - ProfileSingleProcess - - - - - - This user right determines which users can use performance monitoring tools to monitor the performance of system processes. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Profile single process - LastWrite - 0xF000 - - - - RemoteShutdown - - - - - - This user right determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Force shutdown from a remote system - LastWrite - 0xF000 - - - - RestoreFilesAndDirectories - - - - - - This user right determines which users can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories, and determines which users can set any valid security principal as the owner of an object. Specifically, this user right is similar to granting the following permissions to the user or group in question on all files and folders on the system:Traverse Folder/Execute File, Write. Caution: Assigning this user right can be a security risk. Since users with this user right can overwrite registry settings, hide data, and gain ownership of system objects, only assign this user right to trusted users. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Restore files and directories - LastWrite - 0xF000 - - - - TakeOwnership - - - - - - This user right determines which users can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. Caution: Assigning this user right can be a security risk. Since owners of objects have full control of them, only assign this user right to trusted users. - - - - - - - - - - - text/plain - - phone - Windows Settings~Security Settings~Local Policies~User Rights Assignment - Take ownership of files or other objects - LastWrite - 0xF000 - - - - - Wifi - - - - - - - - - - - - - - - - - - - AllowAutoConnectToWiFiSenseHotspots - - - - - 1 - - - - - - - - - - - - text/plain - - - wlansvc.admx - wlansvc~AT~Network~WlanSvc_Category~WlanSettings_Category - WiFiSense - LowestValueMostSecure - - - - AllowInternetSharing - - - - - 1 - - - - - - - - - - - - text/plain - - - NetworkConnections.admx - NetworkConnections~AT~Network~NetworkConnections - NC_ShowSharedAccessUI - LowestValueMostSecure - - - - AllowManualWiFiConfiguration - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowWiFi - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowWiFiDirect - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - WLANScanMode - - - - - 0 - - - - - - - - - - - - text/plain - - - HighestValueMostSecureZeroHasNoLimits - - - - - WindowsConnectionManager - - - - - - - - - - - - - - - - - - - ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork - - - - - - - - - - - - - - - - - text/plain - - phone - WCM.admx - WCM~AT~Network~WCM_Category - WCM_BlockNonDomain - LastWrite - - - - - WindowsDefenderSecurityCenter - - - - - - - - - - - - - - - - - - - CompanyName - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefenderSecurityCenter.admx - Presentation_EnterpriseCustomization_CompanyName - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization - EnterpriseCustomization_CompanyName - LastWrite - - - - DisableAccountProtectionUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~AccountProtection - AccountProtection_UILockdown - LastWrite - - - - DisableAppBrowserUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~AppBrowserProtection - AppBrowserProtection_UILockdown - LastWrite - - - - DisableClearTpmButton - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity - DeviceSecurity_DisableClearTpmButton - LastWrite - - - - DisableDeviceSecurityUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity - DeviceSecurity_UILockdown - LastWrite - - - - DisableEnhancedNotifications - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~Notifications - Notifications_DisableEnhancedNotifications - LastWrite - - - - DisableFamilyUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~FamilyOptions - FamilyOptions_UILockdown - LastWrite - - - - DisableHealthUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DevicePerformanceHealth - DevicePerformanceHealth_UILockdown - LastWrite - - - - DisableNetworkUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~FirewallNetworkProtection - FirewallNetworkProtection_UILockdown - LastWrite - - - - DisableNotifications - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~Notifications - Notifications_DisableNotifications - LastWrite - - - - DisableTpmFirmwareUpdateWarning - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity - DeviceSecurity_DisableTpmFirmwareUpdateWarning - LastWrite - - - - DisableVirusUI - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~VirusThreatProtection - VirusThreatProtection_UILockdown - LastWrite - - - - DisallowExploitProtectionOverride - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~AppBrowserProtection - AppBrowserProtection_DisallowExploitProtectionOverride - LastWrite - - - - Email - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefenderSecurityCenter.admx - Presentation_EnterpriseCustomization_Email - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization - EnterpriseCustomization_Email - LastWrite - - - - EnableCustomizedToasts - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization - EnterpriseCustomization_EnableCustomizedToasts - LastWrite - - - - EnableInAppCustomization - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization - EnterpriseCustomization_EnableInAppCustomization - LastWrite - - - - HideRansomwareDataRecovery - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~VirusThreatProtection - VirusThreatProtection_HideRansomwareRecovery - LastWrite - - - - HideSecureBoot - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity - DeviceSecurity_HideSecureBoot - LastWrite - - - - HideTPMTroubleshooting - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~DeviceSecurity - DeviceSecurity_HideTPMTroubleshooting - LastWrite - - - - HideWindowsSecurityNotificationAreaControl - - - - - 0 - - - - - - - - - - - - text/plain - - - phone - WindowsDefenderSecurityCenter.admx - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~Systray - Systray_HideSystray - LastWrite - - - - Phone - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefenderSecurityCenter.admx - Presentation_EnterpriseCustomization_Phone - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization - EnterpriseCustomization_Phone - LastWrite - - - - URL - - - - - - - - - - - - - - - - - text/plain - - phone - WindowsDefenderSecurityCenter.admx - Presentation_EnterpriseCustomization_URL - WindowsDefenderSecurityCenter~AT~WindowsComponents~WindowsDefenderSecurityCenter~EnterpriseCustomization - EnterpriseCustomization_URL - LastWrite - - - - - WindowsInkWorkspace - - - - - - - - - - - - - - - - - - - AllowSuggestedAppsInWindowsInkWorkspace - - - - - 1 - - - - - - - - - - - - text/plain - - - phone - WindowsInkWorkspace.admx - WindowsInkWorkspace~AT~WindowsComponents~WindowsInkWorkspace - AllowSuggestedAppsInWindowsInkWorkspace - LowestValueMostSecure - - - - AllowWindowsInkWorkspace - - - - - 2 - - - - - - - - - - - - text/plain - - - phone - WindowsInkWorkspace.admx - AllowWindowsInkWorkspaceDropdown - WindowsInkWorkspace~AT~WindowsComponents~WindowsInkWorkspace - AllowWindowsInkWorkspace - LowestValueMostSecure - - - - - WindowsLogon - - - - - - - - - - - - - - - - - - - AllowAutomaticRestartSignOn - - - - - - - - - - - - - - - - - text/plain - - phone - WinLogon.admx - WinLogon~AT~WindowsComponents~Logon - AutomaticRestartSignOn - LastWrite - - - - ConfigAutomaticRestartSignOn - - - - - - - - - - - - - - - - - text/plain - - phone - WinLogon.admx - WinLogon~AT~WindowsComponents~Logon - ConfigAutomaticRestartSignOn - LastWrite - - - - DisableLockScreenAppNotifications - - - - - - - - - - - - - - - - - text/plain - - phone - logon.admx - Logon~AT~System~Logon - DisableLockScreenAppNotifications - LastWrite - - - - DontDisplayNetworkSelectionUI - - - - - - - - - - - - - - - - - text/plain - - phone - logon.admx - Logon~AT~System~Logon - DontDisplayNetworkSelectionUI - LastWrite - - - - EnableFirstLogonAnimation - - - - - 1 - This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. - -If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. - -If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. - -If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. - -Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. - - - - - - - - - - - text/plain - - - Logon.admx - Logon~AT~System~Logon - EnableFirstLogonAnimation - HighestValueMostSecure - - - - EnumerateLocalUsersOnDomainJoinedComputers - - - - - - - - - - - - - - - - - text/plain - - phone - logon.admx - Logon~AT~System~Logon - EnumerateLocalUsers - LastWrite - - - - HideFastUserSwitching - - - - - 0 - This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager. If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied. The locations that Switch User interface appear are in the Logon UI, the Start menu and the Task Manager. If you disable or do not configure this policy setting, the Switch User interface is accessible to the user in the three locations. - - - - - - - - - - - text/plain - - - Logon.admx - Logon~AT~System~Logon - HideFastUserSwitching - HighestValueMostSecure - - - - - WindowsPowerShell - - - - - - - - - - - - - - - - - - - TurnOnPowerShellScriptBlockLogging - - - - - - - - - - - - - - - - - text/plain - - phone - PowerShellExecutionPolicy.admx - PowerShellExecutionPolicy~AT~WindowsComponents~PowerShell - EnableScriptBlockLogging - LastWrite - - - - - WirelessDisplay - - - - - - - - - - - - - - - - - - - AllowMdnsAdvertisement - - - - - 1 - This policy setting allows you to turn off the Wireless Display multicast DNS service advertisement from a Wireless Display receiver. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowMdnsDiscovery - - - - - 1 - This policy setting allows you to turn off discovering the display service advertised over multicast DNS by a Wireless Display receiver. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowProjectionFromPC - - - - - 1 - This policy allows you to turn off projection from a PC. - If you set it to 0, your PC cannot discover or project to other devices. - If you set it to 1, your PC can discover and project to other devices. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowProjectionFromPCOverInfrastructure - - - - - 1 - This policy allows you to turn off projection from a PC over infrastructure. - If you set it to 0, your PC cannot discover or project to other infrastructure devices, though it may still be possible to discover and project over WiFi Direct. - If you set it to 1, your PC can discover and project to other devices over infrastructure. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowProjectionToPC - - - - - 1 - This policy setting allows you to turn off projection to a PC - If you set it to 0, your PC isn't discoverable and can't be projected to - If you set it to 1, your PC is discoverable and can be projected to above the lock screen only. The user has an option to turn it always on or off except for manual launch, too. - - - - - - - - - - - text/plain - - - phone - WirelessDisplay.admx - WirelessDisplay~AT~WindowsComponents~Connect - AllowProjectionToPC - LowestValueMostSecure - - - - AllowProjectionToPCOverInfrastructure - - - - - 1 - This policy setting allows you to turn off projection to a PC over infrastructure. - If you set it to 0, your PC cannot be discoverable and can't be projected to over infrastructure, though it may still be possible to project over WiFi Direct. - If you set it to 1, your PC can be discoverable and can be projected to over infrastructure. - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - AllowUserInputFromWirelessDisplayReceiver - - - - - 1 - - - - - - - - - - - - text/plain - - - LowestValueMostSecure - - - - RequirePinForPairing - - - - - 0 - This policy setting allows you to require a pin for pairing. - If you set this to 0, a pin isn't required for pairing. - If you set this to 1, the pairing ceremony for new devices will always require a PIN. - If you set this to 2, all pairings will require PIN. - - - - - - - - - - - text/plain - - - WirelessDisplay.admx - WirelessDisplay~AT~WindowsComponents~Connect - RequirePinForPairing - LastWrite - - - - - - - -``` diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 9e7d8d762f..1fabc85e07 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -725,7 +725,7 @@ The XML below is the DDF for the current version for this CSP. LocMasterSwitchDependencyNII - + - diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index ff96d2c80a..9755457f60 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -61,9 +61,9 @@ SurfaceHub --------SleepTimeout --------AllowSessionResume --------AllowAutoProxyAuth +--------ProxyServers --------DisableSigninSuggestions --------DoNotShowMyMeetingsAndFiles -----ProxyServers ----Management --------GroupName --------GroupSid @@ -571,6 +571,11 @@ SurfaceHub

If this setting is true, the device account will be used for proxy authentication. If false, a separate account will be used.

The data type is boolean. Supported operation is Get and Replace. + +**Properties/ProxyServers** +

Added in KB4499162 for Windows 10, version 1703. Specifies FQDNs of proxy servers to provide device account credentials to before any user interaction (if AllowAutoProxyAuth is enabled). This is a semi-colon separated list of server names, without any additional prefixes (e.g. https://). + +

The data type is string. Supported operation is Get and Replace. **Properties/DisableSigninSuggestions**

Added in Windows 10, version 1703. Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings. diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 89c8d33d45..094b56add7 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -17,7 +17,7 @@ ms.date: 02/23/2018 The Update configuration service provider enables IT administrators to manage and control the rollout of new updates. > [!NOTE] -> The Update CSP functionality of 'AprrovedUpdates' is not recommended for managing desktop devices. To manage updates to desktop devices from Windows Update, see the [Policy CSP - Updates](policy-csp-update.md) documentation for the recommended policies. +> The Update CSP functionality of 'ApprovedUpdates' is not recommended for managing desktop devices. To manage updates to desktop devices from Windows Update, see the [Policy CSP - Updates](policy-csp-update.md) documentation for the recommended policies. The following shows the Update configuration service provider in tree format. diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index 15c30be7f5..1fed240483 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -390,6 +390,9 @@ Optional node. Name Resolution Policy Table (NRPT) rules for the VPN profile. The Name Resolution Policy Table (NRPT) is a table of namespaces and corresponding settings stored in the Windows registry that determines the DNS client behavior when issuing queries and processing responses. Each row in the NRPT represents a rule for a portion of the namespace for which the DNS client issues queries. Before issuing name resolution queries, the DNS client consults the NRPT to determine if any additional flags must be set in the query. After receiving the response, the client again consults the NRPT to check for any special processing or policy requirements. In the absence of the NRPT, the client operates based on the DNS servers and suffixes set on the interface. +> [!NOTE] +> Only applications using the [Windows DNS API](/windows/win32/dns/dns-reference) can make use of the NRPT and therefore all settings configured within the DomainNameInformationList section. Applications using their own DNS implementation bypass the Windows DNS API. One example of applications not using the Windows DNS API is nslookup, so always use the PowerShell CmdLet [Resolve-DNSName](/powershell/module/dnsclient/resolve-dnsname) to check the functionality of the NRPT. + **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId A sequential integer identifier for the Domain Name information. Sequencing must start at 0. @@ -419,8 +422,8 @@ Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/WebProxyServers** Optional. Web Proxy Server IP address if you are redirecting traffic through your intranet. -> [!NOTE] -> Currently only one web proxy server is supported. +> [!NOTE] +> Currently only one web proxy server is supported. Value type is chr. Supported operations include Get, Add, Replace, and Delete. @@ -1600,4 +1603,3 @@ Servers - diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index eb784753c2..47b2fc60cb 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -531,7 +531,7 @@ To distribute an app offline (organization-managed), the app must be downloaded To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Microsoft Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. -Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. +Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 edition. For more information, see [Microsoft Store for Business](/microsoft-store/index). @@ -786,14 +786,12 @@ Update availability depends on what servicing option you choose for the device. Immediately after the Feature Update is published to Windows Update by Microsoft Microsoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer) Makes new features available to users as soon as possible -Mobile & Mobile Enterprise Current Branch for Business (CBB) A minimum of four months after the corresponding Feature Update is first published to Windows Update by Microsoft A minimum of four months, though it potentially can be longerNo Provides additional time to test new feature before deployment -Mobile Enterprise only @@ -802,11 +800,11 @@ Update availability depends on what servicing option you choose for the device. *Applies to: Corporate devices* -While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 Mobile Enterprise edition. +While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 edition. -Upgrading to Windows 10 Mobile Enterprise edition provides additional device and app management capabilities for organizations that want to: -- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 Mobile Enterprise edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released. -- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 Mobile Enterprise is required. +Upgrading to Windows 10 edition provides additional device and app management capabilities for organizations that want to: +- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released. +- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 is required. - **Set the diagnostic data level:** Microsoft collects diagnostic data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the diagnostic data level so that only diagnostic information required to keep devices secured is gathered. To learn more about diagnostic, see [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization). @@ -980,7 +978,7 @@ This is a list of attributes that are supported by DHA and can trigger the corre - **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). - **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). - **Secure Boot Configuration Policy (SBCP) present** Specifies whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. -- **Boot cycle whitelist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allow list. A device that complies with the allow list is more trustworthy (secure) than a device that is noncompliant. +- **Boot cycle allow list** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allow list. A device that complies with the allow list is more trustworthy (secure) than a device that is noncompliant. #### Example scenario diff --git a/windows/configuration/TOC.yml b/windows/configuration/TOC.yml index a5a0bbbb07..867a205b26 100644 --- a/windows/configuration/TOC.yml +++ b/windows/configuration/TOC.yml @@ -117,7 +117,7 @@ items: - name: Set up and test Cortana in Windows 10, version 2004 and later href: cortana-at-work/set-up-and-test-cortana-in-windows-10.md - - name: Testing scenarios using Cortana in your business or organization + - name: Cortana at work testing scenarios href: cortana-at-work/cortana-at-work-testing-scenarios.md - name: Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query href: cortana-at-work/cortana-at-work-scenario-1.md @@ -138,7 +138,7 @@ - name: Set up and test Cortana in Windows 10, versions 1909 and earlier, with Microsoft 365 in your organization href: cortana-at-work/cortana-at-work-o365.md - name: Testing scenarios using Cortana in your business or organization - href: cortana-at-work/cortana-at-work-testing-scenarios.md + href: cortana-at-work/testing-scenarios-using-cortana-in-business-org.md - name: Test scenario 1 - Sign into Azure AD, enable the wake word, and try a voice query href: cortana-at-work/test-scenario-1.md - name: Test scenario 2 - Perform a quick search with Cortana at work diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md index 46b62aec12..8137313839 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md @@ -1,31 +1,25 @@ --- -title: Testing scenarios using Cortana in your business or organization (Windows 10) -description: A list of suggested testing scenarios that you can use to test Cortana in your organization. +title: Cortana at work testing scenarios +description: Suggested testing scenarios that you can use to test Cortana in your organization. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library author: greg-lindsay ms.localizationpriority: medium ms.author: greglin -ms.date: 10/05/2017 +ms.date: 06/28/2021 ms.reviewer: manager: dansimp --- -# Testing scenarios using Cortana in your business or organization +# Cortana at work testing scenarios We've come up with a list of suggested testing scenarios that you can use to test Cortana in your organization. After you complete all the scenarios, you should be able to: - [Sign into Azure AD, enable the Cortana wake word, and try a voice query](cortana-at-work-scenario-1.md) - - [Perform a Bing search with Cortana](cortana-at-work-scenario-2.md) - - [Set a reminder](cortana-at-work-scenario-3.md) - - [Use Cortana to find free time on your calendar](cortana-at-work-scenario-4.md) - - [Find out about a person](cortana-at-work-scenario-5.md) - - [Change your language and perform a quick search with Cortana](cortana-at-work-scenario-6.md) - - [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) \ No newline at end of file diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index c8a3334ac2..ae0fdee1a2 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -1,11 +1,11 @@ -- name: Deploy and update Windows 10 +- name: Deploy and update Windows client href: index.yml items: - name: Get started items: - name: What's new href: deploy-whats-new.md - - name: Windows 10 deployment scenarios + - name: Windows client deployment scenarios href: windows-10-deployment-scenarios.md - name: What is Windows as a service? href: update/waas-quick-start.md @@ -33,6 +33,8 @@ - name: Plan items: + - name: Plan for Windows 11 + href: /windows/whats-new/windows-11-plan - name: Create a deployment plan href: update/create-deployment-plan.md - name: Define readiness criteria @@ -67,6 +69,8 @@ - name: Prepare items: + - name: Prepare for Windows 11 + href: /windows/whats-new/windows-11-prepare - name: Prepare to deploy Windows 10 updates href: update/prepare-deploy-windows.md - name: Evaluate and update infrastructure @@ -96,11 +100,11 @@ - name: Deploy items: - - name: Deploy Windows 10 + - name: Deploy Windows client items: - - name: Deploy Windows 10 with Autopilot + - name: Deploy Windows client with Autopilot href: windows-autopilot/index.yml - - name: Deploy Windows 10 with Configuration Manager + - name: Deploy Windows client with Configuration Manager items: - name: Deploy to a new device href: deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -110,7 +114,7 @@ href: deploy-windows-cm/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md - name: In-place upgrade href: deploy-windows-cm/upgrade-to-windows-10-with-configuraton-manager.md - - name: Deploy Windows 10 with MDT + - name: Deploy Windows client with MDT items: - name: Deploy to a new device href: deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -193,6 +197,8 @@ href: update/update-compliance-configuration-script.md - name: Manually configuring devices for Update Compliance href: update/update-compliance-configuration-manual.md + - name: Configuring devices for Update Compliance in Microsoft Endpoint Manager + href: update/update-compliance-configuration-mem.md - name: Update Compliance monitoring items: - name: Use Update Compliance @@ -261,6 +267,8 @@ items: - name: How does Windows Update work? href: update/how-windows-update-works.md + - name: Windows 10 upgrade paths + href: upgrade/windows-10-upgrade-paths.md - name: Deploy Windows 10 with Microsoft 365 href: deploy-m365.md - name: Understanding the Unified Update Platform @@ -541,4 +549,4 @@ href: volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md - name: Install fonts in Windows 10 - href: windows-10-missing-fonts.md \ No newline at end of file + href: windows-10-missing-fonts.md diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index 4707849d86..d2e0935b7d 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -1,9 +1,9 @@ --- -title: What's new in Windows 10 deployment +title: What's new in Windows client deployment ms.reviewer: manager: laurawi ms.author: greglin -description: Use this article to learn about new solutions and online content related to deploying Windows 10 in your organization. +description: Use this article to learn about new solutions and online content related to deploying Windows in your organization. keywords: deployment, automate, tools, configure, news ms.mktglfcycl: deploy ms.localizationpriority: medium @@ -16,19 +16,25 @@ ms.topic: article ms.custom: seo-marvel-apr2020 --- -# What's new in Windows 10 deployment +# What's new in Windows client deployment **Applies to:** - Windows 10 +- Windows 11 ## In this topic -This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization. +This topic provides an overview of new solutions and online content related to deploying Windows client in your organization. - For an all-up overview of new features in Windows 10, see [What's new in Windows 10](/windows/whats-new/index). ## Latest news +Check out the following new articles about Windows 11: +- [Overview of Windows 11](/windows/whats-new/windows-11) +- [Plan for Windows 11](/windows/whats-new/windows-11-plan) +- [Prepare for Windows 11](/windows/whats-new/windows-11-prepare) + [SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.
The [Windows ADK for Windows 10, version 2004](/windows-hardware/get-started/adk-install) is available.
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md index ba163c16c9..02c175e81b 100644 --- a/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt.md @@ -50,7 +50,7 @@ On **DC01**: 2. Create the **MDT_JD** service account by running the following command from an elevated **Windows PowerShell prompt**: ```powershell - New-ADUser -Name MDT_JD -UserPrincipalName MDT_JD -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT join domain account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true + New-ADUser -Name MDT_JD -UserPrincipalName MDT_JD@contoso.com -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT join domain account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true ``` 3. Next, run the Set-OuPermissions script to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated Windows PowerShell prompt: @@ -369,9 +369,9 @@ On **MDT01**: 2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: 1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: - - Name: Set DriverGroup001 - - Task Sequence Variable: DriverGroup001 - - Value: Windows 10 x64\\%Make%\\%Model% + 1. Name: Set DriverGroup001 + 2. Task Sequence Variable: DriverGroup001 + 3. Value: Windows 10 x64\\%Manufacturer%\\%Model% 2. Configure the **Inject Drivers** action with the following settings: - Choose a selection profile: Nothing @@ -842,4 +842,4 @@ The partitions when deploying an UEFI-based machine. [Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
-[Configure MDT settings](configure-mdt-settings.md)
\ No newline at end of file +[Configure MDT settings](configure-mdt-settings.md)
diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index 55641790b7..d938c4922b 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -1,10 +1,10 @@ ### YamlMime:Landing -title: Windows 10 deployment resources and documentation # < 60 chars -summary: Learn about deploying and keeping Windows 10 up to date. # < 160 chars +title: Windows client deployment resources and documentation # < 60 chars +summary: Learn about deploying and keeping Windows client devices up to date. # < 160 chars metadata: - title: Windows 10 deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. + title: Windows client deployment resources and documentation # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn about deploying Windows 10 and keeping it up to date in your organization. # Required; article description that is displayed in search results. < 160 chars. services: windows-10 ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. @@ -13,7 +13,7 @@ metadata: ms.collection: windows-10 author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - ms.date: 08/05/2020 #Required; mm/dd/yyyy format. + ms.date: 06/24/2021 #Required; mm/dd/yyyy format. localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -40,7 +40,7 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Prepare to deploy Windows 10 updates + - text: Prepare to deploy Windows updates url: update/prepare-deploy-windows.md - text: Prepare updates using Windows Update for Business url: update/waas-manage-updates-wufb.md @@ -65,8 +65,10 @@ landingContent: - linkListType: overview links: - text: What's new in Windows deployment - url: windows-10-deployment-scenarios.md - - text: Windows 10 deployment scenarios + url: deploy-whats-new.md + - text: Windows 11 overview + url: /windows/whats-new/windows-11.md + - text: Windows client deployment scenarios url: windows-10-deployment-scenarios.md - text: Basics of Windows updates, channels, and tools url: update/get-started-updates-channels-tools.md diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 475d3b84c6..72bcfc72c9 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -36,7 +36,7 @@ The features described below are no longer being actively developed, and might b | Language Community tab in Feedback Hub | The Language Community tab will be removed from the Feedback Hub. The standard feedback process: [Feedback Hub - Feedback](feedback-hub://?newFeedback=true&feedbackType=2) is the recommended way to provide translation feedback. | 1909 | | My People / People in the Shell | My People is no longer being developed. It may be removed in a future update. | 1909 | | Package State Roaming (PSR) | PSR will be removed in a future update. PSR allows non-Microsoft developers to access roaming data on devices, enabling developers of UWP applications to write data to Windows and synchronize it to other instantiations of Windows for that user.
 
The recommended replacement for PSR is [Azure App Service](/azure/app-service/). Azure App Service is widely supported, well documented, reliable, and supports cross-platform/cross-ecosystem scenarios such as iOS, Android and web. | 1909 | -| XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information about implementing a remote indirect display driver, ISVs can reach out to [rdsdev@microsoft.com](mailto:rdsdev@microsoft.com). | 1903 | +| XDDM-based remote display driver | Starting with this release, the Remote Desktop Services uses a Windows Display Driver Model (WDDM) based Indirect Display Driver (IDD) for a single session remote desktop. The support for Windows 2000 Display Driver Model (XDDM) based remote display drivers will be removed in a future release. Independent Software Vendors that use an XDDM-based remote display driver should plan a migration to the WDDM driver model. For more information on implementing remote display indirect display driver, check out [Updates for IddCx versions 1.4 and later](/windows-hardware/drivers/display/iddcx1.4-updates). | 1903 | | Taskbar settings roaming | Roaming of taskbar settings is no longer being developed and we plan to remove this capability in a future release. | 1903 | | Wi-Fi WEP and TKIP | Since the 1903 release, a warning message has appeared when connecting to Wi-Fi networks secured with WEP or TKIP (which are not as secure as those using WPA2 or WPA3). In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | 1903 | | Windows To Go | Windows To Go is no longer being developed.

The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| 1903 | @@ -70,4 +70,4 @@ The features described below are no longer being actively developed, and might b |TLS DHE_DSS ciphers DisabledByDefault| [TLS RC4 Ciphers](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server) will be disabled by default in this release. | 1703 | |TCPChimney | TCP Chimney Offload is no longer being developed. See [Performance Tuning Network Adapters](/windows-server/networking/technologies/network-subsystem/net-sub-performance-tuning-nics). | 1703 | |IPsec Task Offload| [IPsec Task Offload](/windows-hardware/drivers/network/task-offload) versions 1 and 2 are no longer being developed and should not be used. | 1703 | -|wusa.exe /uninstall /kb:####### /quiet|The wusa usage to quietly uninstall an update has been deprecated. The uninstall command with /quiet switch fails with event ID 8 in the Setup event log. Uninstalling updates quietly could be a security risk because malicious software could quietly uninstall an update in the background without user intervention.|1507
Applies to Windows Server 2016 and Windows Server 2019 as well.| \ No newline at end of file +|wusa.exe /uninstall /kb:####### /quiet|The wusa usage to quietly uninstall an update has been deprecated. The uninstall command with /quiet switch fails with event ID 8 in the Setup event log. Uninstalling updates quietly could be a security risk because malicious software could quietly uninstall an update in the background without user intervention.|1507
Applies to Windows Server 2016 and Windows Server 2019 as well.| diff --git a/windows/deployment/update/deployment-service-overview.md b/windows/deployment/update/deployment-service-overview.md index 4c034921b7..b7bccbb684 100644 --- a/windows/deployment/update/deployment-service-overview.md +++ b/windows/deployment/update/deployment-service-overview.md @@ -125,7 +125,7 @@ Deployment scheduling controls are always available, but to take advantage of th > Deployment protections are currently in preview and available if you're using Update Compliance. If you set these policies on a a device that isn't enrolled in Update Compliance, there is no effect. - Diagnostic data is set to *Required* or *Optional*. -- The **AllowWUfBCloudProcessing** policy is set to **1**. +- The **AllowWUfBCloudProcessing** policy is set to **8**. #### Set the **AllowWUfBCloudProcessing** policy @@ -148,8 +148,8 @@ Following is an example of setting the policy using Microsoft Endpoint Manager: - Name: **AllowWUfBCloudProcessing** - Description: Enter a description. - OMA-URI: `./Vendor/MSFT/Policy/Config/System/AllowWUfBCloudProcessing` - - Data type: **String** - - Value: **1** + - Data type: **Integer** + - Value: **8** 6. In **Assignments**, select the groups that will receive the profile, and then select **Next**. 7. In **Review + create**, review your settings, and then select **Create**. 8. (Optional) To verify that the policy reached the client, check the value of the following registry entry: **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager \\default\\System\\AllowWUfBCloudProcessing**. diff --git a/windows/deployment/update/feature-update-maintenance-window.md b/windows/deployment/update/feature-update-maintenance-window.md index e3accdee77..771a7648f8 100644 --- a/windows/deployment/update/feature-update-maintenance-window.md +++ b/windows/deployment/update/feature-update-maintenance-window.md @@ -53,7 +53,7 @@ Use **Peer Cache** to help manage deployment of content to clients in remote loc If you're deploying **Feature update to Windows 10, version 1709** or later, by default, portions of setup are configured to run at a lower priority. This can result in a longer total install time for the feature update. When deploying within a maintenance window, we recommend that you override this default behavior to benefit from faster total install times. To override the default priority, create a file called SetupConfig.ini on each machine to be upgraded in the below location containing the single section noted. -%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini +**%systemdrive%\Users\Default\AppData\Local\Microsoft\Windows\WSUS\SetupConfig.ini** ``` [SetupConfig] @@ -62,7 +62,7 @@ Priority=Normal You can use the new [Run Scripts](/sccm/apps/deploy-use/create-deploy-scripts) feature to run a PowerShell script like the sample below to create the SetupConfig.ini on target devices. -``` +```powershell #Parameters Param( [string] $PriorityValue = "Normal" @@ -91,6 +91,7 @@ foreach ($k in $iniSetupConfigKeyValuePair.Keys) #Write content to file New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force +<# Disclaimer Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without @@ -100,162 +101,164 @@ Microsoft, its authors, or anyone else involved in the creation, production, or for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script or documentation, even if Microsoft has been advised of the possibility of such damages. +#> ``` ->[!NOTE] ->If you elect not to override the default setup priority, you will need to increase the [maximum run time](/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. +> [!NOTE] +> If you elect not to override the default setup priority, you will need to increase the [maximum run time](/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. ## Manually deploy feature updates The following sections provide the steps to manually deploy a feature update. ### Step 1: Specify search criteria for feature updates -There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy. +There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy. -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. 3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: - - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. + - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, Required is greater than or equal to 1, and Language equals English. -4. Save the search for future use. +4. Save the search for future use. -### Step 2: Download the content for the feature update(s) -Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. +### Step 2: Download the content for the feature updates +Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. -1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. -2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download. +1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. +2. Choose the **feature update(s)** to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Download**. - The **Download Software Updates Wizard** opens. -3. On the **Deployment Package** page, configure the following settings: - **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: - - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. - - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. - - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. + The **Download Software Updates Wizard** opens. +3. On the **Deployment Package** page, configure the following settings: + **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: + - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. + - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. + - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. - >[!NOTE] - >The deployment package source location that you specify cannot be used by another software deployment package. + > [!NOTE] + > The deployment package source location that you specify cannot be used by another software deployment package. - >[!IMPORTANT] - >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. + > [!IMPORTANT] + > The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. - >[!IMPORTANT] - >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. + > [!IMPORTANT] + > You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. - Click **Next**. -4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). + Click **Next**. +4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). - >[!NOTE] - >The Distribution Points page is available only when you create a new software update deployment package. -5. On the **Distribution Settings** page, specify the following settings: + > [!NOTE] + > The Distribution Points page is available only when you create a new software update deployment package. +5. On the **Distribution Settings** page, specify the following settings: - - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. - - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios). - - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: - - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. + - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. + - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios). + - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: + - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. - - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. - - For more information about prestaging content to distribution points, see [Use Prestaged content](/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). - Click **Next**. -6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: + - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. + + For more information about prestaging content to distribution points, see [Use Prestaged content](/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). + Click **Next**. +6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting. - - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. - - >[!NOTE] - >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. + - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. - Click **Next**. -7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. -8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. -9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. + > [!NOTE] + > When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. + + Click **Next**. +7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. +8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. +9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. #### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. -3. Select the feature update package that you previously identified to download the feature updates. +1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +3. Select the feature update package that you previously identified to download the feature updates. 4. On the **Home** tab, in the Content group, click **View Status**. -### Step 3: Deploy the feature update(s) -After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). +### Step 3: Deploy the feature update(s) +After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. 3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. - The **Deploy Software Updates Wizard** opens. -4. On the General page, configure the following settings: - - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\** - - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default. - - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct. - - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time. - - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment. -5. On the Deployment Settings page, configure the following settings: + The **Deploy Software Updates Wizard** opens. +4. On the General page, configure the following settings: + - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\** + - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default. + - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct. + - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time. + - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment. +5. On the Deployment Settings page, configure the following settings: - - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline. - - >[!IMPORTANT] - > After you create the software update deployment, you cannot later change the type of deployment. - - >[!NOTE] - >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured. + - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline. - - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required. + > [!IMPORTANT] + > After you create the software update deployment, you cannot later change the type of deployment. - >[!WARNING] - >Before you can use this option, computers and networks must be configured for Wake On LAN. + > [!NOTE] + > A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured. - - **Detail level**: Specify the level of detail for the state messages that are reported by client computers. + - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required. + + > [!WARNING] + > Before you can use this option, computers and networks must be configured for Wake On LAN. + + - **Detail level**: Specify the level of detail for the state messages that are reported by client computers. 6. On the Scheduling page, configure the following settings: - - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. - - >[!NOTE] - >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time. + - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. - - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients: - - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation. - - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. - - >[!NOTE] - >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. + > [!NOTE] + > When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time. - - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links. + - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients: + - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation. + - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. - >[!NOTE] - >The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](/sccm/core/clients/deploy/about-client-settings#computer-agent). -7. On the User Experience page, configure the following settings: - - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**. - - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](/sccm/core/clients/manage/collections/use-maintenance-windows). - - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation. + > [!NOTE] + > You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. - >[!IMPORTANT] - >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. - - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device. + - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links. - >[!NOTE] - >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. - - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. -8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. + > [!NOTE] + > The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](/sccm/core/clients/deploy/about-client-settings#computer-agent). +7. On the User Experience page, configure the following settings: + - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**. + - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](/sccm/core/clients/manage/collections/use-maintenance-windows). + - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation. - >[!NOTE] - >You can review recent software updates alerts from the Software Updates node in the Software Library workspace. -9. On the Download Settings page, configure the following settings: - - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. - - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. - - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). + > [!IMPORTANT] + > Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. + - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device. + + > [!NOTE] + > When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. + - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. +8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. + + > [!NOTE] + > You can review recent software updates alerts from the Software Updates node in the Software Library workspace. +9. On the Download Settings page, configure the following settings: + - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. + - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. + - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. - - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. + - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. - >[!NOTE] - >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). + > [!NOTE] + > Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source priority](/mem/configmgr/core/plan-design/hierarchy/fundamental-concepts-for-content-management#content-source-priority). +10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. +11. Click **Next** to deploy the feature update(s). ### Step 4: Monitor the deployment status + After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: -1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. \ No newline at end of file +1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. +2. Click the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, click **View Status**. diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index 1ae3f99648..fc45328c40 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -18,6 +18,8 @@ ms.custom: seo-marvel-apr2020 > Applies to: Windows 10 +In Windows 10 version 21H2, non-Administrator user accounts can add both a display language and its corresponding language features. + As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it's important to note this policy only allows specifying one alternate location and behaves differently across OS versions. @@ -28,4 +30,4 @@ In Windows 10 version 1809 and beyond, changing the **Specify settings for optio For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS, Configuration Manager, or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. -Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](/windows/client-management/). \ No newline at end of file +Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](/windows/client-management/). diff --git a/windows/deployment/update/media-dynamic-update.md b/windows/deployment/update/media-dynamic-update.md index 34ef7cc00f..2664d3f9d8 100644 --- a/windows/deployment/update/media-dynamic-update.md +++ b/windows/deployment/update/media-dynamic-update.md @@ -84,6 +84,9 @@ This table shows the correct sequence for applying the various tasks to the file > [!NOTE] > Starting in February 2021, the latest cumulative update and servicing stack update will be combined and distributed in the Microsoft Update Catalog as a new combined cumulative update. For Steps 1, 9, and 18 that require the servicing stack update for updating the installation media, you should use the combined cumulative update. For more information on the combined cumulative update, see [Servicing stack updates](./servicing-stack-updates.md). +> [!NOTE] +> Microsoft will remove the Flash component from Windows through KB4577586, “Update for Removal of Adobe Flash Player”. You can also remove Flash anytime by deploying the update in KB4577586 (available on the Catalog) between steps 20 and 21. As of July 2021, KB4577586, “Update for Removal of Adobe Flash Player” will be included in the latest cumulative update for Windows 10, versions 1607 and 1507. The update will also be included in the Monthly Rollup and the Security Only Update for Windows 8.1, Windows Server 2012, and Windows Embedded 8 Standard. For more information, see [Update on Adobe Flash Player End of Support](https://blogs.windows.com/msedgedev/2020/09/04/update-adobe-flash-end-support/). + ### Multiple Windows editions The main operating system file (install.wim) contains multiple editions of Windows 10. It’s possible that only an update for a given edition is required to deploy it, based on the index. Or, it might be that all editions need an update. Further, ensure that languages are installed before Features on Demand, and the latest cumulative update is always applied last. @@ -456,4 +459,4 @@ Dismount-DiskImage -ImagePath $LP_ISO_PATH -ErrorAction stop | Out-Null Dismount-DiskImage -ImagePath $FOD_ISO_PATH -ErrorAction stop | Out-Null Write-Output "$(Get-TS): Media refresh completed!" -``` \ No newline at end of file +``` diff --git a/windows/deployment/update/update-baseline.md b/windows/deployment/update/update-baseline.md index 4438c95e54..2e4ab4fd64 100644 --- a/windows/deployment/update/update-baseline.md +++ b/windows/deployment/update/update-baseline.md @@ -40,8 +40,7 @@ For the complete detailed list of all settings and their values, see the MSFT Wi ## How do I get started? -The Update Baseline toolkit makes it easy by providing a single command for IT Admins to load the baseline settings into Group Policy Management Console. You can get the [Update Baseline toolkit](https://www.microsoft.com/download/details.aspx?id=101056) from the Download Center. +The Update Baseline toolkit makes it easy by providing a single command for IT Admins to load the baseline settings into Group Policy Management Console. You can get the [Update Baseline toolkit](https://www.microsoft.com/download/details.aspx?id=55319) (included as a part of the Security Compliance Toolkit) from the Download Center. Today, the Update Baseline toolkit is currently only available for use with Group Policy. - diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index ccdb293504..10b6032442 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -41,16 +41,13 @@ Update Compliance has a number of policies that must be appropriately configured Each MDM Policy links to its documentation in the CSP hierarchy, providing its exact location in the hierarchy and more details. -| Policy | Value | Function | -|---------------------------|-|------------------------------------------------------------| -|**Provider/*ProviderID*/**[**CommercialID**](/windows/client-management/mdm/dmclient-csp#provider-providerid-commercialid) |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) |Identifies the device as belonging to your organization. | -|**System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | 1- Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. | -|**System/**[**ConfigureTelemetryOptInSettingsUx**](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) | 1 - Disable Telemetry opt-in Settings | (in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. | -|**System/**[**AllowDeviceNameInDiagnosticData**](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | -| **System/AllowUpdateComplianceProcessing** | 16 - Allowed | Enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. | - -> [!NOTE] -> If you use Microsoft Intune, set the **ProviderID** to *MS DM Server*. If you use another MDM product, check with its vendor. See also [DMClient CSP](/windows/client-management/mdm/dmclient-csp). +| Policy | Data type | Value | Function | +|--------------------------|-|-|------------------------------------------------------------| +|**Provider/*ProviderID*/**[**CommercialID**](/windows/client-management/mdm/dmclient-csp#provider-providerid-commercialid) |String |[Your CommercialID](update-compliance-get-started.md#get-your-commercialid) |Identifies the device as belonging to your organization. | +|**System/**[**AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) |Integer | 1 - Basic |Configures the maximum allowed diagnostic data to be sent to Microsoft. Individual users can still set this value lower than what the policy defines. For more information, see the following policy. | +|**System/**[**ConfigureTelemetryOptInSettingsUx**](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux) |Integer |1 - Disable Telemetry opt-in Settings | (in Windows 10, version 1803 and later) Determines whether users of the device can adjust diagnostic data to levels lower than the level defined by AllowTelemetry. We recommend that you disable this policy or the effective diagnostic data level on devices might not be sufficient. | +|**System/**[**AllowDeviceNameInDiagnosticData**](/windows/client-management/mdm/policy-csp-system#system-allowdevicenameindiagnosticdata) |Integer | 1 - Allowed | Allows device name to be sent for Windows Diagnostic Data. If this policy is Not Configured or set to 0 (Disabled), Device Name will not be sent and will not be visible in Update Compliance, showing `#` instead. | +| **System/AllowUpdateComplianceProcessing** |Integer | 16 - Allowed | Enables data flow through Update Compliance's data processing system and indicates a device's explicit enrollment to the service. | ### Group policies @@ -89,6 +86,6 @@ Census is a service that runs on a regular schedule on Windows devices. A number A full Census sync adds a new registry value to Census's path. When this registry value is added, Census's configuration is overridden to force a full sync. For Census to work normally, this registry value should be enabled, Census should be started manually, and then the registry value should be disabled. Follow these steps: -1. For every device you are manually configuring for Update Compliance, add or modify the registry key located at **HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Census** to include a new **DWORD value** named **FullSync** and set to **1**. +1. For every device you are manually configuring for Update Compliance and do not plan to use the [Update Compliance Configuration Script](update-compliance-configuration-script.md), add or modify the registry key located at **HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Census** to include a new **DWORD value** named **FullSync** and set to **1**. 2. Run Devicecensus.exe with administrator privileges on every device. Devicecensus.exe is in the System32 folder. No additional run parameters are required. 3. After Devicecensus.exe has run, the **FullSync** registry value can be removed or set to **0**. diff --git a/windows/deployment/update/update-compliance-configuration-mem.md b/windows/deployment/update/update-compliance-configuration-mem.md new file mode 100644 index 0000000000..01de3567bf --- /dev/null +++ b/windows/deployment/update/update-compliance-configuration-mem.md @@ -0,0 +1,77 @@ +--- +title: Configuring Microsoft Endpoint Manager devices for Update Compliance +ms.reviewer: +manager: laurawi +description: Configuring devices that are enrolled in Endpoint Manager for Update Compliance +keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav, intune, mem +ms.prod: w10 +ms.mktglfcycl: deploy +ms.pagetype: deploy +audience: itpro +author: jaimeo +ms.author: jaimeo +ms.localizationpriority: medium +ms.collection: M365-analytics +ms.topic: article +--- + +# Configuring Microsoft Endpoint Manager devices for Update Compliance + +> [!NOTE] +> As of May 10, 2021, a new policy is required to use Update Compliance: "Allow Update Compliance Processing." For more details, see the Mobile Device Management policies and Group policies tables. + +This article is specifically targeted at configuring devices enrolled to [Microsoft Endpoint Manager](/mem/endpoint-manager-overview) for Update Compliance, within MEM itself. Configuring devices for Update Compliance in MEM breaks down to the following steps: + +1. [Create a configuration profile](#create-a-configuration-profile) for devices you want to enroll, that contains settings for all the MDM policies that must be configured. +2. [Deploy the configuration script](#deploy-the-configuration-script) as a Win32 app to those same devices, so additional checks can be performed to ensure devices are correctly configured. +3. Wait for data to populate. The length of this process depends on the computer being on, connected to the internet, and correctly configured. Some data types take longer to appear than others. You can learn more about this in the broad section on [enrolling devices to Update Compliance](update-compliance-get-started.md#enroll-devices-in-update-compliance). + +## Create a configuration profile + +Take the following steps to create a configuration profile that will set required policies for Update Compliance: + +1. Go to the Admin portal in Endpoint Manager and navigate to **Devices/Windows/Configuration profiles**. +2. On the **Configuration profiles** view, select **Create a profile**. +3. Select **Platform**="Windows 10 and later" and **Profile type**="Templates". +4. For **Template name**, select **Custom**, and then press **Create**. +5. You are now on the Configuration profile creation screen. On the **Basics** tab, give a **Name** and **Description**. +6. On the **Configuration settings** page, you will be adding multiple OMA-URI Settings that correspond to the policies described in [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md). + 1. If you don't already have it, get your Commercial ID. For steps, see [Get your CommmercialID](update-compliance-get-started.md#get-your-commercialid). + 2. Add a setting for **Commercial ID** ) with the following values: + - **Name**: Commercial ID + - **Description**: Sets the Commercial ID that corresponds to the Update Compliance Log Analytics workspace. + - **OMA-URI**: `./Vendor/MSFT/DMClient/Provider/ProviderID/CommercialID` + - **Data type**: String + - **Value**: *Set this to your Commercial ID* + 2. Add a setting configuring the **Windows Diagnostic Data level** for devices: + - **Name**: Allow Telemetry + - **Description**: Sets the maximum allowed diagnostic data to be sent to Microsoft, required for Update Compliance. + - **OMA-URI**: `./Vendor/MSFT/Policy/Config/System/AllowTelemetry` + - **Data type**: Integer + - **Value**: 1 (*all that is required is 1, but it can be safely set to a higher value*). + 3. (*Recommended, but not required*) Add a setting for **disabling devices' Diagnostic Data opt-in settings interface**. If this is not disabled, users of each device can potentially override the diagnostic data level of devices such that data will not be available for those devices in Update Compliance: + - **Name**: Disable Telemetry opt-in interface + - **Description**: Disables the ability for end-users of devices can adjust diagnostic data to levels lower than defined by the Allow Telemetry setting. + - **OMA-URI**: `./Vendor/MSFT/Policy/Config/System/ConfigureTelemetryOptInSettingsUx` + - **Data type**: Integer + - **Value**: 1 + 4. Add a setting to **Allow device name in diagnostic data**; otherwise, there will be no device name in Update Compliance: + - **Name**: Allow device name in Diagnostic Data + - **Description**: Allows device name in Diagnostic Data. + - **OMA-URI**: `./Vendor/MSFT/Policy/Config/System/AllowDeviceNameInDiagnosticData` + - **Data type**: Integer + - **Value**: 1 + 5. Add a setting to **Allow Update Compliance processing**; this policy is required for Update Compliance: + - **Name**: Allow Update Compliance Processing + - **Description**: Opts device data into Update Compliance processing. Required to see data. + - **OMA-URI**: `./Vendor/MSFT/Policy/Config/System/AllowUpdateComplianceProcessing` + - **Data type**: Integer + - **Value**: 16 +7. Proceed through the next set of tabs **Scope tags**, **Assignments**, and **Applicability Rules** to assign the configuration profile to devices you wish to enroll. +8. Review and select **Create**. + +## Deploy the configuration script + +The [Update Compliance Configuration Script](update-compliance-configuration-script.md) is an important component of properly enrolling devices in Update Compliance, though it isn't strictly necessary. It checks to ensure that devices have the required services running and checks connectivity to the endpoints detailed in the section on [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md). You can deploy the script as a Win32 app. For more information, see [Win32 app management in Microsoft Intune](/mem/intune/apps/apps-win32-app-management). + +When you deploy the configuration script as a Win32 app, you won't be able to retrieve the results of logs on the device without having access to the device, or saving results of the logs to a shared filesystem. We recommend deploying the script in Pilot mode to a set of devices that you do have access to, or have a way to access the resultant log output the script provides, with as similar of a configuration profile as other devices which will be enrolled to Update Compliance, and analyzing the logs for any potential issues. Following this, you can deploy the configuration script in Deployment mode as a Win32 app to all Update Compliance devices. diff --git a/windows/deployment/update/update-compliance-configuration-script.md b/windows/deployment/update/update-compliance-configuration-script.md index 2bdf88323c..085bf545d6 100644 --- a/windows/deployment/update/update-compliance-configuration-script.md +++ b/windows/deployment/update/update-compliance-configuration-script.md @@ -18,22 +18,15 @@ ms.topic: article # Configuring devices through the Update Compliance Configuration Script > [!NOTE] -> A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing." If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must rerun the script so the new policy can be configured. We don't recommend using this script if you configure devices using MDM. Instead, configure the policies listed in [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md) by using your MDM provider. You should check devices to ensure that there aren't any policy configurations in any existing tool that conflict with how policies should be configured. +> A new policy is required to use Update Compliance: "AllowUpdateComplianceProcessing." If you're already using Update Compliance and have configured your devices prior to May 10, 2021, you must rerun the script so the new policy can be configured. -The Update Compliance Configuration Script is the recommended method of configuring devices to send data to Microsoft for use with Update Compliance. The script configures the registry keys backing policies, ensures required services are running, and more. +The Update Compliance Configuration Script is the recommended method of configuring devices to send data to Microsoft for use with Update Compliance. The script configures the registry keys backing policies, ensures required services are running, and more. This script is a recommended complement to configuring the required policies documented in [Manually configured devices for Update Compliance](update-compliance-configuration-manual.md), as it can provide feedback on whether there are any configuration issues outside of policies being configured. > [!NOTE] -> The configuration script configures registry keys directly. Registry keys can potentially be overwritten by policy settings like Group Policy or MDM. *Reconfiguring devices with the script does not reconfigure previously set policies, both in the case of Group Policy and MDM*. If there are conflicts between your Group Policy or MDM configurations and the required configurations listed in [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md), there can be issues with device enrollment. +> The configuration script configures registry keys directly. Registry keys can potentially be overwritten by policy settings like Group Policy or MDM. *Reconfiguring devices with the script does not reconfigure previously set policies, both in the case of Group Policy and MDM*. If there are conflicts between your Group Policy or MDM configurations and the required configurations listed in [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md), device data might not appear in Update Compliance correctly. You can download the script from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=101086). Keep reading to learn how to configure the script and interpret error codes that are output in logs for troubleshooting. -## Script FAQ - -- I manage my devices with MDM. Should I use this script? -No, you should not use this script. Instead configure the policies through your MDM provider. -- Does this script configure devices for Delivery Optimization? -No. You must do that separately. - ## How this script is organized This script's two primary files are `ConfigScript.ps1` and `RunConfig.bat`. You configure `RunConfig.bat` according to the directions in the `.bat` itself, which will then run `ConfigScript.ps1` with the parameters entered to `RunConfig.bat`. There are two ways of using the script: in **Pilot** mode or **Deployment** mode. diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index a224816f2b..f1c18585dd 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -26,7 +26,7 @@ This topic introduces the high-level steps required to enroll to the Update Comp 2. [Add Update Compliance](#add-update-compliance-to-your-azure-subscription) to your Azure subscription. 3. [Configure devices](#enroll-devices-in-update-compliance) to send data to Update Compliance. -After adding the solution to Azure and configuring devices, it could take up to 72 hours before you can begin to see devices in the solution. Before or as devices appear, you can learn how to [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and Delivery Optimization. +After adding the solution to Azure and configuring devices, it can take some time before all devices appear. For more information, see the [enrollment section](#enroll-devices-in-update-compliance). Before or as devices appear, you can learn how to [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and Delivery Optimization. ## Update Compliance prerequisites @@ -100,10 +100,11 @@ To find your CommercialID within Azure: ## Enroll devices in Update Compliance -Once you've added Update Compliance to a workspace in your Azure subscription, you'll need to configure any devices you want to monitor. There are two ways to configure devices to use Update Compliance: +Once you've added Update Compliance to a workspace in your Azure subscription, you'll need to configure any devices you want to monitor. There are a few steps to follow when enrolling devices to Update Compliance: -- If you use Group Policy to manage device policies, use the [Update Compliance Configuration Script](update-compliance-configuration-script.md). -- If you manage devices through MDM providers like Intune, [manually configure device for Update Compliance](update-compliance-configuration-manual.md). +1. Check the policies, services, and other device enrollment requirements in [Manually configuring devices for Update Compliance](update-compliance-configuration-manual.md). +2. If you use [Microsoft Endpoint Manager](/mem/endpoint-manager-overview), you can follow the enrollment process documented at [Configuring devices for Update Compliance in Microsoft Endpoint Manager](update-compliance-configuration-mem.md). +3. Finally, you should run the [Update Compliance Configuration Script](update-compliance-configuration-script.md) on all devices to ensure they are appropriately configured and troubleshoot any enrollment issues. After you configure devices, diagnostic data they send will begin to be associated with your Azure AD organization ("tenant"). However, enrolling to Update Compliance doesn't influence the rate at which required data is uploaded from devices. Device connectivity to the internet and generally how active the device is highly influences how long it will take before the device appears in Update Compliance. Devices that are active and connected to the internet daily can expect to be fully uploaded within one week (usually less than 72 hours). Devices that are less active can take up to two weeks before data is fully available. diff --git a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md index 2876fbd034..d07348165d 100644 --- a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md +++ b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md @@ -32,7 +32,7 @@ This article describes how system administrators can upgrade eligible Windows Ph The Windows Phone 8.1 to Windows 10 Mobile upgrade uses an "opt-in" or "seeker" model. To determine if the device is eligible for an upgrade with MDM, see the [How to determine whether an upgrade is available for a device](#howto-upgrade-available) topic in this article. An eligible device must opt-in to be offered the upgrade. For consumers, the Windows 10 Mobile Upgrade Advisor app is available from the Windows Store to perform the opt-in. For Enterprises, Microsoft is offering a centralized management solution through MDM that can push a management policy to each eligible device to perform the opt-in. -If you use a list of allowed applications (app allow listing) with MDM, verify that system applications are allow-listed before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whitelist) with app allow-lists that could adversely affect the device after you upgrade. +If you use a list of allowed applications (app allow listing) with MDM, verify that system applications are allow-listed before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management) with app allow-lists that could adversely affect the device after you upgrade. Some enterprises might want to control the availability of the Windows 10 Mobile upgrade to their users. With the opt-in model, the enterprise can block the Upgrade Advisor app to prevent their users from upgrading prematurely. For more information about how to restrict the Upgrade Advisor app, see the [How to restrict the Upgrade Advisor app](#howto-restrict) section in this article. Enterprises that have restricted the Upgrade Advisor app can use the solution described in this article to select the upgrade timing on a per-device basis. diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 71af1da585..1454fe92ed 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -26,9 +26,13 @@ With Windows 10, you can quickly upgrade from one edition of Windows 10 to ano For a list of operating systems that qualify for the Windows 10 Pro Upgrade or Windows 10 Enterprise Upgrade through Microsoft Volume Licensing, see [Windows 10 Qualifying Operating Systems](https://download.microsoft.com/download/2/d/1/2d14fe17-66c2-4d4c-af73-e122930b60f6/Windows10-QOS.pdf). -The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607. +The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. -Note: Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. +> [!NOTE] +> The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607. + +> [!TIP] +> Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. ![not supported](../images/x_blk.png) (X) = not supported
![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
@@ -39,7 +43,7 @@ X = unsupported
✔ (green) = supported; reboot required
✔ (blue) = supported; no reboot required -|Method |Home > Pro |Home > Education |Pro > Education |Pro > Enterprise |Ent > Education |Mobile > Mobile Enterprise | +|Method |Home > Pro |Home > Education |Pro > Education |Pro > Enterprise |Ent > Education |Mobile | |-------|-----------|-----------------|----------------|-----------------|----------------|--------| | Using mobile device management (MDM) |![unsupported](../images/x_blk.png) |![supported](../images/check_grn.png) |![supported](../images/check_grn.png) |![supported](../images/check_blu.png) |![supported](../images/check_grn.png) |![supported](../images/check_blu.png) | | Using a provisioning package |![unsupported](../images/x_blk.png) |![supported](../images/check_grn.png) |![supported](../images/check_grn.png) |![supported](../images/check_grn.png) |![supported](../images/check_grn.png) |![supported](../images/check_blu.png) | @@ -63,7 +67,6 @@ X = unsupported
| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | | **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | | **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Mobile > Mobile Enterprise** | ![supported, no reboot](../images/check_blu.png) |![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | > [!NOTE] > - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md) @@ -84,7 +87,7 @@ Use Windows Configuration Designer to create a provisioning package to upgrade a - To create a provisioning package for upgrading mobile editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithLicense** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. For more info about Windows Configuration Designer, see these topics: -- [Create a provisioining package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package) +- [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package) - [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) @@ -122,7 +125,8 @@ If you do not have a product key, you can upgrade your edition of Windows 10 th 3. Follow the on-screen instructions. - **Note**
If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/). + > [!NOTE] + > If you are a Windows 10 Home N or Windows 10 Home KN user and have trouble finding your applicable upgrade in the Microsoft Store, click [here](ms-windows-store://windowsupgrade/). ## License expiration @@ -130,7 +134,8 @@ Volume license customers whose license has expired will need to change the editi Downgrading from any edition of Windows 10 to Windows 7, 8, or 8.1 by entering a different product key is not supported. You also cannot downgrade from a later version to an earlier version of the same edition (Ex: Windows 10 Pro 1709 to 1703) unless the rollback process is used. This topic does not discuss version downgrades. -Note: If you are using [Windows 10 Enterprise Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation) and a license expires, devices will automatically revert to the original edition when the grace period expires. +> [!NOTE] +> If you are using [Windows 10 Enterprise Subscription Activation](/windows/deployment/windows-10-enterprise-subscription-activation) and a license expires, devices will automatically revert to the original edition when the grace period expires. ### Scenario example @@ -150,21 +155,21 @@ You can move directly from Enterprise to any valid destination edition. In this
- + - - - - - - - - - + + + + + + + + + - + diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index 57994ce79b..b0a3dcf6d5 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -43,17 +43,17 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
Destination editionDestination edition
      HomeProPro for WorkstationsPro EducationEducationEnterprise LTSCEnterprise       HomeProPro for WorkstationsPro EducationEducationEnterprise LTSCEnterprise
Starting editionStarting edition
Home
- - - - - - - - + + + + + + + + - + @@ -116,7 +116,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - + @@ -209,7 +209,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - + @@ -261,17 +261,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - - - - - - - - - -
      Windows 10 HomeWindows 10 ProWindows 10 Pro EducationWindows 10 EducationWindows 10 EnterpriseWindows 10 MobileWindows 10 Mobile Enterprise Windows 10 HomeWindows 10 ProWindows 10 Pro EducationWindows 10 EducationWindows 10 EnterpriseWindows 10 MobileWindows 10 Mobile Enterprise
Windows 7Windows 7
Starter
Windows 8.1Windows 8.1
(Core)✔
Windows 10Windows 10
Home ✔
Mobile EnterpriseD
+ ## Related Topics diff --git a/windows/hub/TOC.yml b/windows/hub/TOC.yml index 2d99b5fb17..a199923b84 100644 --- a/windows/hub/TOC.yml +++ b/windows/hub/TOC.yml @@ -1,8 +1,13 @@ -- name: Windows 10 +- name: Windows href: index.yml items: - name: What's new - href: /windows/whats-new + expanded: true + items: + - name: What's new in Windows + href: /windows/whats-new + - name: Windows 11 + href: /windows/whats-new/windows-11 - name: Release information href: /windows/release-health - name: Deployment diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 2714aec10e..f61c3a9861 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -1,11 +1,11 @@ ### YamlMime:Landing -title: Windows 10 resources and documentation for IT Pros # < 60 chars -summary: Plan, deploy, secure, and manage devices running Windows 10. # < 160 chars +title: Windows client resources and documentation for IT Pros # < 60 chars +summary: Plan, deploy, secure, and manage devices running Windows 10 and Windows 11. # < 160 chars metadata: - title: Windows 10 documentation for IT Pros # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Evaluate, plan, deploy, secure and manage devices running Windows 10. # Required; article description that is displayed in search results. < 160 chars. + title: Windows client documentation for IT Pros # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Evaluate, plan, deploy, secure, and manage devices running Windows 10 and Windows 11. # Required; article description that is displayed in search results. < 160 chars. services: windows-10 ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. ms.subservice: subservice @@ -13,7 +13,7 @@ metadata: ms.collection: windows-10 author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - ms.date: 10/20/2020 #Required; mm/dd/yyyy format. + ms.date: 06/01/2020 #Required; mm/dd/yyyy format. localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -26,13 +26,17 @@ landingContent: linkLists: - linkListType: overview links: + - text: Windows 11 overview + url: /windows/whats-new/windows-11 + - text: Windows 11 requirements + url: /windows/whats-new/windows-11-requirements + - text: Plan for Windows 11 + url: /windows/whats-new/windows-11-plan + - text: Prepare for Windows 11 + url: /windows/whats-new/windows-11-prepare - text: What's new in Windows 10, version 21H1 url: /windows/whats-new/whats-new-windows-10-version-21H1 - - text: What's new in Windows 10, version 20H2 - url: /windows/whats-new/whats-new-windows-10-version-20H2 - - text: What's new in Windows 10, version 2004 - url: /windows/whats-new/whats-new-windows-10-version-2004 - - text: Windows 10 release information + - text: Windows release information url: /windows/release-health/release-information # Card (optional) @@ -40,7 +44,7 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Configure Windows 10 + - text: Configure Windows url: /windows/configuration/index - text: Accessibility information for IT Pros url: /windows/configuration/windows-10-accessibility-for-itpros @@ -54,13 +58,13 @@ landingContent: linkLists: - linkListType: deploy links: - - text: Deploy and update Windows 10 + - text: Deploy and update Windows url: /windows/deployment/index - - text: Windows 10 deployment scenarios + - text: Windows deployment scenarios url: /windows/deployment/windows-10-deployment-scenarios - text: Create a deployment plan url: /windows/deployment/update/create-deployment-plan - - text: Prepare to deploy Windows 10 + - text: Prepare to deploy Windows client url: /windows/deployment/update/prepare-deploy-windows @@ -69,7 +73,7 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Windows 10 application management + - text: Windows application management url: /windows/application-management/index - text: Understand the different apps included in Windows 10 url: /windows/application-management/apps-in-windows-10 @@ -83,9 +87,9 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Windows 10 client management + - text: Windows client management url: /windows/client-management/index - - text: Administrative tools in Windows 10 + - text: Administrative tools url: /windows/client-management/administrative-tools-in-windows-10 - text: Create mandatory user profiles url: /windows/client-management/mandatory-user-profile @@ -97,7 +101,7 @@ landingContent: linkLists: - linkListType: how-to-guide links: - - text: Windows 10 Enterprise Security + - text: Windows Enterprise Security url: /windows/security/index - text: Windows Privacy url: /windows/privacy/index diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 7f1681e846..23b3637f84 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -276,11 +276,6 @@ The following fields are available: - **DatasourceApplicationFile_20H1Setup** The total number of objects of this type present on this device. - **DatasourceApplicationFile_21H1** The total number of objects of this type present on this device. - **DatasourceApplicationFile_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_21H2** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_CO21H2** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device. - **DatasourceApplicationFile_RS2** The total number of objects of this type present on this device. - **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. @@ -294,11 +289,6 @@ The following fields are available: - **DatasourceDevicePnp_20H1Setup** The total number of objects of this type present on this device. - **DatasourceDevicePnp_21H1** The total number of objects of this type present on this device. - **DatasourceDevicePnp_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_21H2** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_CO21H2** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device. - **DatasourceDevicePnp_RS2** The total number of objects of this type present on this device. - **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. @@ -315,11 +305,6 @@ The following fields are available: - **DatasourceDriverPackage_20H1Setup** The total number of objects of this type present on this device. - **DatasourceDriverPackage_21H1** The total number of objects of this type present on this device. - **DatasourceDriverPackage_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_21H2** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_CO21H2** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device. - **DatasourceDriverPackage_RS2** The total number of objects of this type present on this device. - **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. @@ -336,11 +321,6 @@ The following fields are available: - **DataSourceMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_21H1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_CO21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_RS2** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. @@ -354,11 +334,6 @@ The following fields are available: - **DataSourceMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_21H1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_CO21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_RS2** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. @@ -372,11 +347,6 @@ The following fields are available: - **DataSourceMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_CO21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. @@ -391,11 +361,6 @@ The following fields are available: - **DatasourceSystemBios_20H1Setup** The total number of objects of this type present on this device. - **DatasourceSystemBios_21H1** The total number of objects of this type present on this device. - **DatasourceSystemBios_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceSystemBios_21H2** The total number of objects of this type present on this device. -- **DatasourceSystemBios_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceSystemBios_CO21H2** The total number of objects of this type present on this device. -- **DatasourceSystemBios_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceSystemBios_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceSystemBios_RS1** The total number of objects of this type present on this device. - **DatasourceSystemBios_RS2** The total number of objects of this type present on this device. - **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. @@ -412,11 +377,6 @@ The following fields are available: - **DecisionApplicationFile_20H1Setup** The total number of objects of this type present on this device. - **DecisionApplicationFile_21H1** The total number of objects of this type present on this device. - **DecisionApplicationFile_21H1Setup** The total number of objects of this type present on this device. -- **DecisionApplicationFile_21H2** The total number of objects of this type present on this device. -- **DecisionApplicationFile_21H2Setup** The total number of objects of this type present on this device. -- **DecisionApplicationFile_CO21H2** The total number of objects of this type present on this device. -- **DecisionApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionApplicationFile_RS1** The total number of objects of this type present on this device. - **DecisionApplicationFile_RS2** The total number of objects of this type present on this device. - **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. @@ -430,11 +390,6 @@ The following fields are available: - **DecisionDevicePnp_20H1Setup** The total number of objects of this type present on this device. - **DecisionDevicePnp_21H1** The total number of objects of this type present on this device. - **DecisionDevicePnp_21H1Setup** The total number of objects of this type present on this device. -- **DecisionDevicePnp_21H2** The total number of objects of this type present on this device. -- **DecisionDevicePnp_21H2Setup** The total number of objects of this type present on this device. -- **DecisionDevicePnp_CO21H2** The total number of objects of this type present on this device. -- **DecisionDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionDevicePnp_RS1** The total number of objects of this type present on this device. - **DecisionDevicePnp_RS2** The total number of objects of this type present on this device. - **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. @@ -451,11 +406,6 @@ The following fields are available: - **DecisionDriverPackage_20H1Setup** The total number of objects of this type present on this device. - **DecisionDriverPackage_21H1** The total number of objects of this type present on this device. - **DecisionDriverPackage_21H1Setup** The total number of objects of this type present on this device. -- **DecisionDriverPackage_21H2** The total number of objects of this type present on this device. -- **DecisionDriverPackage_21H2Setup** The total number of objects of this type present on this device. -- **DecisionDriverPackage_CO21H2** The total number of objects of this type present on this device. -- **DecisionDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionDriverPackage_RS1** The total number of objects of this type present on this device. - **DecisionDriverPackage_RS2** The total number of objects of this type present on this device. - **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. @@ -472,11 +422,6 @@ The following fields are available: - **DecisionMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_21H1** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_CO21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_RS2** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. @@ -490,11 +435,6 @@ The following fields are available: - **DecisionMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_21H1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_CO21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_RS2** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. @@ -508,11 +448,6 @@ The following fields are available: - **DecisionMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_CO21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. @@ -526,11 +461,6 @@ The following fields are available: - **DecisionMediaCenter_20H1Setup** The total number of objects of this type present on this device. - **DecisionMediaCenter_21H1** The total number of objects of this type present on this device. - **DecisionMediaCenter_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMediaCenter_21H2** The total number of objects of this type present on this device. -- **DecisionMediaCenter_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMediaCenter_CO21H2** The total number of objects of this type present on this device. -- **DecisionMediaCenter_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMediaCenter_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMediaCenter_RS1** The total number of objects of this type present on this device. - **DecisionMediaCenter_RS2** The total number of objects of this type present on this device. - **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. @@ -540,11 +470,6 @@ The following fields are available: - **DecisionMediaCenter_TH2** The total number of objects of this type present on this device. - **DecisionSModeState_20H1** The total number of objects of this type present on this device. - **DecisionSModeState_21H1** The total number of objects of this type present on this device. -- **DecisionSModeState_21H2** The total number of objects of this type present on this device. -- **DecisionSModeState_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSModeState_CO21H2** The total number of objects of this type present on this device. -- **DecisionSModeState_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSModeState_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_19ASetup** The total number of objects of this type present on this device. - **DecisionSystemBios_19H1** The total number of objects of this type present on this device. - **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device. @@ -552,11 +477,6 @@ The following fields are available: - **DecisionSystemBios_20H1Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_21H1** The total number of objects of this type present on this device. - **DecisionSystemBios_21H1Setup** The total number of objects of this type present on this device. -- **DecisionSystemBios_21H2** The total number of objects of this type present on this device. -- **DecisionSystemBios_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemBios_CO21H2** The total number of objects of this type present on this device. -- **DecisionSystemBios_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemBios_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_RS1** The total number of objects of this type present on this device. - **DecisionSystemBios_RS2** The total number of objects of this type present on this device. - **DecisionSystemBios_RS3** The total number of objects of this type present on this device. @@ -569,49 +489,20 @@ The following fields are available: - **DecisionSystemBios_TH2** The total number of objects of this type present on this device. - **DecisionSystemDiskSize_20H1** The total number of objects of this type present on this device. - **DecisionSystemDiskSize_21H1** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_21H2** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_CO21H2** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemMemory_20H1** The total number of objects of this type present on this device. - **DecisionSystemMemory_21H1** The total number of objects of this type present on this device. -- **DecisionSystemMemory_21H2** The total number of objects of this type present on this device. -- **DecisionSystemMemory_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemMemory_CO21H2** The total number of objects of this type present on this device. -- **DecisionSystemMemory_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemMemory_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemProcessor_RS2** The total number of objects of this type present on this device. - **DecisionSystemProcessorCpuCores_20H1** The total number of objects of this type present on this device. - **DecisionSystemProcessorCpuCores_21H1** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_21H2** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_CO21H2** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemProcessorCpuModel_20H1** The total number of objects of this type present on this device. - **DecisionSystemProcessorCpuModel_21H1** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuModel_21H2** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuModel_CO21H2** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuModel_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuModel_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemProcessorCpuSpeed_20H1** The total number of objects of this type present on this device. - **DecisionSystemProcessorCpuSpeed_21H1** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_21H2** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_CO21H2** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionTest_19H1** The total number of objects of this type present on this device. - **DecisionTest_20H1** The total number of objects of this type present on this device. - **DecisionTest_20H1Setup** The total number of objects of this type present on this device. - **DecisionTest_21H1** The total number of objects of this type present on this device. - **DecisionTest_21H1Setup** The total number of objects of this type present on this device. -- **DecisionTest_21H2** The total number of objects of this type present on this device. -- **DecisionTest_21H2Setup** The total number of objects of this type present on this device. -- **DecisionTest_CO21H2** The total number of objects of this type present on this device. -- **DecisionTest_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionTest_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionTest_RS1** The total number of objects of this type present on this device. - **DecisionTest_RS2** The total number of objects of this type present on this device. - **DecisionTest_RS3** The total number of objects of this type present on this device. @@ -621,18 +512,8 @@ The following fields are available: - **DecisionTest_TH2** The total number of objects of this type present on this device. - **DecisionTpmVersion_20H1** The total number of objects of this type present on this device. - **DecisionTpmVersion_21H1** The total number of objects of this type present on this device. -- **DecisionTpmVersion_21H2** The total number of objects of this type present on this device. -- **DecisionTpmVersion_21H2Setup** The total number of objects of this type present on this device. -- **DecisionTpmVersion_CO21H2** The total number of objects of this type present on this device. -- **DecisionTpmVersion_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionTpmVersion_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionUefiSecureBoot_20H1** The total number of objects of this type present on this device. - **DecisionUefiSecureBoot_21H1** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_21H2** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_21H2Setup** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_CO21H2** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_CU22H2Setup** The total number of objects of this type present on this device. - **InventoryApplicationFile** The total number of objects of this type present on this device. - **InventoryDeviceContainer** The total number of objects of this type present on this device. - **InventoryDevicePnp** The total number of objects of this type present on this device. @@ -662,11 +543,6 @@ The following fields are available: - **Wmdrm_20H1Setup** The total number of objects of this type present on this device. - **Wmdrm_21H1** The total number of objects of this type present on this device. - **Wmdrm_21H1Setup** The total number of objects of this type present on this device. -- **Wmdrm_21H2** The total number of objects of this type present on this device. -- **Wmdrm_21H2Setup** The total number of objects of this type present on this device. -- **Wmdrm_CO21H2** The total number of objects of this type present on this device. -- **Wmdrm_CO21H2Setup** The total number of objects of this type present on this device. -- **Wmdrm_CU22H2Setup** The total number of objects of this type present on this device. - **Wmdrm_RS1** The total number of objects of this type present on this device. - **Wmdrm_RS2** The total number of objects of this type present on this device. - **Wmdrm_RS3** The total number of objects of this type present on this device. diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 692cfa0a09..9514d43951 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -50,7 +50,7 @@ Starting in Windows 10, version 1903 and newer, both the **Out-of-Box-Experience ## Behaviorial changes -In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be migrated to the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit crash dumps and logs**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**. +In an upcoming release of Windows 10, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. If your devices are set to **Enhanced** when they are upgraded, the device settings will be evaluated to be at the more privacy-preserving setting of **Required diagnostic data**, which means that analytic services that leverage enhanced data collection may not work properly. For a list of services, see the section named, **Services that rely on Enhanced diagnostic data**, later in this topic. Administrators should read through the details and determine whether to apply these new policies to restore the same collection settings as they had before this change. For a list of steps, see the section named **Configure a Windows 10 device to limit crash dumps and logs**. For more information on services that rely on Enhanced diagnostic data, see **Services that rely on Enhanced diagnostic data**. Additionally, you will see the following policy changes in an upcoming release of Windows 10: diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index a66e8d0a3a..2e5dcae25d 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -559,6 +559,8 @@ To disable the Microsoft Account Sign-In Assistant: Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682) and [Configure Microsoft Edge policy settings on Windows](/DeployEdge/configure-microsoft-edge). +For a complete list of the Microsoft Edge policies, see [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies). + ### 13.1 Microsoft Edge Group Policies Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. @@ -594,8 +596,6 @@ Alternatively, you can configure the following Registry keys as described: | Choose whether employees can configure Compatibility View. | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation
REG_DWORD: MSCompatibilityMode
Value: **0**| -For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](/microsoft-edge/deploy/available-policies). - ### 13.2 Microsoft Edge Enterprise For a complete list of the Microsoft Edge policies, see [Microsoft Edge and privacy: FAQ](https://docs.microsoft.com/en-us/microsoft-edge/deploy/available-policies). diff --git a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md index 67158554c1..fdaf967827 100644 --- a/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md +++ b/windows/privacy/required-windows-diagnostic-data-events-and-fields-2004.md @@ -1,5 +1,5 @@ --- -description: Use this article to learn more about what required Windows diagnostic data is gathered. +description: Learn what required Windows diagnostic data is gathered. title: Windows 10, version 21H1, Windows 10, version 20H2 and Windows 10, version 2004 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry ms.prod: w10 @@ -64,10 +64,6 @@ The following fields are available: - **DatasourceApplicationFile_20H1Setup** The total number of objects of this type present on this device. - **DatasourceApplicationFile_21H1** The total number of objects of this type present on this device. - **DatasourceApplicationFile_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_21H2** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceApplicationFile_RS1** The total number of objects of this type present on this device. - **DatasourceApplicationFile_RS2** The total number of objects of this type present on this device. - **DatasourceApplicationFile_RS3** The total number of objects of this type present on this device. @@ -81,10 +77,6 @@ The following fields are available: - **DatasourceDevicePnp_20H1Setup** The total number of objects of this type present on this device. - **DatasourceDevicePnp_21H1** The total number of objects of this type present on this device. - **DatasourceDevicePnp_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_21H2** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceDevicePnp_RS1** The total number of objects of this type present on this device. - **DatasourceDevicePnp_RS2** The total number of objects of this type present on this device. - **DatasourceDevicePnp_RS3** The total number of objects of this type present on this device. @@ -100,10 +92,6 @@ The following fields are available: - **DatasourceDriverPackage_20H1Setup** The total number of objects of this type present on this device. - **DatasourceDriverPackage_21H1** The total number of objects of this type present on this device. - **DatasourceDriverPackage_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_21H2** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceDriverPackage_RS1** The total number of objects of this type present on this device. - **DatasourceDriverPackage_RS2** The total number of objects of this type present on this device. - **DatasourceDriverPackage_RS3** The total number of objects of this type present on this device. @@ -119,10 +107,6 @@ The following fields are available: - **DataSourceMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_21H1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_RS1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_RS2** The total number of objects of this type present on this device. - **DataSourceMatchingInfoBlock_RS3** The total number of objects of this type present on this device. @@ -136,10 +120,6 @@ The following fields are available: - **DataSourceMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_21H1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_RS1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_RS2** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPassive_RS3** The total number of objects of this type present on this device. @@ -153,10 +133,6 @@ The following fields are available: - **DataSourceMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. -- **DataSourceMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. - **DataSourceMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. @@ -170,10 +146,6 @@ The following fields are available: - **DatasourceSystemBios_20H1Setup** The total number of objects of this type present on this device. - **DatasourceSystemBios_21H1** The total number of objects of this type present on this device. - **DatasourceSystemBios_21H1Setup** The total number of objects of this type present on this device. -- **DatasourceSystemBios_21H2** The total number of objects of this type present on this device. -- **DatasourceSystemBios_21H2Setup** The total number of objects of this type present on this device. -- **DatasourceSystemBios_CO21H2Setup** The total number of objects of this type present on this device. -- **DatasourceSystemBios_CU22H2Setup** The total number of objects of this type present on this device. - **DatasourceSystemBios_RS1** The total number of objects of this type present on this device. - **DatasourceSystemBios_RS2** The total number of objects of this type present on this device. - **DatasourceSystemBios_RS3** The total number of objects of this type present on this device. @@ -189,10 +161,6 @@ The following fields are available: - **DecisionApplicationFile_20H1Setup** The total number of objects of this type present on this device. - **DecisionApplicationFile_21H1** The total number of objects of this type present on this device. - **DecisionApplicationFile_21H1Setup** The total number of objects of this type present on this device. -- **DecisionApplicationFile_21H2** The total number of objects of this type present on this device. -- **DecisionApplicationFile_21H2Setup** The total number of objects of this type present on this device. -- **DecisionApplicationFile_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionApplicationFile_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionApplicationFile_RS1** The total number of objects of this type present on this device. - **DecisionApplicationFile_RS2** The total number of objects of this type present on this device. - **DecisionApplicationFile_RS3** The total number of objects of this type present on this device. @@ -206,10 +174,6 @@ The following fields are available: - **DecisionDevicePnp_20H1Setup** The total number of objects of this type present on this device. - **DecisionDevicePnp_21H1** The total number of objects of this type present on this device. - **DecisionDevicePnp_21H1Setup** The total number of objects of this type present on this device. -- **DecisionDevicePnp_21H2** The total number of objects of this type present on this device. -- **DecisionDevicePnp_21H2Setup** The total number of objects of this type present on this device. -- **DecisionDevicePnp_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionDevicePnp_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionDevicePnp_RS1** The total number of objects of this type present on this device. - **DecisionDevicePnp_RS2** The total number of objects of this type present on this device. - **DecisionDevicePnp_RS3** The total number of objects of this type present on this device. @@ -225,10 +189,6 @@ The following fields are available: - **DecisionDriverPackage_20H1Setup** The total number of objects of this type present on this device. - **DecisionDriverPackage_21H1** The total number of objects of this type present on this device. - **DecisionDriverPackage_21H1Setup** The total number of objects of this type present on this device. -- **DecisionDriverPackage_21H2** The total number of objects of this type present on this device. -- **DecisionDriverPackage_21H2Setup** The total number of objects of this type present on this device. -- **DecisionDriverPackage_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionDriverPackage_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionDriverPackage_RS1** The total number of objects of this type present on this device. - **DecisionDriverPackage_RS2** The total number of objects of this type present on this device. - **DecisionDriverPackage_RS3** The total number of objects of this type present on this device. @@ -244,10 +204,6 @@ The following fields are available: - **DecisionMatchingInfoBlock_20H1Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_21H1** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoBlock_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_RS1** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_RS2** The total number of objects of this type present on this device. - **DecisionMatchingInfoBlock_RS3** The total number of objects of this type present on this device. @@ -261,10 +217,6 @@ The following fields are available: - **DecisionMatchingInfoPassive_20H1Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_21H1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPassive_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_RS1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_RS2** The total number of objects of this type present on this device. - **DecisionMatchingInfoPassive_RS3** The total number of objects of this type present on this device. @@ -278,10 +230,6 @@ The following fields are available: - **DecisionMatchingInfoPostUpgrade_20H1Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_21H1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_21H2** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMatchingInfoPostUpgrade_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_RS1** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_RS2** The total number of objects of this type present on this device. - **DecisionMatchingInfoPostUpgrade_RS3** The total number of objects of this type present on this device. @@ -295,10 +243,6 @@ The following fields are available: - **DecisionMediaCenter_20H1Setup** The total number of objects of this type present on this device. - **DecisionMediaCenter_21H1** The total number of objects of this type present on this device. - **DecisionMediaCenter_21H1Setup** The total number of objects of this type present on this device. -- **DecisionMediaCenter_21H2** The total number of objects of this type present on this device. -- **DecisionMediaCenter_21H2Setup** The total number of objects of this type present on this device. -- **DecisionMediaCenter_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionMediaCenter_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionMediaCenter_RS1** The total number of objects of this type present on this device. - **DecisionMediaCenter_RS2** The total number of objects of this type present on this device. - **DecisionMediaCenter_RS3** The total number of objects of this type present on this device. @@ -306,19 +250,12 @@ The following fields are available: - **DecisionMediaCenter_RS5** The total number of objects of this type present on this device. - **DecisionMediaCenter_TH1** The total number of objects of this type present on this device. - **DecisionMediaCenter_TH2** The total number of objects of this type present on this device. -- **DecisionSModeState_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSModeState_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSModeState_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_19H1** The total number of objects of this type present on this device. - **DecisionSystemBios_19H1Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_20H1** The total number of objects of this type present on this device. - **DecisionSystemBios_20H1Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_21H1** The total number of objects of this type present on this device. - **DecisionSystemBios_21H1Setup** The total number of objects of this type present on this device. -- **DecisionSystemBios_21H2** The total number of objects of this type present on this device. -- **DecisionSystemBios_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemBios_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemBios_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_RS1** The total number of objects of this type present on this device. - **DecisionSystemBios_RS2** The total number of objects of this type present on this device. - **DecisionSystemBios_RS3** The total number of objects of this type present on this device. @@ -328,29 +265,11 @@ The following fields are available: - **DecisionSystemBios_RS5Setup** The total number of objects of this type present on this device. - **DecisionSystemBios_TH1** The total number of objects of this type present on this device. - **DecisionSystemBios_TH2** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemDiskSize_CU22H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemMemory_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemMemory_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemMemory_CU22H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuCores_CU22H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuModel_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuModel_CU22H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionSystemProcessorCpuSpeed_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionTest_19H1** The total number of objects of this type present on this device. - **DecisionTest_20H1** The total number of objects of this type present on this device. - **DecisionTest_20H1Setup** The total number of objects of this type present on this device. - **DecisionTest_21H1** The total number of objects of this type present on this device. - **DecisionTest_21H1Setup** The total number of objects of this type present on this device. -- **DecisionTest_21H2** The total number of objects of this type present on this device. -- **DecisionTest_21H2Setup** The total number of objects of this type present on this device. -- **DecisionTest_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionTest_CU22H2Setup** The total number of objects of this type present on this device. - **DecisionTest_RS1** The total number of objects of this type present on this device. - **DecisionTest_RS2** The total number of objects of this type present on this device. - **DecisionTest_RS3** The total number of objects of this type present on this device. @@ -358,12 +277,6 @@ The following fields are available: - **DecisionTest_RS5** The total number of objects of this type present on this device. - **DecisionTest_TH1** The total number of objects of this type present on this device. - **DecisionTest_TH2** The total number of objects of this type present on this device. -- **DecisionTpmVersion_21H2Setup** The total number of objects of this type present on this device. -- **DecisionTpmVersion_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionTpmVersion_CU22H2Setup** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_21H2Setup** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_CO21H2Setup** The total number of objects of this type present on this device. -- **DecisionUefiSecureBoot_CU22H2Setup** The total number of objects of this type present on this device. - **InventoryApplicationFile** The total number of objects of this type present on this device. - **InventoryLanguagePack** The total number of objects of this type present on this device. - **InventoryMediaCenter** The total number of objects of this type present on this device. @@ -387,10 +300,6 @@ The following fields are available: - **Wmdrm_20H1Setup** The total number of objects of this type present on this device. - **Wmdrm_21H1** The total number of objects of this type present on this device. - **Wmdrm_21H1Setup** The total number of objects of this type present on this device. -- **Wmdrm_21H2** The total number of objects of this type present on this device. -- **Wmdrm_21H2Setup** The total number of objects of this type present on this device. -- **Wmdrm_CO21H2Setup** The total number of objects of this type present on this device. -- **Wmdrm_CU22H2Setup** The total number of objects of this type present on this device. - **Wmdrm_RS1** The total number of objects of this type present on this device. - **Wmdrm_RS2** The total number of objects of this type present on this device. - **Wmdrm_RS3** The total number of objects of this type present on this device. @@ -4130,7 +4039,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event, where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See [experimentationandconfigurationservicecontrol](/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol) for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **installSourceName** A string representation of the installation source. @@ -4162,7 +4071,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See [experimentationandconfigurationservicecontrol](/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol) for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **installSourceName** A string representation of the installation source. @@ -4195,7 +4104,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See (experimentationandconfigurationservicecontrol)[/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol] for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **installSourceName** A string representation of the installation source. @@ -4228,7 +4137,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See [#experimentationandconfigurationservicecontrol](/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol) for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **installSourceName** A string representation of the installation source. @@ -4342,7 +4251,7 @@ The following fields are available: - **container_session_id** The session ID of the container, if in WDAG mode. This will be different from the UMA log session ID, which is the session ID of the host in WDAG mode. - **Etag** Etag is an identifier representing all service applied configurations and experiments for the current browser session. This field is left empty when Windows diagnostic level is set to Basic or lower or when consent for diagnostic data has been denied. - **EventInfo.Level** The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full. -- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol for more details on this policy. +- **experimentation_mode** A number representing the value set for the ExperimentationAndConfigurationServiceControl group policy. See [experimentationandconfigurationservicecontrol](/DeployEdge/microsoft-edge-policies#experimentationandconfigurationservicecontrol) for more details on this policy. - **install_date** The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour. - **installSource** An enumeration representing the source of this installation: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13). - **installSourceName** A string representation of the installation source. @@ -6355,7 +6264,7 @@ The following fields are available: ### Microsoft.Windows.WERVertical.OSCrash -This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event. +This event sends binary data from the collected dump file whenever a bug check occurs, to help keep Windows up to date. This is the OneCore version of this event. The following fields are available: diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 0dc6406a6d..f0c84a4b48 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -282,7 +282,7 @@ This group implicitly includes all users who are logged on to the system through ## Principal Self -This identify is a placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal that is represented by the object. +This identity is a placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal that is represented by the object. | **Attribute** | **Value** | | :--: | :--: | diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md new file mode 100644 index 0000000000..850b4b5214 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -0,0 +1,103 @@ +--- +title: Azure Active Directory join cloud only deployment +description: Use this deployment guide to successfully use Azure Active Directory to join a Windows 10 device. +keywords: identity, Hello, Active Directory, cloud, +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 06/23/2021 +ms.reviewer: +--- +# Azure Active Directory join cloud only deployment + +## Introduction + +When you Azure Active Directory (Azure AD) join a Windows 10 device, the system prompts you to enroll in Windows Hello for Business by default. If you want to use Windows Hello for Business in your cloud only environment, then there's no additional configuration needed. + +You may wish to disable the automatic Windows Hello for Business enrollment prompts if you aren't ready to use it in your environment. Instructions on how to disable Windows Hello for Business enrollment in a cloud only environment are included below. + +> [!NOTE] +> During the out-of-box experience (OOBE) flow of an Azure AD join, you will see a provisioning PIN when you don’t have Intune. You can always cancel the PIN screen and set this cancellation with registry keys to prevent future prompts. + +## Prerequisites + +Cloud only deployments will use Azure AD multi-factor authentication (MFA) during Windows Hello for Business (WHfB) enrollment and there's no additional MFA configuration needed. If you aren't already registered in Azure AD MFA, you will be guided though the MFA registration as part of the Windows Hello for Business enrollment process. + +The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#cloud-only-deployment). + +Also note that it's possible for federated domains to enable the “Supports MFA” flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge. + +Check and view this setting with the following MSOnline PowerShell command: + +`Get-MsolDomainFederationSettings –DomainName ` + +To disable this setting, run the following command. Note that this change impacts ALL Azure AD MFA scenarios for this federated domain. + +`Set-MsolDomainFederationSettings -DomainName -SupportsMfa $false` + +Example: + +`Set-MsolDomainFederationSettings -DomainName contoso.com -SupportsMfa $false` + +If you use this Supports MFA switch with value **True**, you must verify that your federated IDP is correctly configured and working with the MFA adapter and provider used by your IDP. + +## Use Intune to disable Windows Hello for Business enrollment + +We recommend that you disable or manage Windows Hello for Business provisioning behavior through an Intune policy using the steps in [Integrate Windows Hello for Business with Microsoft Intune](/mem/intune/protect/windows-hello). + +However, not everyone uses Intune. The following method explains how to disable Windows Hello for Business enrollment without Intune, or through a third-party mobile device management (MDM). If you aren't using Intune in your organization, you can disable Windows Hello for Business via the registry. We have provided the underlying registry subkeys for disabling Windows Hello for Business. + +## Disable Windows Hello for Business using Intune Enrollment policy + +1. Sign into the [Microsoft Endpoint Manager](https://endpoint.microsoft.com/) admin center. +2. Go to **Devices** > **Enrollment** > **Enroll devices** > **Windows enrollment** > **Windows Hello for Business**. The Windows Hello for Business pane opens. +3. If you don't want to enable Windows Hello for Business during device enrollment, select **Disabled** for **Configure Windows Hello for Business**. + + When disabled, users cannot provision Windows Hello for Business. When set to Disabled, you can still configure the subsequent settings for Windows Hello for Business even though this policy won't enable Windows Hello for Business. + +> [!NOTE] +> This policy is only applied during new device enrollments. For currently enrolled devices, you can [set the same settings in a device configuration policy](hello-manage-in-organization.md). + +## Disable Windows Hello for Business enrollment without Intune + +The information below can be pushed out to the devices through a third-party MDM, or some other method that you use to manage these devices, if you don't manage them with Intune. This push can also be set manually on the specific device(s). + +Because these systems are Azure AD Joined only, and not domain joined, these settings could be made in the registry on the device(s) when Intune isn't used. + +Here are the registry settings an Intune policy would set. + +Intune Device Policy: **`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\\Device\Policies`** + +To look up your Tenant ID, see [How to find your Azure Active Directory tenant ID](/azure/active-directory/fundamentals/active-directory-how-to-find-tenant) + +These registry settings are pushed from Intune for user policies for your reference. + +- Intune User Policy: **`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Policies\PassportForWork\\UserSid\Policies`** +- DWORD: **UsePassportForWork** +- Value = **0** for Disable, or Value = **1** for Enable + +For your reference, these registry settings can be applied from Local or Group Policies. + +- Local/GPO User Policy: **`HKEY_USERS\UserSID\SOFTWARE\Policies\Microsoft\PassportForWork`** +- Local/GPO Device Policy: **`HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\PassportForWork`** +- DWORD: **Enabled** +- Value = **0** for Disable or Value = **1** for Enable + +If there's a conflicting Device policy and User policy, the User policy would take precedence. We don't recommend creating Local/GPO registry settings that could conflict with an Intune policy. This conflict could lead to unexpected results. + +## Related reference documents for Azure AD join scenarios + +- [Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join) +- [Plan your Azure Active Directory device deployment](/azure/active-directory/devices/plan-device-deployment) +- [How to: Plan your Azure AD join implementation](/azure/active-directory/devices/azureadjoin-plan) +- [How to manage the local administrators group on Azure AD joined devices](/azure/active-directory/devices/assign-local-admin) +- [Manage device identities using the Azure portal](/azure/active-directory/devices/device-management-azure-portal) +- [Azure AD Join Single Sign-on Deployment](hello-hybrid-aadj-sso.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index eb89236d09..405b6710ad 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -69,9 +69,9 @@ sections: answer: | It's currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts (synchronized identities included). It's only supported for on-premises Domain Joined users and local account users. - - question: Can I use an external camera when my laptop is closed or docked? + - question: Can I use an external Windows Hello compatible camera when my laptop is closed or docked? answer: | - No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. + Yes. Starting with Windows 10, version 21H2 an external Windows Hello compatible camera can be used if a device already supports an internal Windows Hello camera. When both cameras are present, the external camera will be be used for face authentication. For more information see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). - question: Why does authentication fail immediately after provisioning hybrid key trust? answer: | @@ -118,7 +118,7 @@ sections: Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. With destructive PIN reset, users that have forgotten their PIN can authenticate by using their password and then performing a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. - question: | - Which is better or more secure: key trust or certificate trust? + Which is better or more secure, key trust or certificate trust? answer: | The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: - Required domain controllers diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 6d1ae1fbd1..c772362fa2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -197,7 +197,7 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - **Description:** (Optional) List of domains that are allowed during PIN reset flows. - **OMA-URI:** ./Vendor/MSFT/Policy/Config/Authentication/ConfigureWebSignInAllowedUrls - **Data type:** String - - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be "signin.contoso.com;portal.contoso.com" + - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be signin.contoso.com;portal.contoso.com (no double quotes) ![Custom Configuration for ConfigureWebSignInAllowedUrls policy](images/pinreset/allowlist.png) @@ -218,4 +218,4 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index d867b494ec..28ff8d49c6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -74,6 +74,9 @@ The two directories used in hybrid deployments must be synchronized. You need A Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema). +> [!NOTE] +> User accounts enrolling for Windows Hello for Business in a Hybrid Certificate Trust scenario must have a UPN matching a verified domain name in Azure AD. For more details, see [Troubleshoot Post-Join issues](/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current#troubleshoot-post-join-issues). + > [!NOTE] > Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory. @@ -152,4 +155,4 @@ If your environment is already federated and supports Azure device registration, 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png b/windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png index 097b1e036d..5b1df9448e 100644 Binary files a/windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png and b/windows/security/identity-protection/hello-for-business/images/pinreset/allowlist.png differ diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml index 5c90875208..60161ce7da 100644 --- a/windows/security/identity-protection/hello-for-business/toc.yml +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -101,6 +101,8 @@ href: hello-cert-trust-validate-deploy-mfa.md - name: Configure Windows Hello for Business policy settings href: hello-cert-trust-policy-settings.md + - name: Azure AD join cloud only deployment + href: hello-aad-join-cloud-only-deploy.md - name: Managing Windows Hello for Business in your organization href: hello-manage-in-organization.md - name: Deploying Certificates to Key Trust Users to Enable RDP diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index cb9d870d46..789da743aa 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -80,8 +80,12 @@ A TPM-based virtual smart card is labeled **Security Device** in the user interf ## Changing the PIN -The PIN for virtual smart card can be changed by pressing Ctrl+Alt+Del, and then selecting the TPM virtual smart card under **Sign in options**. - +The PIN for a virtual smart card can be changed by following these steps: +- Sign in with the old PIN or password. +- Press Ctrl+Alt+Del and choose **Change a password**. +- Select **Sign-in Options**. +- Select the virtual smart card icon. +- Enter and confirm the new PIN. ## Resolving issues ### TPM not provisioned @@ -100,4 +104,4 @@ Sometimes, due to frequent incorrect PIN attempts from a user, the TPM may enter ## See also -For information about authentication, confidentiality, and data integrity use cases, see [Virtual Smart Card Overview](virtual-smart-card-overview.md). \ No newline at end of file +For information about authentication, confidentiality, and data integrity use cases, see [Virtual Smart Card Overview](virtual-smart-card-overview.md). diff --git a/windows/security/information-protection/TOC.yml b/windows/security/information-protection/TOC.yml index 9965f322db..bcaa9d74d7 100644 --- a/windows/security/information-protection/TOC.yml +++ b/windows/security/information-protection/TOC.yml @@ -29,6 +29,8 @@ href: bitlocker\bitlocker-using-with-other-programs-faq.yml - name: "Prepare your organization for BitLocker: Planning and policies" href: bitlocker\prepare-your-organization-for-bitlocker-planning-and-policies.md + - name: BitLocker deployment comparison + href: bitlocker\bitlocker-deployment-comparison.md - name: BitLocker basic deployment href: bitlocker\bitlocker-basic-deployment.md - name: "BitLocker: How to deploy on Windows Server 2012 and later" diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md new file mode 100644 index 0000000000..0fbc7f9f48 --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -0,0 +1,65 @@ +--- +title: BitLocker deployment comparison (Windows 10) +description: This article shows the BitLocker deployment comparison chart. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: lovina-saldanha +ms.author: v-lsaldanha +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 05/20/2021 +ms.custom: bitlocker +--- + +# BitLocker deployment comparison + +**Applies to** + +- Windows 10 + +This article depicts the BitLocker deployment comparison chart. + +## BitLocker deployment comparison chart + +| |Microsoft Intune |Microsoft Endpoint Configuration Manager |Microsoft BitLocker Administration and Monitoring (MBAM) | +|---------|---------|---------|---------| +|**Requirements**|||| +|Minimum client operating system version |Windows 10 | Windows 10 and Windows 8.1 | Windows 7 and later | +|Supported Windows 10 SKUs | Enterprise, Pro, Education | Enterprise, Pro, Education | Enterprise | +|Minimum Windows 10 version |1909 | None | None | +|Supported domain-joined status | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory joined, hybrid Azure AD joined | Active Directory joined | +|Permissions required to manage policies | Endpoint security manager or custom | Full administrator or custom | Domain Admin or Delegated GPO access | +|Cloud or on premises | Cloud | On premises | On premises | +|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Additional agent required? | No (device enrollment only) | Configuration Manager client | MBAM client | +|Administrative plane | Microsoft Endpoint Manager admin center | Configuration Manager console | Group Policy Management Console and MBAM sites | +|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | +|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Standard recovery password storage location | Azure AD or Active Directory | Configuration Manager site database | MBAM database | +|Store recovery password for operating system and fixed drives to Azure AD or Active Directory | Yes (Active Directory and Azure AD) | Yes (Active Directory only) | Yes (Active Directory only) | +|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | +|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | | +|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | diff --git a/windows/security/information-protection/bitlocker/images/yes-icon.png b/windows/security/information-protection/bitlocker/images/yes-icon.png new file mode 100644 index 0000000000..bbae7d3052 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/yes-icon.png differ diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index 6424a91e8b..bab9c21e3e 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -94,6 +94,9 @@ To find the PCR information, go to the end of the file. ## Use PCPTool to decode Measured Boot logs +> [!NOTE] +> PCPTool is a Visual Studio solution, but you need to build the executable before you can start using this tool. + PCPTool is part of the [TPM Platform Crypto-Provider Toolkit](https://www.microsoft.com/download/details.aspx?id=52487). The tool decodes a Measured Boot log file and converts it into an XML file. To download and install PCPTool, go to the Toolkit page, select **Download**, and follow the instructions. @@ -111,4 +114,4 @@ where the variables represent the following values: The content of the XML file resembles the following. -![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) \ No newline at end of file +![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index 6179ba0c0a..658a7d98d5 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -72,7 +72,7 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in > [!NOTE] > TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. - +> > Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. ## Discrete, Integrated or Firmware TPM? @@ -95,7 +95,7 @@ For end consumers, TPM is behind the scenes but is still very relevant. TPM is u ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of an existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). ### IoT Core @@ -111,21 +111,20 @@ The following table defines which Windows features require TPM support. Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | -|-|-|-|- - Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot + Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Automatic Device Encryption requires Modern Standby](../bitlocker/bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) including TPM 2.0 support Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. Windows Defender Application Control (Device Guard) | No | Yes | Yes - Windows Defender System Guard | Yes | No | Yes - Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. - Device Health Attestation| Yes | Yes | Yes - Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. + Windows Defender System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. + Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with Windows Defender System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. + Device Health Attestation| Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. + Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. TPM 2.0 is recommended over TPM 1.2 for better performance and security. Windows Hello as a FIDO platform authenticator will take advantage of TPM 2.0 for key storage. UEFI Secure Boot | No | Yes | Yes TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes Virtual Smart Card | Yes | Yes | Yes Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. - DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. ## OEM Status on TPM 2.0 system availability and certified parts @@ -133,4 +132,4 @@ Government customers and enterprise customers in regulated industries may have a ## Related topics -- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) \ No newline at end of file +- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index c10b2990b3..62291e7f81 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -52,9 +52,9 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or ## Create a WIP policy -1. Sign in to the Azure portal. +1. Sign in to the [Microsoft Endpoint Manager](https://endpoint.microsoft.com/). -2. Open Microsoft Intune and click **Client apps** > **App protection policies** > **Create policy**. +2. Open Microsoft Intune and click **Apps** > **App protection policies** > **Create policy**. ![Open Client apps](images/create-app-protection-policy.png) @@ -486,7 +486,7 @@ Specify the proxy servers your devices will go through to reach your cloud resou Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Internal proxy servers list. -Internal proxy servers must be used only for WIP-protected (enterprise) traffic. +Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. Separate multiple resources with the ";" delimiter. ```console @@ -497,8 +497,8 @@ proxy.contoso.com:80;proxy2.contoso.com:443 Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. -This list shouldn’t include any servers listed in your Proxy servers list. -Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. +This list shouldn’t include any servers listed in your Proxy servers list. +Internal proxy servers must be used only for WIP-protected (enterprise) traffic. Separate multiple resources with the ";" delimiter. ```console @@ -507,8 +507,6 @@ contoso.internalproxy1.com;contoso.internalproxy2.com ### IPv4 ranges -Starting with Windows 10, version 1703, this field is optional. - Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. Classless Inter-Domain Routing (CIDR) notation isn’t supported. diff --git a/windows/security/threat-protection/TOC.yml b/windows/security/threat-protection/TOC.yml index 3c8e12e04c..e310d0d993 100644 --- a/windows/security/threat-protection/TOC.yml +++ b/windows/security/threat-protection/TOC.yml @@ -224,7 +224,7 @@ - name: Information for developers items: - name: Software developer FAQ - href: intelligence/developer-faq.md + href: intelligence/developer-faq.yml - name: Software developer resources href: intelligence/developer-resources.md - name: The Windows Security app diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index 87c74a4998..7e8dea77c3 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -21,8 +21,7 @@ ms.technology: mde - Windows 10 - Windows Server 2016 - -This auditing subcategory should not have any events in it, but for some reason Success auditing will enable generation of event 4985(S): The state of a transaction has changed. +This auditing subcategory should not have any events in it, but for some reason Success auditing will enable the generation of event [4985(S): The state of a transaction has changed](/windows/security/threat-protection/auditing/event-4985). | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------| @@ -35,4 +34,3 @@ This auditing subcategory should not have any events in it, but for some reason - [4985](event-4985.md)(S): The state of a transaction has changed. - diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index 10a7cb1c8c..5541fc0f63 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -44,51 +44,51 @@ set this value to **No auditing**, in the **Properties** dialog box for this pol You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. -| Account management events | Description | -|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 624 | A user account was created. | -| 627 | A user password was changed. | -| 628 | A user password was set. | -| 630 | A user account was deleted. | -| 631 | A global group was created. | -| 632 | A member was added to a global group. | -| 633 | A member was removed from a global group. | -| 634 | A global group was deleted. | -| 635 | A new local group was created. | -| 636 | A member was added to a local group. | -| 637 | A member was removed from a local group. | -| 638 | A local group was deleted. | -| 639 | A local group account was changed. | -| 641 | A global group account was changed. | -| 642 | A user account was changed. | -| 643 | A domain policy was modified. | -| 644 | A user account was auto locked. | -| 645 | A computer account was created. | -| 646 | A computer account was changed. | -| 647 | A computer account was deleted. | -| 648 | A local security group with security disabled was created.
**Note:** SECURITY_DISABLED in the formal name means that this group cannot be used to grant permissions in access checks. | -| 649 | A local security group with security disabled was changed. | -| 650 | A member was added to a security-disabled local security group. | -| 651 | A member was removed from a security-disabled local security group. | -| 652 | A security-disabled local group was deleted. | -| 653 | A security-disabled global group was created. | -| 645 | A security-disabled global group was changed. | -| 655 | A member was added to a security-disabled global group. | -| 656 | A member was removed from a security-disabled global group. | -| 657 | A security-disabled global group was deleted. | -| 658 | A security-enabled universal group was created. | -| 659 | A security-enabled universal group was changed. | -| 660 | A member was added to a security-enabled universal group. | -| 661 | A member was removed from a security-enabled universal group. | -| 662 | A security-enabled universal group was deleted. | -| 663 | A security-disabled universal group was created. | -| 664 | A security-disabled universal group was changed. | -| 665 | A member was added to a security-disabled universal group. | -| 666 | A member was removed from a security-disabled universal group. | -| 667 | A security-disabled universal group was deleted. | -| 668 | A group type was changed. | -| 684 | Set the security descriptor of members of administrative groups. | -| 685 | Set the security descriptor of members of administrative groups.
**Note:** Every 60 minutes on a domain controller a background thread searches all members of administrative groups (such as domain, enterprise, and schema administrators) and applies a fixed security descriptor on them. This event is logged. | +| Account management events | Description | +| :-----------------------: | :---------- | +| 4720 | A user account was created. | +| 4723 | A user password was changed. | +| 4724 | A user password was set. | +| 4726 | A user account was deleted. | +| 4727 | A global group was created. | +| 4728 | A member was added to a global group. | +| 4729 | A member was removed from a global group. | +| 4730 | A global group was deleted. | +| 4731 | A new local group was created. | +| 4732 | A member was added to a local group. | +| 4733 | A member was removed from a local group. | +| 4734 | A local group was deleted. | +| 4735 | A local group account was changed. | +| 4737 | A global group account was changed. | +| 4738 | A user account was changed. | +| 4739 | A domain policy was modified. | +| 4740 | A user account was auto locked. | +| 4741 | A computer account was created. | +| 4742 | A computer account was changed. | +| 4743 | A computer account was deleted. | +| 4744 | A local security group with security disabled was created.
**Note:** SECURITY_DISABLED in the formal name means that this group cannot be used to grant permissions in access checks | +| 4745 | A local security group with security disabled was changed. | +| 4746 | A member was added to a security-disabled local security group. | +| 4747 | A member was removed from a security-disabled local security group. | +| 4748 | A security-disabled local group was deleted. | +| 4749 | A security-disabled global group was created. | +| 4750 | A security-disabled global group was changed. | +| 4751 | A member was added to a security-disabled global group. | +| 4752 | A member was removed from a security-disabled global group. | +| 4753 | A security-disabled global group was deleted. | +| 4754 | A security-enabled universal group was created. | +| 4755 | A security-enabled universal group was changed. | +| 4756 | A member was added to a security-enabled universal group. | +| 4757 | A member was removed from a security-enabled universal group. | +| 4758 | A security-enabled universal group was deleted. | +| 4759 | A security-disabled universal group was created. | +| 4760 | A security-disabled universal group was changed. | +| 4761 | A member was added to a security-disabled universal group. | +| 4762 | A member was removed from a security-disabled universal group. | +| 4763 | A security-disabled universal group was deleted. | +| 4764 | A group type was changed. | +| 4780 | Set the security descriptor of members of administrative groups. | +| 685 | Set the security descriptor of members of administrative groups.
**Note:** Every 60 minutes on a domain controller a background thread searches all members of administrative groups (such as domain, enterprise, and schema administrators) and applies a fixed security descriptor on them. This event is logged. | ## Related topics diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index f34d8e3ae4..27db3be3f3 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -286,7 +286,7 @@ For 4624(S): An account was successfully logged on. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"New Logon\\Security ID"** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **"New Logon\\Security ID"** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "allow list-only" action, review the **"New Logon\\Security ID"** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "allow list-only" action, review the **"New Logon\\Security ID"** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"New Logon\\Security ID"** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **"Subject\\Account Domain"** corresponding to accounts from another domain or "external" accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"New Logon\\Security ID"** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index ff63c0c122..0ae5e51990 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -21,7 +21,7 @@ ms.technology: mde - Windows Server 2016 -Event 4627 illustration +Event 4627 illustration ***Subcategory:*** [Audit Group Membership](audit-group-membership.md) diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md index 8483ee08ac..44eb565de4 100644 --- a/windows/security/threat-protection/auditing/event-4648.md +++ b/windows/security/threat-protection/auditing/event-4648.md @@ -179,7 +179,7 @@ The following table is similar to the table in [Appendix A: Security monitoring | **High-value accounts**: You might have high value domain or local accounts for which you need to monitor each action.
Examples of high value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that correspond to the high value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that correspond to the accounts that should never be used. | -| **Account allow list**: You might have a specific allow list of accounts that are allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** and “**Account Whose Credentials Were Used\\Security ID**” for accounts that are outside the allow list. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform the action corresponding to this event. | Monitor for the **“Subject\\Account Domain”** or “**Account Whose Credentials Were Used\\Security ID**” corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** or “**Account Whose Credentials Were Used\\Security ID**” that you are concerned about.
For example, you might monitor to ensure that “**Account Whose Credentials Were Used\\Security ID**” is not used to log on to a certain computer. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** and “**Account Whose Credentials Were Used\\Security ID**” for names that don’t comply with naming conventions. | diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index 39167d9431..6e90a42a1e 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -193,7 +193,7 @@ For 4688(S): A new process has been created. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor all events with the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "whitelist-only" action, review the **"Creator Subject\\Security ID"** and **"Target Subject\\Security ID"** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a "allow list-only" action, review the **"Creator Subject\\Security ID"** and **"Target Subject\\Security ID"** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or "external" accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor the specific events for the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** corresponding to accounts from another domain or "external" accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **"Creator Subject\\Security ID"** or **"Target Subject\\Security ID"** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md index 520d0d5d1e..e35c7d44e0 100644 --- a/windows/security/threat-protection/auditing/event-4696.md +++ b/windows/security/threat-protection/auditing/event-4696.md @@ -153,7 +153,7 @@ For 4696(S): A primary token was assigned to process. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** and **“New Token Information\\Security ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** and **“New Token Information\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** or **“New Token Information\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index 243fa17ce2..3d024b8ccf 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -195,7 +195,7 @@ Otherwise, see the recommendations in the following table. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\Security ID**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Security ID**” and **“Enabled Privileges”** to see what was enabled. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Security ID**” and **“Enabled Privileges”** to see what was enabled. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about.
Also check **“Target Account\\Security ID”** to see whether the change in privileges should be made on that computer for that account. | diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index 4dc7eb2c64..a4e0e07aa3 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -153,7 +153,7 @@ For 4704(S): A user right was assigned. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\ Account Name**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Account Name**” and **“New Right”** to see what was enabled. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. Also check the “**Target Account\\Account Name**” and **“New Right”** to see what was enabled. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about.
Also check **“Target Account\\ Account Name”** to see whether the change in rights should be made on that computer for that account. | diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index 9478ffd125..83accc384e 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -152,7 +152,7 @@ For 4705(S): A user right was removed. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** or “**Target Account\\Account Name**” that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
If you have specific user rights policies, for example, an allow list of accounts that can perform certain actions, monitor this event to confirm that it was appropriate that the “**Removed Right**” was removed from “**Target** **Account\\Account Name**.” | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
If you have specific user rights policies, for example, an allow list of accounts that can perform certain actions, monitor this event to confirm that it was appropriate that the “**Removed Right**” was removed from “**Target** **Account\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Target Account\\Account Name”** to see whether the account type is as expected.
For example, if some accounts have critical user rights which should never be removed, monitor this event for the **“Target** **Account\\Account Name”** and the appropriate rights.
As another example, if non-administrative accounts should never be granted certain user rights (for example, **SeAuditPrivilege**), you might monitor this event, because a right can be removed only after it was previously granted. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Target Account\\Account Name**” to see whether user rights should be removed from that account (or whether that account should have any rights on that computer).
For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Removed Right**” should be removed from “**Target** **Account\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4717.md b/windows/security/threat-protection/auditing/event-4717.md index 32576cdc3b..3b438e68d4 100644 --- a/windows/security/threat-protection/auditing/event-4717.md +++ b/windows/security/threat-protection/auditing/event-4717.md @@ -127,7 +127,7 @@ For 4717(S): System security access was granted to an account. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
If you have specific user logon rights policies, for example, an allow list of accounts that can log on to certain computers, monitor this event to confirm that any “**Access Right**” was granted only to the appropriate “**Account Modified\\Account Name**.” | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
If you have specific user logon rights policies, for example, an allow list of accounts that can log on to certain computers, monitor this event to confirm that any “**Access Right**” was granted only to the appropriate “**Account Modified\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** to see whether the account type is as expected.
For example, if non-service accounts should never be granted certain logon rights (for example, **SeServiceLogonRight**), monitor this event for those accounts and rights. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Account Modified\\Account Name**” to see whether logon rights should be granted to that account.
For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Access Right**” should be granted to “**Account Modified\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4718.md b/windows/security/threat-protection/auditing/event-4718.md index 2c7f91f8c7..75f96131fe 100644 --- a/windows/security/threat-protection/auditing/event-4718.md +++ b/windows/security/threat-protection/auditing/event-4718.md @@ -127,7 +127,7 @@ For 4718(S): System security access was removed from an account. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
If you have specific user logon rights policies, for example, an allow list of accounts that can log on to certain computers, monitor this event to confirm that it was appropriate that the “**Access Right**” was removed from “**Account Modified\\Account Name**.” | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list.
If you have specific user logon rights policies, for example, an allow list of accounts that can log on to certain computers, monitor this event to confirm that it was appropriate that the “**Access Right**” was removed from “**Account Modified\\Account Name**.” | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** and “**Account Modified\\Account Name”** to see whether the account type is as expected.
For example, if critical remote network service accounts have user logon rights which should never be removed (for example, **SeNetworkLogonRight**), monitor this event for the **“Account Modified\\Account Name”** and the appropriate rights.
As another example, if non-service accounts should never be granted certain logon rights (for example, **SeServiceLogonRight**), you might monitor this event, because a right can be removed only after it was previously granted. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should perform only limited actions, or no actions at all. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. Also be sure to check “**Account Modified\\Account Name**” to see whether logon rights should be removed from that account.
For high-value servers or other computers, we recommend that you track this event and investigate whether the specific “**Access Right**” should be removed from “**Account Modified\\Account Name**” in each case. | diff --git a/windows/security/threat-protection/auditing/event-4732.md b/windows/security/threat-protection/auditing/event-4732.md index 43c74c4d05..543455432e 100644 --- a/windows/security/threat-protection/auditing/event-4732.md +++ b/windows/security/threat-protection/auditing/event-4732.md @@ -154,7 +154,7 @@ For 4732(S): A member was added to a security-enabled local group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4733.md b/windows/security/threat-protection/auditing/event-4733.md index b7bad044d0..2b749c0511 100644 --- a/windows/security/threat-protection/auditing/event-4733.md +++ b/windows/security/threat-protection/auditing/event-4733.md @@ -161,7 +161,7 @@ For 4733(S): A member was removed from a security-enabled local group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4751.md b/windows/security/threat-protection/auditing/event-4751.md index a6ac4afde8..39888ce838 100644 --- a/windows/security/threat-protection/auditing/event-4751.md +++ b/windows/security/threat-protection/auditing/event-4751.md @@ -158,7 +158,7 @@ For 4751(S): A member was added to a security-disabled global group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4752.md b/windows/security/threat-protection/auditing/event-4752.md index 7a81d28e4f..a1e4dff838 100644 --- a/windows/security/threat-protection/auditing/event-4752.md +++ b/windows/security/threat-protection/auditing/event-4752.md @@ -149,7 +149,7 @@ For 4752(S): A member was removed from a security-disabled global group. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Security ID”** and **“Member\\Security ID”** that correspond to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Security ID”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Security ID”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Security ID”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index d4de56e2c7..cea554341c 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -305,7 +305,7 @@ For 4768(S, F): A Kerberos authentication ticket (TGT) was requested. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“User ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“User ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“User ID”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“User ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“User ID”** for accounts that are outside the allow list. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Supplied Realm Name”** corresponding to another domain or “external” location. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**User ID”** for names that don’t comply with naming conventions. | diff --git a/windows/security/threat-protection/auditing/event-4771.md b/windows/security/threat-protection/auditing/event-4771.md index f63ab02819..c5aea23ecb 100644 --- a/windows/security/threat-protection/auditing/event-4771.md +++ b/windows/security/threat-protection/auditing/event-4771.md @@ -166,13 +166,78 @@ The most common values: > Table 6. Kerberos ticket flags. -- **Failure Code** \[Type = HexInt32\]**:** hexadecimal failure code of failed TGT issue operation. The table below contains the list of the most common error codes for this event: +- **Failure Code** \[Type = HexInt32\]**:** hexadecimal failure code of failed TGT issue operation. The table below contains the list of the error codes for this event as defined in [RFC 4120](https://tools.ietf.org/html/rfc4120#section-7.5.9): | Code | Code Name | Description | Possible causes | |------|--------------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 0x10 | KDC\_ERR\_PADATA\_TYPE\_NOSUPP | KDC has no support for PADATA type (pre-authentication data) | Smart card logon is being attempted and the proper certificate cannot be located. This problem can happen because the wrong certification authority (CA) is being queried or the proper CA cannot be contacted in order to get Domain Controller or Domain Controller Authentication certificates for the domain controller.
It can also happen when a domain controller doesn’t have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates). | -| 0x17 | KDC\_ERR\_KEY\_EXPIRED | Password has expired—change password to reset | The user’s password has expired. | -| 0x18 | KDC\_ERR\_PREAUTH\_FAILED | Pre-authentication information was invalid | The wrong password was provided. | +| 0x0 | KDC\_ERR\_NONE | No error | +| 0x1 | KDC\_ERR\_NAME\_EXP | Client's entry in database has expired | +| 0x2 | KDC\_ERR\_SERVICE\_EXP | Server's entry in database has expired | +| 0x3 | KDC\_ERR\_BAD\_PVNO | Requested protocol version number not supported | +| 0x4 | KDC\_ERR\_C\_OLD\_MAST\_KVNO | Client's key encrypted in old master key | +| 0x5 | KDC\_ERR\_S\_OLD\_MAST\_KVNO | Server's key encrypted in old master key | +| 0x6 | KDC\_ERR\_C\_PRINCIPAL\_UNKNOWN | Client not found in Kerberos database | +| 0x7 | KDC\_ERR\_S\_PRINCIPAL\_UNKNOWN | Server not found in Kerberos database | +| 0x8 | KDC\_ERR\_PRINCIPAL\_NOT\_UNIQUE | Multiple principal entries in database | +| 0x9 | KDC\_ERR\_NULL\_KEY | The client or server has a null key | +| 0xa | KDC\_ERR\_CANNOT\_POSTDATE | Ticket not eligible for postdating | +| 0xb | KDC\_ERR\_NEVER\_VALID | Requested starttime is later than end time | +| 0xc | KDC\_ERR\_POLICY | KDC policy rejects request | +| 0xd | KDC\_ERR\_BADOPTION | KDC cannot accommodate requested option | +| 0xe | KDC\_ERR\_ETYPE\_NOSUPP | KDC has no support for encryption type | +| 0xf | KDC\_ERR\_SUMTYPE\_NOSUPP | KDC has no support for checksum type | +| 0x10 | KDC\_ERR\_PADATA\_TYPE\_NOSUPP | KDC has no support for PADATA type (pre-authentication data)|Smart card logon is being attempted and the proper certificate cannot be located. This problem can happen because the wrong certification authority (CA) is being queried or the proper CA cannot be contacted in order to get Domain Controller or Domain Controller Authentication certificates for the domain controller.
It can also happen when a domain controller doesn’t have a certificate installed for smart cards (Domain Controller or Domain Controller Authentication templates). +| 0x11 | KDC\_ERR\_TRTYPE\_NOSUPP | KDC has no support for transited type | +| 0x12 | KDC\_ERR\_CLIENT\_REVOKED | Clients credentials have been revoked | +| 0x13 | KDC\_ERR\_SERVICE\_REVOKED | Credentials for server have been revoked | +| 0x14 | KDC\_ERR\_TGT\_REVOKED | TGT has been revoked | +| 0x15 | KDC\_ERR\_CLIENT\_NOTYET | Client not yet valid; try again later | +| 0x16 | KDC\_ERR\_SERVICE\_NOTYET | Server not yet valid; try again later | +| 0x17 | KDC\_ERR\_KEY\_EXPIRED | Password has expired—change password to reset |The user’s password has expired. +| 0x18 | KDC\_ERR\_PREAUTH\_FAILED | Pre-authentication information was invalid |The wrong password was provided. +| 0x19 | KDC\_ERR\_PREAUTH\_REQUIRED | Additional pre-authentication required | +| 0x1a | KDC\_ERR\_SERVER\_NOMATCH | Requested server and ticket don't match | +| 0x1b | KDC\_ERR\_MUST\_USE\_USER2USER | Server principal valid for user2user only | +| 0x1c | KDC\_ERR\_PATH\_NOT\_ACCEPTED | KDC Policy rejects transited path | +| 0x1d | KDC\_ERR\_SVC\_UNAVAILABLE | A service is not available | +| 0x1f | KRB\_AP\_ERR\_BAD\_INTEGRITY | Integrity check on decrypted field failed | +| 0x20 | KRB\_AP\_ERR\_TKT\_EXPIRED | Ticket expired | +| 0x21 | KRB\_AP\_ERR\_TKT\_NYV | Ticket not yet valid | +| 0x22 | KRB\_AP\_ERR\_REPEAT | Request is a replay | +| 0x23 | KRB\_AP\_ERR\_NOT\_US | The ticket isn't for us | +| 0x24 | KRB\_AP\_ERR\_BADMATCH | Ticket and authenticator don't match | +| 0x25 | KRB\_AP\_ERR\_SKEW | Clock skew too great | +| 0x26 | KRB\_AP\_ERR\_BADADDR | Incorrect net address | +| 0x27 | KRB\_AP\_ERR\_BADVERSION | Protocol version mismatch | +| 0x28 | KRB\_AP\_ERR\_MSG\_TYPE | Invalid msg type | +| 0x29 | KRB\_AP\_ERR\_MODIFIED | Message stream modified | +| 0x2a | KRB\_AP\_ERR\_BADORDER | Message out of order | +| 0x2c | KRB\_AP\_ERR\_BADKEYVER | Specified version of key is not available | +| 0x2d | KRB\_AP\_ERR\_NOKEY | Service key not available | +| 0x2e | KRB\_AP\_ERR\_MUT\_FAIL | Mutual authentication failed | +| 0x2f | KRB\_AP\_ERR\_BADDIRECTION | Incorrect message direction | +| 0x30 | KRB\_AP\_ERR\_METHOD | Alternative authentication method required | +| 0x31 | KRB\_AP\_ERR\_BADSEQ | Incorrect sequence number in message | +| 0x32 | KRB\_AP\_ERR\_INAPP\_CKSUM | Inappropriate type of checksum in message | +| 0x33 | KRB\_AP\_PATH\_NOT\_ACCEPTED | Policy rejects transited path | +| 0x34 | KRB\_ERR\_RESPONSE\_TOO\_BIG | Response too big for UDP; retry with TCP | +| 0x3c | KRB\_ERR\_GENERIC | Generic error (description in e-text) | +| 0x3d | KRB\_ERR\_FIELD\_TOOLONG | Field is too long for this implementation | +| 0x3e | KDC\_ERROR\_CLIENT\_NOT\_TRUSTED | Reserved for PKINIT | +| 0x3f | KDC\_ERROR\_KDC\_NOT\_TRUSTED | Reserved for PKINIT | +| 0x40 | KDC\_ERROR\_INVALID\_SIG | Reserved for PKINIT | +| 0x41 | KDC\_ERR\_KEY\_TOO\_WEAK | Reserved for PKINIT | +| 0x42 | KDC\_ERR\_CERTIFICATE\_MISMATCH | Reserved for PKINIT | +| 0x43 | KRB\_AP\_ERR\_NO\_TGT | No TGT available to validate USER-TO-USER | +| 0x44 | KDC\_ERR\_WRONG\_REALM | Reserved for future use | +| 0x45 | KRB\_AP\_ERR\_USER\_TO\_USER\_REQUIRED | Ticket must be for USER-TO-USER | +| 0x46 | KDC\_ERR\_CANT\_VERIFY\_CERTIFICATE | Reserved for PKINIT | +| 0x47 | KDC\_ERR\_INVALID\_CERTIFICATE | Reserved for PKINIT | +| 0x48 | KDC\_ERR\_REVOKED\_CERTIFICATE | Reserved for PKINIT | +| 0x49 | KDC\_ERR\_REVOCATION\_STATUS\_UNKNOWN | Reserved for PKINIT | +| 0x4a | KDC\_ERR\_REVOCATION\_STATUS\_UNAVAILABLE | Reserved for PKINIT | +| 0x4b | KDC\_ERR\_CLIENT\_NAME\_MISMATCH | Reserved for PKINIT | +| 0x4c | KDC\_ERR\_KDC\_NAME\_MISMATCH | Reserved for PKINIT | - **Pre-Authentication Type** \[Type = UnicodeString\]: the code of [pre-Authentication](/previous-versions/windows/it-pro/windows-server-2003/cc772815(v=ws.10)) type that was used in TGT request. @@ -209,7 +274,7 @@ For 4771(F): Kerberos pre-authentication failed. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Security ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Security ID”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Security ID”** that corresponds to the accounts that should never be used. | -| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Security ID”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Security ID”** for accounts that are outside the allow list. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Subject\\Account Name”** for names that don’t comply with naming conventions. | - You can track all [4771](event-4771.md) events where the **Client Address** is not from your internal IP range or not from private IP ranges. diff --git a/windows/security/threat-protection/auditing/event-4776.md b/windows/security/threat-protection/auditing/event-4776.md index d5d1fcdf4f..75dc6a4a69 100644 --- a/windows/security/threat-protection/auditing/event-4776.md +++ b/windows/security/threat-protection/auditing/event-4776.md @@ -130,7 +130,7 @@ For 4776(S, F): The computer attempted to validate the credentials for an accoun | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Logon Account”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Logon Account”** value (with other information) to monitor how or when a particular account is being used.
To monitor activity of specific user accounts outside of working hours, monitor the appropriate **Logon Account + Source Workstation** pairs. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Logon Account”** that should never be used. | -| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Logon Account”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Logon Account”** for accounts that are outside the allow list. | | **Restricted-use computers**: You might have certain computers from which certain people (accounts) should not log on. | Monitor the target **Source Workstation** for credential validation requests from the **“Logon Account”** that you are concerned about. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**Logon Account”** for names that don’t comply with naming conventions. | diff --git a/windows/security/threat-protection/auditing/event-4778.md b/windows/security/threat-protection/auditing/event-4778.md index 74b7630bc6..8293e41487 100644 --- a/windows/security/threat-protection/auditing/event-4778.md +++ b/windows/security/threat-protection/auditing/event-4778.md @@ -127,7 +127,7 @@ For 4778(S): A session was reconnected to a Window Station. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Account Name”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the accounts that should never be used. | -| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Account Name”** for accounts that are outside the allow list. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Account Name”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Account Name”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Account Name”** that you are concerned about. | diff --git a/windows/security/threat-protection/auditing/event-4779.md b/windows/security/threat-protection/auditing/event-4779.md index 7cf0dec285..f9c2757ab6 100644 --- a/windows/security/threat-protection/auditing/event-4779.md +++ b/windows/security/threat-protection/auditing/event-4779.md @@ -131,7 +131,7 @@ For 4779(S): A session was disconnected from a Window Station. | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“Subject\\Account Name”** (with other information) to monitor how or when a particular account is being used. | | **Non-active accounts**: You might have non-active, disabled, or guest accounts, or other accounts that should never be used. | Monitor this event with the **“Subject\\Account Name”** that corresponds to the accounts that should never be used. | -| **Account whitelist**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “whitelist-only” action, review the **“Subject\\Account Name”** for accounts that are outside the whitelist. | +| **Account allow list**: You might have a specific allow list of accounts that are the only ones allowed to perform actions corresponding to particular events. | If this event corresponds to a “allow list-only” action, review the **“Subject\\Account Name”** for accounts that are outside the allow list. | | **Accounts of different types**: You might want to ensure that certain actions are performed only by certain account types, for example, local or domain account, machine or user account, vendor or employee account, and so on. | If this event corresponds to an action you want to monitor for certain account types, review the **“Subject\\Account Name”** to see whether the account type is as expected. | | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Subject\\Account Domain”** corresponding to accounts from another domain or “external” accounts. | | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions.
For example, you might have computers to which connections should not be made from certain accounts or addresses. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Subject\\Account Name”** that you are concerned about.
If you have a target **Computer:** (or other target device) to which connections should not be made from certain accounts or addresses, monitor this event for the corresponding **Client Name** or **Client Address**. | diff --git a/windows/security/threat-protection/intelligence/TOC.yml b/windows/security/threat-protection/intelligence/TOC.yml index 6c1f372f77..eb239b51c5 100644 --- a/windows/security/threat-protection/intelligence/TOC.yml +++ b/windows/security/threat-protection/intelligence/TOC.yml @@ -55,6 +55,6 @@ - name: Information for developers items: - name: Software developer FAQ - href: developer-faq.md + href: developer-faq.yml - name: Software developer resources href: developer-resources.md diff --git a/windows/security/threat-protection/intelligence/developer-faq.md b/windows/security/threat-protection/intelligence/developer-faq.md deleted file mode 100644 index 73ca4ec48c..0000000000 --- a/windows/security/threat-protection/intelligence/developer-faq.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Software developer FAQ -ms.reviewer: -description: This page provides answers to common questions we receive from software developers -keywords: wdsi, software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article -ms.technology: mde ---- - -# Software developer FAQ - -This page provides answers to common questions we receive from software developers. For general guidance about submitting malware or incorrectly detected files, read the submission guide. - -## Does Microsoft accept files for a known list or false-positive prevention program? - -No. We don't accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list. Far less frequently, in will add your digital certificate to a list of trusted publishers. - -## How do I dispute the detection of my program? - -Submit the file in question as a software developer. Wait until your submission has a final determination. - -If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We'll use the information you provide to investigate further if necessary. - -We encourage all software vendors and developers to read about [how Microsoft identifies malware and Potentially Unwanted Applications (PUA)](criteria.md). - -## Why is Microsoft asking for a copy of my program? - -Providing copies can help us with our analysis. Participants of the [Microsoft Active Protection Service (MAPS)](https://www.microsoft.com/msrc/mapp) may occasionally receive these requests. The requests will stop once our systems have received and processed the file. - -## Why does Microsoft classify my installer as a software bundler? - -It contains instructions to offer a program classified as unwanted software. You can review the [criteria](criteria.md) we use to check applications for behaviors that are considered unwanted. - -## Why is the Windows Defender Firewall blocking my program? - -Firewall blocks aren't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](../windows-firewall/windows-firewall-with-advanced-security.md). - -## Why does the Microsoft Defender Windows Defender SmartScreen say my program isn't commonly downloaded? - -This isn't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender Windows Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/developer-faq.yml b/windows/security/threat-protection/intelligence/developer-faq.yml new file mode 100644 index 0000000000..04300736d9 --- /dev/null +++ b/windows/security/threat-protection/intelligence/developer-faq.yml @@ -0,0 +1,60 @@ +### YamlMime:FAQ +metadata: + title: Software developer FAQ + ms.reviewer: + description: This page provides answers to common questions we receive from software developers + keywords: wdsi, software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking + search.product: eADQiWindows 10XVcnh + ms.prod: m365-security + ms.mktglfcycl: deploy + ms.sitesec: library + ms.pagetype: security + ms.author: dansimp + author: dansimp + ms.localizationpriority: medium + manager: dansimp + audience: ITPro + ms.collection: M365-security-compliance + ms.topic: article + ms.technology: mde + +title: Software developer FAQ +summary: This page provides answers to common questions we receive from software developers. For general guidance about submitting malware or incorrectly detected files, read the submission guide. + + +sections: + - name: Ignored + questions: + - question: | + Does Microsoft accept files for a known list or false-positive prevention program? + answer: | + No. We don't accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list. Far less frequently, in will add your digital certificate to a list of trusted publishers. + + - question: | + How do I dispute the detection of my program? + answer: | + Submit the file in question as a software developer. Wait until your submission has a final determination. + + If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We'll use the information you provide to investigate further if necessary. + + We encourage all software vendors and developers to read about [how Microsoft identifies malware and Potentially Unwanted Applications (PUA)](criteria.md). + + - question: | + Why is Microsoft asking for a copy of my program? + answer: | + Providing copies can help us with our analysis. Participants of the [Microsoft Active Protection Service (MAPS)](https://www.microsoft.com/msrc/mapp) may occasionally receive these requests. The requests will stop once our systems have received and processed the file. + + - question: | + Why does Microsoft classify my installer as a software bundler? + answer: | + It contains instructions to offer a program classified as unwanted software. You can review the [criteria](criteria.md) we use to check applications for behaviors that are considered unwanted. + + - question: | + Why is the Windows Defender Firewall blocking my program? + answer: | + Firewall blocks aren't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Windows Defender Firewall](../windows-firewall/windows-firewall-with-advanced-security.md). + + - question: | + Why does the Microsoft Defender Windows Defender SmartScreen say my program isn't commonly downloaded? + answer: | + This isn't related to Microsoft Defender Antivirus and other Microsoft antimalware. [Learn about Microsoft Defender Windows Defender SmartScreen](../microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md) diff --git a/windows/security/threat-protection/intelligence/developer-resources.md b/windows/security/threat-protection/intelligence/developer-resources.md index 659eaad25b..3b7d080b28 100644 --- a/windows/security/threat-protection/intelligence/developer-resources.md +++ b/windows/security/threat-protection/intelligence/developer-resources.md @@ -37,7 +37,7 @@ To objectively identify malware and unidentified software, Microsoft applies a [ ### Developer questions -Find more guidance about the file submission and detection dispute process in our [FAQ for software developers](developer-faq.md). +Find more guidance about the file submission and detection dispute process in our [FAQ for software developers](developer-faq.yml). ### Scan your software diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index 39371c3da0..e2029f3c2c 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -99,7 +99,7 @@ Besides being vulnerable at the firmware level, CPUs could be manufactured with ## Defeating fileless malware -At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions to mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, Microsoft Defender for Endpoint](https://www.microsoft.com/windowsforbusiness?ocid=docs-fileless) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. +At Microsoft, we actively monitor the security landscape to identify new threat trends and develop solutions to mitigate classes of threats. We instrument durable protections that are effective against a wide range of threats. Through AntiMalware Scan Interface (AMSI), behavior monitoring, memory scanning, and boot sector protection, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) can inspect fileless threats even with heavy obfuscation. Machine learning technologies in the cloud allow us to scale these protections against new and emerging threats. To learn more, read: [Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV](https://cloudblogs.microsoft.com/microsoftsecure/2018/09/27/out-of-sight-but-not-invisible-defeating-fileless-malware-with-behavior-monitoring-amsi-and-next-gen-av/) diff --git a/windows/security/threat-protection/intelligence/ransomware-malware.md b/windows/security/threat-protection/intelligence/ransomware-malware.md index 4f7f59f8ff..5a04348f87 100644 --- a/windows/security/threat-protection/intelligence/ransomware-malware.md +++ b/windows/security/threat-protection/intelligence/ransomware-malware.md @@ -26,9 +26,9 @@ The trend towards increasingly sophisticated malware behavior, highlighted by th Most ransomware infections start with: -* Email messages with attachments that try to install ransomware. +- Email messages with attachments that try to install ransomware. -* Websites hosting [exploit kits](exploits-malware.md) that attempt to use vulnerabilities in web browsers and other software to install ransomware. +- Websites hosting [exploit kits](exploits-malware.md) that attempt to use vulnerabilities in web browsers and other software to install ransomware. Once ransomware infects a device, it starts encrypting files, folders, entire hard drive partitions using encryption algorithms like RSA or RC4. @@ -38,11 +38,11 @@ Ransomware is one of the most lucrative revenue channels for cybercriminals, so Sophisticated ransomware like **Spora**, **WannaCrypt** (also known as WannaCry), and **Petya** (also known as NotPetya) spread to other computers via network shares or exploits. -* Spora drops ransomware copies in network shares. +- Spora drops ransomware copies in network shares. -* WannaCrypt exploits the Server Message Block (SMB) vulnerability CVE-2017-0144 (also called EternalBlue) to infect other computers. +- WannaCrypt exploits the Server Message Block (SMB) vulnerability CVE-2017-0144 (also called EternalBlue) to infect other computers. -* A Petya variant exploits the same vulnerability, in addition to CVE-2017-0145 (also known as EternalRomance), and uses stolen credentials to move laterally across networks. +- A Petya variant exploits the same vulnerability, in addition to CVE-2017-0145 (also known as EternalRomance), and uses stolen credentials to move laterally across networks. Older ransomware like **Reveton** (nicknamed "Police Trojan" or "Police ransomware") locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they're effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and a fine needs to be paid. @@ -52,16 +52,26 @@ Ransomware like **Cerber** and **Locky** search for and encrypt specific file ty ## How to protect against ransomware - Organizations can be targeted specifically by attackers, or they can be caught in the wide net cast by cybercriminal operations. Large organizations are high value targets and attackers can demand bigger ransoms. +Organizations can be targeted specifically by attackers, or they can be caught in the wide net cast by cybercriminal operations. Large organizations are high value targets because attackers can demand bigger ransoms. -We recommend: +To provide the best protection against ransomware attacks, Microsoft recommends that you: -* Back up important files regularly. Use the 3-2-1 rule. Keep three backups of your data, on two different storage types, and at least one backup offsite. +- Back up important files regularly. Use the 3-2-1 rule. Keep three backups of your data, on two different storage types, and at least one backup offsite. -* Apply the latest updates to your operating systems and apps. +- Apply the latest updates to your operating systems and apps. -* Educate your employees so they can identify social engineering and spear-phishing attacks. +- Educate your employees so they can identify social engineering and spear-phishing attacks. -* [Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). It can stop ransomware from encrypting files and holding the files for ransom. +- [Implement controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders). It can stop ransomware from encrypting files and holding the files for ransom. -For more general tips, see [prevent malware infection](prevent-malware-infection.md). \ No newline at end of file +For more general tips, see [prevent malware infection](prevent-malware-infection.md). + +## Human-operated ransomware + +Unlike auto-spreading ransomware like WannaCry or NotPetya, human-operated ransomware is the result of active and ongoing attacks that target an organization rather than a single device. Cybercriminals use their knowledge of common system and security misconfigurations and vulnerabilities to infiltrate the organization, navigate the enterprise network, adapt to the environment, and exploit its weaknesses as they go. + +Hallmarks of these human-operated ransomware attacks typically include credential theft and lateral movement and can result in deployment of ransomware payloads to high business impact resources that attackers choose. Once deployed, the attackers contact the organization with their ransom demands. + +The same primary prevention techniques described in this article should be implemented to prevent human-operated ransomware. For additional preventative measures against human-operated ransomware, see this [article](/security/compass/human-operated-ransomware). + +See [this blog post](https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/) from the Microsoft 365 Defender Threat Intelligence Team for more information and attack chain analysis of actual human-operated ransomware attacks. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/TOC.yml b/windows/security/threat-protection/microsoft-defender-application-guard/TOC.yml index c77a91d3e5..ee887e168a 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/TOC.yml +++ b/windows/security/threat-protection/microsoft-defender-application-guard/TOC.yml @@ -12,4 +12,4 @@ - name: Microsoft Defender Application Guard Extension href: md-app-guard-browser-extension.md - name: FAQ - href: faq-md-app-guard.md + href: faq-md-app-guard.yml diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md index 208da5965e..593984f0dc 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 05/06/2021 +ms.date: 05/24/2021 ms.reviewer: manager: dansimp ms.custom: asr @@ -27,7 +27,7 @@ Application Guard uses both network isolation and application-specific settings. ## Network isolation settings -These settings, located at **Computer Configuration\Administrative Templates\Network\Network Isolation**, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. +These settings, located at `Computer Configuration\Administrative Templates\Network\Network Isolation`, help you define and manage your organization's network boundaries. Application Guard uses this information to automatically transfer any requests to access the non-corporate resources into the Application Guard container. > [!NOTE] > You must configure either the Enterprise resource domains hosted in the cloud or Private network ranges for apps settings on your employee devices to successfully turn on Application Guard using enterprise mode. Proxy servers must be a neutral resource listed in the "Domains categorized as both work and personal" policy. @@ -48,11 +48,11 @@ These settings, located at **Computer Configuration\Administrative Templates\Net |`..contoso.com`|2|Trust all levels of the domain hierarchy that are to the left of the dot. Matching sites include `shop.contoso.com`, `us.shop.contoso.com`, `www.us.shop.contoso.com`, but NOT `contoso.com` itself.| ## Application-specific settings -These settings, located at **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard**, can help you to manage your company's implementation of Application Guard. +These settings, located at `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard`, can help you to manage your company's implementation of Application Guard. |Name|Supported versions|Description|Options| |-----------|------------------|-----------|-------| -|Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:
-Disable the clipboard functionality completely when Virtualization Security is enabled.
- Enable copying of certain content from Application Guard into Microsoft Edge.
- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.

**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.| +|Configure Microsoft Defender Application Guard clipboard settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the clipboard functionality.|**Enabled.** Turns On the clipboard functionality and lets you choose whether to additionally:
- Disable the clipboard functionality completely when Virtualization Security is enabled.
- Enable copying of certain content from Application Guard into Microsoft Edge.
- Enable copying of certain content from Microsoft Edge into Application Guard. **Important:** Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended.

**Disabled or not configured.** Completely turns Off the clipboard functionality for Application Guard.| |Configure Microsoft Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use the print functionality.|**Enabled.** Turns On the print functionality and lets you choose whether to additionally:
- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for additional printers.

**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| |Block enterprise websites to load non-enterprise content in IE and Edge|Windows 10 Enterprise, 1709 or higher|Determines whether to allow Internet access for apps not included on the **Allowed Apps** list.|**Enabled.** Prevents network traffic from both Internet Explorer and Microsoft Edge to non-enterprise sites that can't render in the Application Guard container.

**NOTE**: This action might also block assets cached by CDNs and references to analytics sites. Add them to the trusted enterprise resources to avoid broken pages.

**Disabled or not configured.** Prevents Microsoft Edge to render network traffic to non-enterprise sites that can't render in Application Guard. | |Allow Persistence|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether data persists across different sessions in Microsoft Defender Application Guard.|**Enabled.** Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

**Disabled or not configured.** All user data within Application Guard is reset between sessions.

**NOTE**: If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.

**To reset the container:**
1. Open a command-line program and navigate to `Windows/System32`.
2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.
3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.| @@ -61,6 +61,3 @@ These settings, located at **Computer Configuration\Administrative Templates\Win |Allow hardware-accelerated rendering for Microsoft Defender Application Guard|Windows 10 Enterprise, 1803 or higher

Windows 10 Pro, 1803 or higher|Determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Be aware that enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.

**Disabled or not configured.** Microsoft Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.| |Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Be aware that enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| |Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise, 1809 or higher

Windows 10 Pro, 1809 or higher|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

**Disabled or not configured.** Certificates are not shared with Microsoft Defender Application Guard.| -|Allow users to trust files that open in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher|Determines whether users are able to manually trust untrusted files to open them on the host.|**Enabled.** Users are able to manually trust files or trust files after an antivirus check.

**Disabled or not configured.** Users are unable to manually trust files and files continue to open in Microsoft Defender Application Guard.| -|Allow extensions in the container|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether Application Guard can use extensions.|**Enabled.** Favorites are able to sync from the host browser to the container. Note that this doesn’t work the other way around. The favorites sync to the user’s work profile by default.

**Disabled.** Users are not able to access their favorites from within the Application Guard container.| -|Allow favorites sync|Windows 10 Enterprise, 1709 or higher

Windows 10 Pro, 1803 or higher|Determines whether favorites can be accessible from Application Guard container.|**Enabled.** Favorites are able to sync from the host browser to the container, but it doesn’t work the other way around. The favorites sync to the user’s work profile by default.

**Disabled.** Users are not able to access their favorites from within the Application Guard container. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md deleted file mode 100644 index 0e4406aaa5..0000000000 --- a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.md +++ /dev/null @@ -1,210 +0,0 @@ ---- -title: FAQ - Microsoft Defender Application Guard (Windows 10) -description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard. -ms.prod: m365-security -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: denisebmsft -ms.author: deniseb -ms.date: 05/12/2021 -ms.reviewer: -manager: dansimp -ms.custom: asr -ms.technology: mde ---- - -# Frequently asked questions - Microsoft Defender Application Guard - -**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) - -This article lists frequently asked questions with answers for Microsoft Defender Application Guard (Application Guard). Questions span features, integration with the Windows operating system, and general configuration. - -## Frequently Asked Questions - -### Can I enable Application Guard on machines equipped with 4-GB RAM? - -We recommend 8-GB RAM for optimal performance but you can use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. - -`HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount` (Default is four cores.) - -`HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB` (Default is 8 GB.) - -`HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB` (Default is 5 GB.) - -### Can employees download documents from the Application Guard Edge session onto host devices? - -In Windows 10 Enterprise edition, version 1803, users are able to download documents from the isolated Application Guard container to the host PC. This capability is managed by policy. - -In Windows 10 Enterprise edition, version 1709, or Windows 10 Professional edition, version 1803, it is not possible to download files from the isolated Application Guard container to the host computer. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device. - -### Can employees copy and paste between the host device and the Application Guard Edge session? - -Depending on your organization's settings, employees can copy and paste images (.bmp) and text to and from the isolated container. - -### Why don't employees see their favorites in the Application Guard Edge session? - -Depending on your organization’s settings, it might be that Favorites Sync is turned off. To manage the policy, see: [Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs](/deployedge/microsoft-edge-security-windows-defender-application-guard) - -### Why aren’t employees able to see their extensions in the Application Guard Edge session? - -Make sure to enable the extensions policy on your Application Guard configuration. - -### How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? - -Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition, version 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. - -### Which Input Method Editors (IME) in 19H1 are not supported? - -The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Microsoft Defender Application Guard: - -- Vietnam Telex keyboard -- Vietnam number key-based keyboard -- Hindi phonetic keyboard -- Bangla phonetic keyboard -- Marathi phonetic keyboard -- Telugu phonetic keyboard -- Tamil phonetic keyboard -- Kannada phonetic keyboard -- Malayalam phonetic keyboard -- Gujarati phonetic keyboard -- Odia phonetic keyboard -- Punjabi phonetic keyboard - -### I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering? - -This feature is currently experimental only and is not functional without an additional registry key provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, contact Microsoft and we’ll work with you to enable the feature. - -### What is the WDAGUtilityAccount local account? - -WDAGUtilityAccount is part of Application Guard, beginning with Windows 10, version 1709 (Fall Creators Update). It remains disabled by default, unless Application Guard is enabled on your device. WDAGUtilityAccount is used to sign in to the Application Guard container as a standard user with a random password. It is NOT a malicious account. If *Run as a service* permissions are revoked for this account, you might see the following error: - -**Error: 0x80070569, Ext error: 0x00000001; RDP: Error: 0x00000000, Ext error: 0x00000000 Location: 0x00000000** - -We recommend that you do not modify this account. - -### How do I trust a subdomain in my site list? - -To trust a subdomain, you must precede your domain with two dots (..). For example: `..contoso.com` ensures that `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), and the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted. - -### Are there differences between using Application Guard on Windows Pro vs Windows Enterprise? - -When using Windows Pro or Windows Enterprise, you have access to using Application Guard in Standalone Mode. However, when using Enterprise you have access to Application Guard in Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](./install-md-app-guard.md). - -### Is there a size limit to the domain lists that I need to configure? - -Yes, both the Enterprise Resource domains that are hosted in the cloud and the domains that are categorized as both work and personal have a 16383-B limit. - -### Why does my encryption driver break Microsoft Defender Application Guard? - -Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (**0x80070013 ERROR_WRITE_PROTECT**). - -### Why do the Network Isolation policies in Group Policy and CSP look different? - -There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy Application Guard are different between CSP and GP. - -- Mandatory network isolation GP policy to deploy Application Guard: **DomainSubnets or CloudResources** - -- Mandatory network isolation CSP policy to deploy Application Guard: **EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)** - -- For EnterpriseNetworkDomainNames, there is no mapped CSP policy. - -Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (**0x80070013 ERROR_WRITE_PROTECT**). - -### Why did Application Guard stop working after I turned off hyperthreading? - -If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements. - -### Why am I getting the error message "ERROR_VIRTUAL_DISK_LIMITATION"? - -Application Guard might not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume. - -### Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach the PAC file? - -This is a known issue. To mitigate this you need to create two firewall rules. For information about creating a firewall rule by using Group Policy, see the following resources: - -- [Create an inbound icmp rule](../windows-firewall/create-an-inbound-icmp-rule.md) -- [Open Group Policy management console for Microsoft Defender Firewall](../windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) - -#### First rule (DHCP Server) -1. Program path: `%SystemRoot%\System32\svchost.exe` - -2. Local Service: `Sid: S-1-5-80-2009329905-444645132-2728249442-922493431-93864177 (Internet Connection Service (SharedAccess))` - -3. Protocol UDP - -4. Port 67 - -#### Second rule (DHCP Client) -This is the same as the first rule, but scoped to local port 68. In the Microsoft Defender Firewall user interface go through the following steps: - -1. Right-click on inbound rules, and then create a new rule. - -2. Choose **custom rule**. - -3. Specify the following program path: `%SystemRoot%\System32\svchost.exe`. - -4. Specify the following settings: - - Protocol Type: UDP - - Specific ports: 67 - - Remote port: any - -5. Specify any IP addresses. - -6. Allow the connection. - -7. Specify to use all profiles. - -8. The new rule should show up in the user interface. Right click on the **rule** > **properties**. - -9. In the **Programs and services** tab, under the **Services** section, select **settings**. - -10. Choose **Apply to this Service** and select **Internet Connection Sharing (ICS) Shared Access**. - -### Why can I not launch Application Guard when Exploit Guard is enabled? - -There is a known issue such that if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to **Windows Security** > **App and Browser control** > **Exploit Protection Setting**, and then switch CFG to **use default**. - -### How can I disable portions of ICS without breaking Application Guard? - -ICS is enabled by default in Windows, and ICS must be enabled in order for Application Guard to function correctly. We do not recommend disabling ICS; however, you can disable ICS in part by using a Group Policy and editing registry keys. - -1. In the Group Policy setting, **Prohibit use of Internet Connection Sharing on your DNS domain network**, set it to **Disabled**. - -2. Disable IpNat.sys from ICS load as follows:
-`System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1` - -3. Configure ICS (SharedAccess) to enabled as follows:
-`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3` - -4. (This is optional) Disable IPNAT as follows:
-`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4` - -5. Reboot the device. - -### Why doesn't the container fully load when device control policies are enabled? - -Allow-listed items must be configured as "allowed" in the Group Policy Object to ensure AppGuard works properly. - -Policy: Allow installation of devices that match any of the following device IDs: - -- `SCSI\DiskMsft____Virtual_Disk____` -- `{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\msvhdhba` -- `VMS_VSF` -- `root\Vpcivsp` -- `root\VMBus` -- `vms_mp` -- `VMS_VSP` -- `ROOT\VKRNLINTVSP` -- `ROOT\VID` -- `root\storvsp` -- `vms_vsmp` -- `VMS_PP` - -Policy: Allow installation of devices using drivers that match these device setup classes -- `{71a27cdd-812a-11d0-bec7-08002be2092f}` - -## See also - -[Configure Microsoft Defender Application Guard policy settings](./configure-md-app-guard.md) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml new file mode 100644 index 0000000000..98fc46090b --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -0,0 +1,251 @@ +### YamlMime:FAQ +metadata: + title: FAQ - Microsoft Defender Application Guard (Windows 10) + description: Learn about the commonly asked questions and answers for Microsoft Defender Application Guard. + ms.prod: m365-security + ms.mktglfcycl: manage + ms.sitesec: library + ms.pagetype: security + ms.localizationpriority: medium + author: denisebmsft + ms.author: deniseb + ms.date: 06/16/2021 + ms.reviewer: + manager: dansimp + ms.custom: asr + ms.technology: mde + +title: Frequently asked questions - Microsoft Defender Application Guard +summary: | + **Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2069559) + + This article lists frequently asked questions with answers for Microsoft Defender Application Guard (Application Guard). Questions span features, integration with the Windows operating system, and general configuration. + + ## Frequently Asked Questions + +sections: + - name: Frequently Asked Questions + questions: + - question: | + Can I enable Application Guard on machines equipped with 4-GB RAM? + answer: | + We recommend 8-GB RAM for optimal performance but you can use the following registry DWORD values to enable Application Guard on machines that aren't meeting the recommended hardware configuration. + + `HKLM\software\Microsoft\Hvsi\SpecRequiredProcessorCount` (Default is four cores.) + + `HKLM\software\Microsoft\Hvsi\SpecRequiredMemoryInGB` (Default is 8 GB.) + + `HKLM\software\Microsoft\Hvsi\SpecRequiredFreeDiskSpaceInGB` (Default is 5 GB.) + + - question: | + My network configuration uses a proxy and I’m running into a “Cannot resolve External URLs from MDAG Browser: Error: err_connection_refused”. How do I resolve that? + answer: | + The manual or PAC server must be a hostname (not IP) that is neutral on the site-list. Additionally, if the PAC script returns a proxy, it must meet those same requirements. + + To make sure the FQDNs (Fully Qualified Domain Names) for the “PAC file” and the “proxy servers the PAC file redirects to” are added as Neutral Resources in the Network Isolation policies used by Application Guard, you can: + + - Verify this by going to edge://application-guard-internals/#utilities and entering the FQDN for the pac/proxy in the “check url trust” field and verifying that it says “Neutral”. + - It must be a FQDN. A simple IP address will not work. + - Optionally, if possible, the IP addresses associated with the server hosting the above should be removed from the Enterprise IP Ranges in the Network Isolation policies used by Application Guard. + + - question: | + Can employees download documents from the Application Guard Edge session onto host devices? + answer: | + In Windows 10 Enterprise edition, version 1803, users are able to download documents from the isolated Application Guard container to the host PC. This capability is managed by policy. + + In Windows 10 Enterprise edition, version 1709, or Windows 10 Professional edition, version 1803, it is not possible to download files from the isolated Application Guard container to the host computer. However, employees can use the **Print as PDF** or **Print as XPS** options and save those files to the host device. + + - question: | + Can employees copy and paste between the host device and the Application Guard Edge session? + answer: | + Depending on your organization's settings, employees can copy and paste images (.bmp) and text to and from the isolated container. + + - question: | + Why don't employees see their favorites in the Application Guard Edge session? + answer: | + Depending on your organization’s settings, it might be that Favorites Sync is turned off. To manage the policy, see: [Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs](/deployedge/microsoft-edge-security-windows-defender-application-guard). + + - question: | + Why aren’t employees able to see their extensions in the Application Guard Edge session? + answer: | + Make sure to enable the extensions policy on your Application Guard configuration. + + - question: | + I’m trying to watch playback video with HDR, why is the HDR option missing? + answer: | + In order for HDR video playback to work in the container, vGPU Hardware Acceleration needs to be enabled in Application Guard. + + - question: | + How do I configure Microsoft Defender Application Guard to work with my network proxy (IP-Literal Addresses)? + answer: | + Application Guard requires proxies to have a symbolic name, not just an IP address. IP-Literal proxy settings such as `192.168.1.4:81` can be annotated as `itproxy:81` or using a record such as `P19216810010` for a proxy with an IP address of `192.168.100.10`. This applies to Windows 10 Enterprise edition, version 1709 or higher. These would be for the proxy policies under Network Isolation in Group Policy or Intune. + + - question: | + Which Input Method Editors (IME) in 19H1 are not supported? + answer: | + The following Input Method Editors (IME) introduced in Windows 10, version 1903 are currently not supported in Microsoft Defender Application Guard: + + - Vietnam Telex keyboard + - Vietnam number key-based keyboard + - Hindi phonetic keyboard + - Bangla phonetic keyboard + - Marathi phonetic keyboard + - Telugu phonetic keyboard + - Tamil phonetic keyboard + - Kannada phonetic keyboard + - Malayalam phonetic keyboard + - Gujarati phonetic keyboard + - Odia phonetic keyboard + - Punjabi phonetic keyboard + + - question: | + I enabled the hardware acceleration policy on my Windows 10 Enterprise, version 1803 deployment. Why are my users still only getting CPU rendering? + answer: | + This feature is currently experimental only and is not functional without an additional registry key provided by Microsoft. If you would like to evaluate this feature on a deployment of Windows 10 Enterprise, version 1803, contact Microsoft and we’ll work with you to enable the feature. + + - question: | + What is the WDAGUtilityAccount local account? + answer: | + WDAGUtilityAccount is part of Application Guard, beginning with Windows 10, version 1709 (Fall Creators Update). It remains disabled by default, unless Application Guard is enabled on your device. WDAGUtilityAccount is used to sign in to the Application Guard container as a standard user with a random password. It is NOT a malicious account. If *Run as a service* permissions are revoked for this account, you might see the following error: + + **Error: 0x80070569, Ext error: 0x00000001; RDP: Error: 0x00000000, Ext error: 0x00000000 Location: 0x00000000** + + We recommend that you do not modify this account. + + - question: | + How do I trust a subdomain in my site list? + answer: | + To trust a subdomain, you must precede your domain with two dots (..). For example: `..contoso.com` ensures that `mail.contoso.com` or `news.contoso.com` are trusted. The first dot represents the strings for the subdomain name (mail or news), and the second dot recognizes the start of the domain name (`contoso.com`). This prevents sites such as `fakesitecontoso.com` from being trusted. + + - question: | + Are there differences between using Application Guard on Windows Pro vs Windows Enterprise? + answer: | + When using Windows Pro or Windows Enterprise, you have access to using Application Guard in Standalone Mode. However, when using Enterprise you have access to Application Guard in Enterprise-Managed Mode. This mode has some extra features that the Standalone Mode does not. For more information, see [Prepare to install Microsoft Defender Application Guard](./install-md-app-guard.md). + + - question: | + Is there a size limit to the domain lists that I need to configure? + answer: | + Yes, both the Enterprise Resource domains that are hosted in the cloud and the domains that are categorized as both work and personal have a 16383-B limit. + + - question: | + Why does my encryption driver break Microsoft Defender Application Guard? + answer: | + Microsoft Defender Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (**0x80070013 ERROR_WRITE_PROTECT**). + + - question: | + Why do the Network Isolation policies in Group Policy and CSP look different? + answer: | + There is not a one-to-one mapping among all the Network Isolation policies between CSP and GP. Mandatory network isolation policies to deploy Application Guard are different between CSP and GP. + + - Mandatory network isolation GP policy to deploy Application Guard: **DomainSubnets or CloudResources** + + - Mandatory network isolation CSP policy to deploy Application Guard: **EnterpriseCloudResources or (EnterpriseIpRange and EnterpriseNetworkDomainNames)** + + - For EnterpriseNetworkDomainNames, there is no mapped CSP policy. + + Application Guard accesses files from a VHD mounted on the host that needs to be written during setup. If an encryption driver prevents a VHD from being mounted or from being written to, Application Guard does not work and results in an error message (**0x80070013 ERROR_WRITE_PROTECT**). + + - question: | + Why did Application Guard stop working after I turned off hyperthreading? + answer: | + If hyperthreading is disabled (because of an update applied through a KB article or through BIOS settings), there is a possibility Application Guard no longer meets the minimum requirements. + + - question: | + Why am I getting the error message "ERROR_VIRTUAL_DISK_LIMITATION"? + answer: | + Application Guard might not work correctly on NTFS compressed volumes. If this issue persists, try uncompressing the volume. + + - question: | + Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach the PAC file? + answer: | + This is a known issue. To mitigate this you need to create two firewall rules. For information about creating a firewall rule by using Group Policy, see the following resources: + + - [Create an inbound icmp rule](../windows-firewall/create-an-inbound-icmp-rule.md) + - [Open Group Policy management console for Microsoft Defender Firewall](../windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) + + ### First rule (DHCP Server) + - Program path: `%SystemRoot%\System32\svchost.exe` + + - Local Service: `Sid: S-1-5-80-2009329905-444645132-2728249442-922493431-93864177 (Internet Connection Service (SharedAccess))` + + - Protocol UDP + + - Port 67 + + ### Second rule (DHCP Client) + This is the same as the first rule, but scoped to local port 68. In the Microsoft Defender Firewall user interface go through the following steps: + + 1. Right-click on inbound rules, and then create a new rule. + + 2. Choose **custom rule**. + + 3. Specify the following program path: `%SystemRoot%\System32\svchost.exe`. + + 4. Specify the following settings: + - Protocol Type: UDP + - Specific ports: 67 + - Remote port: any + + 5. Specify any IP addresses. + + 6. Allow the connection. + + 7. Specify to use all profiles. + + 8. The new rule should show up in the user interface. Right click on the **rule** > **properties**. + + 9. In the **Programs and services** tab, under the **Services** section, select **settings**. + + 10. Choose **Apply to this Service** and select **Internet Connection Sharing (ICS) Shared Access**. + + - question: | + Why can I not launch Application Guard when Exploit Guard is enabled? + answer: | + There is a known issue such that if you change the Exploit Protection settings for CFG and possibly others, hvsimgr cannot launch. To mitigate this issue, go to **Windows Security** > **App and Browser control** > **Exploit Protection Setting**, and then switch CFG to **use default**. + + - question: | + How can I disable portions of ICS without breaking Application Guard? + answer: | + ICS is enabled by default in Windows, and ICS must be enabled in order for Application Guard to function correctly. We do not recommend disabling ICS; however, you can disable ICS in part by using a Group Policy and editing registry keys. + + 1. In the Group Policy setting, **Prohibit use of Internet Connection Sharing on your DNS domain network**, set it to **Disabled**. + + 2. Disable IpNat.sys from ICS load as follows:
+ `System\CurrentControlSet\Services\SharedAccess\Parameters\DisableIpNat = 1` + + 3. Configure ICS (SharedAccess) to enabled as follows:
+ `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Start = 3` + + 4. (This is optional) Disable IPNAT as follows:
+ `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNat\Start = 4` + + 5. Reboot the device. + + - question: | + Why doesn't the container fully load when device control policies are enabled? + answer: | + Allow-listed items must be configured as "allowed" in the Group Policy Object to ensure AppGuard works properly. + + Policy: Allow installation of devices that match any of the following device IDs: + + - `SCSI\DiskMsft____Virtual_Disk____` + - `{8e7bd593-6e6c-4c52-86a6-77175494dd8e}\msvhdhba` + - `VMS_VSF` + - `root\Vpcivsp` + - `root\VMBus` + - `vms_mp` + - `VMS_VSP` + - `ROOT\VKRNLINTVSP` + - `ROOT\VID` + - `root\storvsp` + - `vms_vsmp` + - `VMS_PP` + + Policy: Allow installation of devices using drivers that match these device setup classes + - `{71a27cdd-812a-11d0-bec7-08002be2092f}` + +additionalContent: | + + ## See also + + [Configure Microsoft Defender Application Guard policy settings](./configure-md-app-guard.md) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 9c41f91b39..83850f5a21 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -52,5 +52,5 @@ Application Guard has been created to target several types of devices: |[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| | [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide | | [Microsoft Defender Application Guard for Microsoft Office](/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | -|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| +|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.yml)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| |[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.| \ No newline at end of file diff --git a/windows/security/threat-protection/security-compliance-toolkit-10.md b/windows/security/threat-protection/security-compliance-toolkit-10.md index 3662667af2..2a578d07ab 100644 --- a/windows/security/threat-protection/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/security-compliance-toolkit-10.md @@ -28,13 +28,13 @@ The SCT enables administrators to effectively manage their enterprise’s Group The Security Compliance Toolkit consists of: - Windows 10 security baselines - - Windows 10 Version 20H2 (October 2020 Update) - - Windows 10 Version 2004 (May 2020 Update) - - Windows 10 Version 1909 (November 2019 Update) - - Windows 10 Version 1809 (October 2018 Update) - - Windows 10 Version 1803 (April 2018 Update) - - Windows 10 Version 1607 (Anniversary Update) - - Windows 10 Version 1507 + - Windows 10, Version 21H1 (May 2021 Update) + - Windows 10, Version 20H2 (October 2020 Update) + - Windows 10, Version 2004 (May 2020 Update) + - Windows 10, Version 1909 (November 2019 Update) + - Windows 10, Version 1809 (October 2018 Update) + - Windows 10, Version 1607 (Anniversary Update) + - Windows 10, Version 1507 - Windows Server security baselines - Windows Server 2019 @@ -42,7 +42,7 @@ The Security Compliance Toolkit consists of: - Windows Server 2012 R2 - Microsoft Office security baseline - - Microsoft 365 Apps for enterprise (Sept 2019) + - Microsoft 365 Apps for enterprise, Version 2104 - Microsoft Edge security baseline - Version 88 diff --git a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md index d20934b1f3..55c80b17f7 100644 --- a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md +++ b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md @@ -14,17 +14,20 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/19/2017 +ms.date: 06/11/2021 ms.technology: mde --- # Access this computer from the network - security policy setting **Applies to** -- Windows 10 +- Windows 10, Azure Stack HCI, Windows Server 2022, Windows Server 2019, Windows Server 2016 Describes the best practices, location, values, policy management, and security considerations for the **Access this computer from the network** security policy setting. +> [!WARNING] +> If running Windows Server or Azure Stack HCI Failover Clustering, don't remove Authenticated Users from the **Access this computer from the network** policy setting. Doing so may induce an unexpected production outage. This is due to the local user account CLIUSR that is used to run the cluster service. CLIUSR is not a member of the local Administrators group and if the Authenticated Users group is removed, the cluster service won't have sufficient rights to function or start properly. + ## Reference The **Access this computer from the network** policy setting determines which users can connect to the device from the network. This capability is required by a number of network protocols, including Server Message Block (SMB)-based protocols, NetBIOS, Common Internet File System (CIFS), and Component Object Model Plus (COM+). @@ -43,6 +46,7 @@ Constant: SeNetworkLogonRight - On desktop devices or member servers, grant this right only to users and administrators. - On domain controllers, grant this right only to authenticated users, enterprise domain controllers, and administrators. +- On failover clusters, make sure this right is granted to authenticated users. - This setting includes the **Everyone** group to ensure backward compatibility. Upon Windows upgrade, after you have verified that all users and groups are correctly migrated, you should remove the **Everyone** group and use the **Authenticated Users** group instead. ### Location @@ -104,6 +108,8 @@ from servers in the domain if members of the **Domain Users** group are included If you remove the **Access this computer from the network** user right on domain controllers for all users, no one can log on to the domain or use network resources. If you remove this user right on member servers, users cannot connect to those servers through the network. If you have installed optional components such as ASP.NET or Internet Information Services (IIS), you may need to assign this user right to additional accounts that are required by those components. It is important to verify that authorized users are assigned this user right for the devices that they need to access the network. +If running Windows Server or Azure Stack HCI Failover Clustering, do not remove Authenticated Users from the Access this computer from the network policy setting. Doing so may induce an unexpected production outage. This is due to the local user account CLIUSR that is used to run the cluster service. CLIUSR is not a member of the local Administrators group and if the Authenticated Users group is removed, the cluster service will not have sufficient rights to function or start properly. + ## Related topics [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index 716b1da171..671eb87720 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -74,17 +74,18 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft account. That account can then log on to a peer device (if the peer device is likewise configured) without the use of a Windows logon account (domain or local). This setup is beneficial for workgroups or home groups. But in a domain-joined environment, it might circumvent established security policies. +Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft account or an Azure AD account. That account can then log on to a peer device (if the peer device is likewise configured) without the use of a Windows logon account (domain or local). This setup is not only beneficial, but required for Azure AD joined devices, where they are signed in with an online identity and are issued certificates by Azure AD. This policy may not be relevant for an *on-premises only* environment and might circumvent established security policies. However, it does not pose any threats in a hybrid environment where Azure AD is used as it relies on the user's online identity and Azure AD to authenticate. ### Countermeasure -Set this policy to *Disabled* or don't configure this security policy for domain-joined devices. +Set this policy to *Disabled* or don't configure this security policy for *on-premises only* environments. ### Potential impact -If you don't set or you disable this policy, the PKU2U protocol won't be used to authenticate between peer devices, which forces users to follow domain-defined access control policies. If you enable this policy, you allow your users to authenticate by using local certificates between systems that aren't part of a domain that uses PKU2U. This configuration allows users to share resources between devices. +If you don't set or you disable this policy, the PKU2U protocol won't be used to authenticate between peer devices, which forces users to follow domain-defined access control policies. This is a valid configuration in *on-premises only* environments. Please be aware that some roles/features (such as Failover Clustering) do not utilize a domain account for its PKU2U authentication and will cease to function properly when disabling this policy. + +If you enable this policy in a hybrid environment, you allow your users to authenticate by using certificates issued by Azure AD and their online identity between the corresponding devices. This configuration allows users to share resources between such devices. Without enabling this policy, remote connections to an Azure AD joined device will not work. -Please be aware that some roles/features (such as Failover Clustering) do not utilize a domain account for its PKU2U authentication and will cease to function properly when disabling this policy. ## Related topics diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.yml b/windows/security/threat-protection/windows-defender-application-control/TOC.yml index eaf0d1aa66..2a9d13497a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.yml +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.yml @@ -21,9 +21,7 @@ href: select-types-of-rules-to-create.md items: - name: Allow apps installed by a managed installer - href: use-windows-defender-application-control-with-managed-installer.md - - name: Configure managed installer rules - href: configure-wdac-managed-installer.md + href: configure-authorized-apps-deployed-with-a-managed-installer.md - name: Allow reputable apps with Intelligent Security Graph (ISG) href: use-windows-defender-application-control-with-intelligent-security-graph.md - name: Allow COM object registration diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index b7dcbcddd8..29d54546be 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -83,7 +83,7 @@ The following are examples of scenarios in which AppLocker can be used: - In addition to other measures, you need to control the access to sensitive data through app usage. > [!NOTE] -> AppLocker is a defense-in-depth security feature and **not** a [security boundary](https://www.microsoft.com/msrc/windows-security-servicing-criteria). [Windows Defender Application Control](https://www.microsoft.com/msrc/windows-security-servicing-criteria) should be used when the goal is to provide robust protection against a threat and there are expected to be no by-design limitations that would prevent the security feature from achieving this goal. +> AppLocker is a defense-in-depth security feature and not a [security boundary](https://www.microsoft.com/msrc/windows-security-servicing-criteria). [Windows Defender Application Control](/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview) should be used when the goal is to provide robust protection against a threat and there are expected to be no by-design limitations that would prevent the security feature from achieving this goal. AppLocker can help you protect the digital assets within your organization, reduce the threat of malicious software being introduced into your environment, and improve the management of application control and the maintenance of application control policies. @@ -143,4 +143,3 @@ For reference in your security planning, the following table identifies the base | [AppLocker design guide](applocker-policies-design-guide.md) | This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. | | [AppLocker deployment guide](applocker-policies-deployment-guide.md) | This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. | | [AppLocker technical reference](applocker-technical-reference.md) | This overview topic for IT professionals provides links to the topics in the technical reference. | - diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md new file mode 100644 index 0000000000..c1d7ac7c71 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md @@ -0,0 +1,161 @@ +--- +title: Use audit events to create then enforce WDAC policy rules (Windows 10) +description: Learn how audits allow admins to discover apps, binaries, and scripts that should be added to a WDAC policy, then learn how to switch that WDAC policy from audit to enforced mode. +keywords: security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: jogeurte +ms.author: dansimp +manager: dansimp +ms.date: 05/03/2021 +ms.technology: mde +--- + +# Use audit events to create WDAC policy rules and Convert **base** policy from audits to enforced + +**Applies to:** + +- Windows 10 +- Windows Server 2016 and above + +Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included. + +While a WDAC policy is running in audit mode, any binary that runs but would have been denied is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. Script and MSI are logged in the **Applications and Services Logs\\Microsoft\\Windows\\AppLocker\\MSI and Script** event log. These events can be used to generate a new WDAC policy that can be merged with the original Base policy or deployed as a separate Supplemental policy, if allowed. + +## Overview of the process to create WDAC policy to allow apps using audit events + +> [!NOTE] +> You must have already deployed a WDAC audit mode policy to use this process. If you have not already done so, see [Deploying Windows Defender Application Control policies](windows-defender-application-control-deployment-guide.md). + +To familiarize yourself with creating WDAC rules from audit events, follow these steps on a device with a WDAC audit mode policy. + +1. Install and run an application not allowed by the WDAC policy but that you want to allow. + +2. Review the **CodeIntegrity - Operational** and **AppLocker - MSI and Script** event logs to confirm events, like those shown in Figure 1, are generated related to the application. For information about the types of events you should see, refer to [Understanding Application Control events](event-id-explanations.md). + + **Figure 1. Exceptions to the deployed WDAC policy**
+ + ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) + +3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. + + ```powershell + $PolicyName= "Lamna_FullyManagedClients_Audit" + $LamnaPolicy=$env:userprofile+"\Desktop\"+$PolicyName+".xml" + $EventsPolicy=$env:userprofile+"\Desktop\EventsPolicy.xml" + $EventsPolicyWarnings=$env:userprofile+"\Desktop\EventsPolicyWarnings.txt" + ``` + +4. Use [New-CIPolicy](/powershell/module/configci/new-cipolicy) to generate a new WDAC policy from logged audit events. This example uses a **FilePublisher** file rule level and a **Hash** fallback level. Warning messages are redirected to a text file **EventsPolicyWarnings.txt**. + + ```powershell + New-CIPolicy -FilePath $EventsPolicy -Audit -Level FilePublisher -Fallback Hash –UserPEs -MultiplePolicyFormat 3> $EventsPolicyWarnings + ``` + + > [!NOTE] + > When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **FilePublisher** rule level with a fallback level of **Hash**, which may be more specific than desired. You can re-run the above command using different **-Level** and **-Fallback** options to meet your needs. For more information about WDAC rule levels, see [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md). + +5. Find and review the WDAC policy file **EventsPolicy.xml** that should be found on your desktop. Ensure that it only includes file and signer rules for applications, binaries, and scripts you wish to allow. You can remove rules by manually editing the policy XML or use the WDAC Policy Wizard tool (see [Editing existing base and supplemental WDAC policies with the Wizard](wdac-wizard-editing-policy.md)). + +6. Find and review the text file **EventsPolicyWarnings.txt** that should be found on your desktop. This file will include a warning for any files that WDAC couldn't create a rule for at either the specified rule level or fallback rule level. + + > [!NOTE] + > New-CIPolicy only creates rules for files that can still be found on disk. Files which are no longer present on the system will not have a rule created to allow them. However, the event log should have sufficient information to allow these files by manually editing the policy XML to add rules. You can use an existing rule as a template and verify your results against the WDAC policy schema definition found at **%windir%\schemas\CodeIntegrity\cipolicy.xsd**. + +7. Merge **EventsPolicy.xml** with the Base policy **Lamna_FullyManagedClients_Audit.xml** or convert it to a supplemental policy. + + For information on merging policies, refer to [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) and for information on supplemental policies see [Use multiple Windows Defender Application Control Policies](deploy-multiple-windows-defender-application-control-policies.md). + +8. Convert the Base or Supplemental policy to binary and deploy using your preferred method. + +## Convert WDAC **BASE** policy from audit to enforced + +As described in [common WDAC deployment scenarios](types-of-devices.md), we'll use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. + +**Alice Pena** is the IT team lead responsible for Lamna's WDAC rollout. + +Alice previously created and deployed a policy for the organization's [fully managed devices](create-wdac-policy-for-fully-managed-devices.md). They updated the policy based on audit event data as described in [Use audit events to create WDAC policy rules](audit-windows-defender-application-control-policies.md) and redeployed it. All remaining audit events are as expected and Alice is ready to switch to enforcement mode. + +1. Initialize the variables that will be used and create the enforced policy by copying the audit version. + + ```powershell + $EnforcedPolicyName = "Lamna_FullyManagedClients_Enforced" + $AuditPolicyXML = $env:USERPROFILE+"\Desktop\Lamna_FullyManagedClients_Audit.xml" + $EnforcedPolicyXML = $env:USERPROFILE+"\Desktop\"+$EnforcedPolicyName+".xml" + cp $AuditPolicyXML $EnforcedPolicyXML + ``` + +2. Use [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo) to give the new policy a unique ID, and descriptive name. Changing the ID and name lets you deploy the enforced policy side by side with the audit policy. Do this step if you plan to harden your WDAC policy over time. If you prefer to replace the audit policy in-place, you can skip this step. + + ```powershell + $EnforcedPolicyID = Set-CIPolicyIdInfo -FilePath $EnforcedPolicyXML -PolicyName $EnforcedPolicyName -ResetPolicyID + $EnforcedPolicyID = $EnforcedPolicyID.Substring(11) + ``` + + > [!NOTE] + > If Set-CIPolicyIdInfo does not output the new PolicyID value on your Windows 10 version, you will need to obtain the *PolicyId* value from the XML directly. + +3. *[Optionally]* Use [Set-RuleOption](/powershell/module/configci/set-ruleoption) to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”). Option 9 allows users to disable WDAC enforcement for a single boot session from a pre-boot menu. Option 10 instructs Windows to switch the policy from enforcement to audit only if a boot critical kernel-mode driver is blocked. We strongly recommend these options when deploying a new enforced policy to your first deployment ring. Then, if no issues are found, you can remove the options and restart your deployment. + + ```powershell + Set-RuleOption -FilePath $EnforcedPolicyXML -Option 9 + Set-RuleOption -FilePath $EnforcedPolicyXML -Option 10 + ``` + +4. Use Set-RuleOption to delete the audit mode rule option, which changes the policy to enforcement: + + ```powershell + Set-RuleOption -FilePath $EnforcedPolicyXML -Option 3 -Delete + ``` + +5. Use [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) to convert the new WDAC policy to binary: + + > [!NOTE] + > If you did not use -ResetPolicyID in Step 2 above, then you must replace $EnforcedPolicyID in the following command with the *PolicyID* attribute found in your base policy XML. + + ```powershell + $EnforcedPolicyBinary = $env:USERPROFILE+"\Desktop\"+$EnforcedPolicyName+"_"+$EnforcedPolicyID+".xml" + ConvertFrom-CIPolicy $EnforcedPolicyXML $EnforcedPolicyBinary + ``` + +## Make copies of any needed **supplemental** policies to use with the enforced base policy + +Since the enforced policy was given a unique PolicyID in the previous procedure, you need to duplicate any needed supplemental policies to use with the enforced policy. Supplemental policies always inherit the Audit or Enforcement mode from the base policy they modify. If you didn't reset the enforcement base policy's PolicyID, you can skip this procedure. + +1. Initialize the variables that will be used and create a copy of the current supplemental policy. Some variables and files from the previous procedure will also be used. + + ```powershell + $SupplementalPolicyName = "Lamna_Supplemental1" + $CurrentSupplementalPolicy = $env:USERPROFILE+"\Desktop\"+$SupplementalPolicyName+"_Audit.xml" + $EnforcedSupplementalPolicy = $env:USERPROFILE+"\Desktop\"+$SupplementalPolicyName+"_Enforced.xml" + ``` + +2. Use [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo) to give the new supplemental policy a unique ID and descriptive name, and change which base policy to supplement. + + ```powershell + $SupplementalPolicyID = Set-CIPolicyIdInfo -FilePath $EnforcedSupplementalPolicy -PolicyName $SupplementalPolicyName -SupplementsBasePolicyID $EnforcedPolicyID -BasePolicyToSupplementPath $EnforcedPolicyXML -ResetPolicyID + $SupplementalPolicyID = $SupplementalPolicyID.Substring(11) + ``` + + > [!NOTE] + > If Set-CIPolicyIdInfo does not output the new PolicyID value on your Windows 10 version, you will need to obtain the *PolicyId* value from the XML directly. + +3. Use [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) to convert the new WDAC supplemental policy to binary: + + ```powershell + $EnforcedSuppPolicyBinary = $env:USERPROFILE+"\Desktop\"+$SupplementalPolicyName+"_"+$SupplementalPolicyID+".xml" + ConvertFrom-CIPolicy $EnforcedSupplementalPolicy $EnforcedSuppPolicyBinary + ``` + +4. Repeat the steps above if you have other supplemental policies to update. + +## Deploy your enforced policy and supplemental policies + +Now that your base policy is in enforced mode, you can begin to deploy it to your managed endpoints. For information about deploying policies, see [Deploying Windows Defender Application Control (WDAC) policies](windows-defender-application-control-deployment-guide.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md new file mode 100644 index 0000000000..6612e9fbf7 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -0,0 +1,194 @@ +--- +title: Configure authorized apps deployed with a WDAC managed installer (Windows 10) +description: Explains how to configure a custom Manged Installer. +keywords: security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jsuther1974 +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.date: 08/14/2020 +ms.technology: mde +--- + +# Configuring authorized apps deployed by a managed installer with AppLocker and Windows Defender Application Control + +**Applies to:** + +- Windows 10 +- Windows Server 2019 + +Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called managed installer, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager. + +## How does a managed installer work? + +A new rule collection in AppLocker specifies binaries that are trusted by the organization as an authorized source for application deployment. When one of these binaries runs, Windows will monitor the binary's process (and processes it launches) then tag all files it writes as having originated from a managed installer. The managed installer rule collection is configured using Group Policy and can be applied with the Set-AppLockerPolicy PowerShell cmdlet. You can't currently set managed installers with the AppLocker CSP through MDM. + +Having defined your managed installers using AppLocker, you can then configure WDAC to trust files installed by a managed installer by adding the "Enabled:Managed Installer" option to your WDAC policy. Once that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules present for the file, WDAC will allow a file to run based on its managed installer origin. + +You should ensure that the WDAC policy allows the system/boot components and any other authorized applications that can't be deployed through a managed installer. + +## Security considerations with managed installer + +Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do. +It is best suited for use where each user operates as a standard user and where all software is deployed and installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager (MEMCM). + +Users with administrator privileges, or malware running as an administrator user on the system, may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed. + +If a managed installer process runs in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. + +Some application installers may automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization will extend to all files created during the first run of the application. This could result in over-authorization for executables that were not intended. To avoid that outcome, ensure that the application deployment solution used as a managed installer limits running applications as part of installation. + +## Known limitations with managed installer + +- Application control, based on managed installer, does not support applications that self-update. If an application deployed by a managed installer later updates itself, the updated application files won't include the managed installer origin information, and may not be able to run. When you rely on managed installers, you must deploy and install all application updates using a managed installer, or include rules to authorize the app in the WDAC policy. In some cases, it may be possible to also designate an application binary that performs self-updates as a managed installer. Proper review for functionality and security should be performed for the application before using this method. + +- [Packaged apps (MSIX)](/windows/msix/) deployed through a managed installer aren't tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy. See [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md). + +- Some applications or installers may extract, download, or generate binaries and immediately attempt to run them. Files run by such a process may not be allowed by the managed installer heuristic. In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer. Proper review for functionality and security should be performed for the application before using this method. + +- The managed installer heuristic doesn't authorize kernel drivers. The WDAC policy must have rules that allow the necessary drivers to run. + +## Configuring the managed installer + +Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy, with specific rules and options enabled. +There are three primary steps to keep in mind: + +- Specify managed installers, by using the Managed Installer rule collection in AppLocker policy. +- Enable service enforcement in AppLocker policy. +- Enable the managed installer option in a WDAC policy. + +## Specify managed installers using the Managed Installer rule collection in AppLocker policy + +The identity of the managed installer executable(s) is specified in an AppLocker policy, in a Managed Installer rule collection. + +### Create Managed Installer rule collection + +Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, you can use a text editor to make the simple changes needed to an EXE or DLL rule collection policy, to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO. + +1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback but other rule types can be used as well. You may need to reformat the output for readability. + + ```powershell + Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml + ``` + +2. Manually rename the rule collection to ManagedInstaller + + Change + + ```powershell + + ``` + + to + + ```powershell + + ``` + +An example of a valid Managed Installer rule collection using Microsoft Endpoint Config Manager (MEMCM) is shown below. + +```xml + + + + + + + + + + + + + + + + +``` + +### Enable service enforcement in AppLocker policy + +Since many installation processes rely on services, it is typically necessary to enable tracking of services. +Correct tracking of services requires the presence of at least one rule in the rule collection. So, a simple audit only rule will suffice. This can be added to the policy created above, which specifies your managed installer rule collection. + +For example: + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +## Enable the managed installer option in WDAC policy + +In order to enable trust for the binaries laid down by managed installers, the "Enabled: Managed Installer" option must be specified in your WDAC policy. +This can be done by using the [Set-RuleOption cmdlet](/powershell/module/configci/set-ruleoption) with Option 13. + +Below are steps to create a WDAC policy which allows Windows to boot and enables the managed installer option. + +1. Copy the DefaultWindows_Audit policy into your working folder from "C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml" + +2. Reset the policy ID to ensure it is in multiple policy format, and give it a different GUID from the example policies. Also, give it a friendly name to help with identification. + + For example: + + ```powershell + Set-CIPolicyIdInfo -FilePath -PolicyName "" -ResetPolicyID + ``` + +3. Set Option 13 (Enabled:Managed Installer) + + ```powershell + Set-RuleOption -FilePath -Option 13 + ``` + +## Set the AppLocker filter driver to autostart + +To enable the managed installer, you need to set the AppLocker filter driver to autostart, and start it. + +To do so, run the following command as an Administrator: + +```console +appidtel.exe start [-mionly] +``` + +Specify "-mionly" if you will not use the Intelligent Security Graph (ISG). + +## Enabling managed installer logging events + +Refer to [Understanding Application Control Events](event-id-explanations.md#optional-intelligent-security-graph-isg-or-managed-installer-mi-diagnostic-events) for information on enabling optional managed installer diagnostic events. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md index 8399532bab..cceb8da77d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md @@ -149,7 +149,7 @@ Alice has defined a policy for Lamna's fully-managed devices that makes some tra Possible mitigations: - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. - **Managed installer**
- See [security considerations with managed installer](use-windows-defender-application-control-with-managed-installer.md#security-considerations-with-managed-installer) + See [security considerations with managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md#security-considerations-with-managed-installer) Existing mitigations applied: - Limit who can elevate to administrator on the device. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md index 08e82cbe13..c4dabcde4c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md @@ -155,7 +155,7 @@ In order to minimize user productivity impact, Alice has defined a policy that m - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. - Limit who can elevate to administrator on the device. - **Managed installer**
- See [security considerations with managed installer](use-windows-defender-application-control-with-managed-installer.md#security-considerations-with-managed-installer) + See [security considerations with managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md#security-considerations-with-managed-installer) Possible mitigations: - Create and deploy signed catalog files as part of the app deployment process in order to remove the requirement for managed installer. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 80ef49b096..1f9364ad64 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -101,7 +101,11 @@ To deploy policies locally using the new multiple policy format, follow these st ### Deploying multiple policies via ApplicationControl CSP -Multiple WDAC policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment. See [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp) for more information on deploying multiple policies, optionally using MEM Intune's Custom OMA-URI capability. +Multiple WDAC policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). The CSP also provides support for rebootless policy deployment.
+ +However, when policies are un-enrolled from an MDM server, the CSP will attempt to remove every policy from devices, not just the policies added by the CSP. The reason for this is that the ApplicationControl CSP doesn't track enrollment sources for individual policies, even though it will query all policies on a device, regardless if they were deployed by the CSP. + +See [ApplicationControl CSP](/windows/client-management/mdm/applicationcontrol-csp) for more information on deploying multiple policies, optionally using MEM Intune's Custom OMA-URI capability. > [!NOTE] > WMI and GP do not currently support multiple policies. Instead, customers who cannot directly access the MDM stack should use the [ApplicationControl CSP via the MDM Bridge WMI Provider](/windows/client-management/mdm/applicationcontrol-csp#powershell-and-wmi-bridge-usage-guidance) to manage Multiple Policy Format WDAC policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md index 73357d0809..c5fd34e870 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md @@ -35,6 +35,8 @@ MEMCM includes native support for WDAC, which allows you to configure Windows 10 - [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG) - [Optional] Apps and executables already installed in admin-definable folder locations that MEMCM will allow through a one-time scan during policy creation on managed endpoints. +Note that MEMCM does not remove policies once deployed. To stop enforcement, you should switch the policy to audit mode, which will produce the same effect. If you want to disable WDAC altogether (including audit mode), you can deploy a script to delete the policy file from disk, and either trigger a reboot or wait for the next reboot. + For more information on using MEMCM's native WDAC policies, see [Windows Defender Application Control management with Configuration Manager](/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) ## Deploy custom WDAC policies using Packages/Programs or Task Sequences diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md index 3aed014401..ca2d5fed65 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md @@ -52,6 +52,20 @@ This topic describes how to deploy Windows Defender Application Control (WDAC) p & $RefreshPolicyTool ``` +### Deploying signed policies + +In addition to the steps outlined above, the binary policy file must also be copied to the device's EFI partition. Deploying your policy via [MEM](/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune) or the Application Control CSP will handle this step automatically. + +1. Mount the EFI volume and make the directory, if it does not exist, in an elevated PowerShell prompt: +```powershell +mountvol J: /S +J: +mkdir J:\EFI\Microsoft\Boot\CiPolicies\Active +``` + +2. Copy the signed policy binary as `{PolicyGUID}.cip` to J:\EFI\Microsoft\Boot\CiPolicies\Active +3. Reboot the system. + ## Script-based deployment process for Windows 10 versions earlier than 1903 1. Initialize the variables to be used by the script. diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md index 784baf06c2..6c3b04eb5a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -52,8 +52,6 @@ Alice previously created and deployed a policy for the organization's [fully man $EnforcedPolicyID = $EnforcedPolicyID.Substring(11) ``` - > [!NOTE] - > If Set-CIPolicyIdInfo does not output the new PolicyID value on your Windows 10 version, you will need to obtain the *PolicyId* value from the XML directly. 3. *[Optionally]* Use [Set-RuleOption](/powershell/module/configci/set-ruleoption) to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”). Option 9 allows users to disable WDAC enforcement for a single boot session from a pre-boot menu. Option 10 instructs Windows to switch the policy from enforcement to audit only if a boot critical kernel-mode driver is blocked. We strongly recommend these options when deploying a new enforced policy to your first deployment ring. Then, if no issues are found, you can remove the options and restart your deployment. @@ -74,7 +72,7 @@ Alice previously created and deployed a policy for the organization's [fully man > If you did not use -ResetPolicyID in Step 2 above, then you must replace $EnforcedPolicyID in the following command with the *PolicyID* attribute found in your base policy XML. ```powershell - $EnforcedPolicyBinary = $env:USERPROFILE+"\Desktop\"+$EnforcedPolicyName+"_"+$EnforcedPolicyID+".xml" + $EnforcedPolicyBinary = $env:USERPROFILE+"\Desktop\"+$EnforcedPolicyID+".cip" ConvertFrom-CIPolicy $EnforcedPolicyXML $EnforcedPolicyBinary ``` diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index b464707f61..6ac3422250 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -14,7 +14,7 @@ author: jsuther1974 ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 3/17/2020 +ms.date: 06/02/2021 ms.technology: mde --- @@ -22,45 +22,49 @@ ms.technology: mde A Windows Defender Application Control (WDAC) policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations: - - Event IDs beginning with 30 appear in Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational +- Event IDs beginning with 30 appear in **Applications and Services logs** > **Microsoft** > **Windows** > **CodeIntegrity** > **Operational** - - Event IDs beginning with 80 appear in Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script +- Event IDs beginning with 80 appear in **Applications and Services logs** > **Microsoft** > **Windows** > **AppLocker** > **MSI and Script** + +> [!NOTE] +> These event IDs are not applicable on Windows Server Core edition. ## Microsoft Windows CodeIntegrity Operational log event IDs | Event ID | Explanation | -|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|--------|-----------| | 3076 | Audit executable/dll file | | 3077 | Block executable/dll file | -| 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. Contains the total number of signatures on a file and an index as to which signature it is.
Unsigned files will generate a single 3089 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | +| 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. Contains the total number of signatures on a file and an index as to which signature it is. Unsigned files will generate a single 3089 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | | 3099 | Indicates that a policy has been loaded | -## Microsoft Windows Applocker MSI and Script log event IDs +## Microsoft Windows AppLocker MSI and Script log event IDs | Event ID | Explanation | -|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the scripthosts themselves. Note: there is no WDAC enforcement on 3rd party scripthosts. | +|--------|-----------| +| 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the script hosts themselves. Note: there is no WDAC enforcement on third-party script hosts. | | 8029 | Block script/MSI file | -| 8038 | Signing information event correlated with either a 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | | +| 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](allow-com-object-registration-in-windows-defender-application-control-policy.md). | +| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | | ## Optional Intelligent Security Graph (ISG) or Managed Installer (MI) diagnostic events -If either the ISG or MI is enabled in a WDAC policy, you can optionally choose to enable 3090, 3091, and 3092 events to provide additional diagnostic information. +If either the ISG or MI is enabled in a WDAC policy, you can optionally choose to enable 3090, 3091, and 3092 events to provide more diagnostic information. | Event ID | Explanation | -|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|--------|---------| | 3090 | Allow executable/dll file | | 3091 | Audit executable/dll file | | 3092 | Block executable/dll file | -3090, 3091, and 3092 events are generated based on the status code of whether a binary passed the policy, regardless of what reputation it was given or whether it was allowed by a designated MI. The SmartLocker template which appears in the event should indicate why the binary passed/failed. Only one event is generated per binary pass/fail. If both ISG and MI are disabled, 3090, 3091, and 3092 events will not be generated. +3090, 3091, and 3092 events are generated based on the status code of whether a binary passed the policy, regardless of what reputation it was given or whether it was allowed by a designated MI. The SmartLocker template that appears in the event should indicate why the binary passed/failed. Only one event is generated per binary pass/fail. If both ISG and MI are disabled, 3090, 3091, and 3092 events will not be generated. ### SmartLocker template -Below are the fields which help to diagnose what a 3090, 3091, or 3092 event indicates. +Below are the fields that help to diagnose what a 3090, 3091, or 3092 event indicates. | Name | Explanation | -|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|------|------| | StatusCode | STATUS_SUCCESS indicates a binary passed the active WDAC policies. If so, a 3090 event is generated. If not, a 3091 event is generated if the blocking policy is in audit mode, and a 3092 event is generated if the policy is in enforce mode. | | ManagedInstallerEnabled | Policy trusts a MI | | PassesManagedInstaller | File originated from a trusted MI | @@ -75,9 +79,49 @@ In order to enable 3091 audit events and 3092 block events, you must create a Te ```powershell reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x100 ``` - -In order to enable 3090 allow events as well as 3091 and 3092 events, you must instead create a TestFlags regkey with a value of 0x300. You can do so using the following PowerShell command: + +To enable 3090 allow events, and 3091 and 3092 events, you must instead create a TestFlags regkey with a value of 0x300. You can do so using the following PowerShell command: ```powershell reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300 ``` + +## Appendix +A list of other relevant event IDs and their corresponding description. + +| Event ID | Description | +|-------|------| +| 3001 | An unsigned driver was attempted to load on the system. | +| 3002 | Code Integrity could not verify the boot image as the page hash could not be found. | +| 3004 | Code Integrity could not verify the file as the page hash could not be found. | +| 3010 | The catalog containing the signature for the file under validation is invalid. | +| 3011 | Code Integrity finished loading the signature catalog. | +| 3012 | Code Integrity started loading the signature catalog. | +| 3023 | The driver file under validation did not meet the requirements to pass the application control policy. | +| 3024 | Windows application control was unable to refresh the boot catalog file. | +| 3026 | The catalog loaded is signed by a signing certificate that has been revoked by Microsoft and/or the certificate issuing authority. | +| 3033 | The file under validation did not meet the requirements to pass the application control policy. | +| 3034 | The file under validation would not meet the requirements to pass the application control policy if the policy was enforced. The file was allowed since the policy is in audit mode. |  +| 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. | +| 3064 | If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. |  +| 3065 | [Ignored] If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. | +| 3074 | Page hash failure while hypervisor-protected code integrity was enabled. | +| 3075 | This event monitors the performance of the Code Integrity policy check a file. | +| 3079 | The file under validation did not meet the requirements to pass the application control policy. | +| 3080 | If the policy was in enforced mode, the file under validation would not have met the requirements to pass the application control policy. | +| 3081 | The file under validation did not meet the requirements to pass the application control policy. | +| 3082 | If the policy was in enforced mode, the non-WHQL driver would have been denied by the policy. | +| 3084 | Code Integrity will enforce the WHQL Required policy setting on this session. | +| 3085 | Code Integrity will not enforce the WHQL Required policy setting on this session. | +| 3086 | The file under validation does not meet the signing requirements for an isolated user mode (IUM) process. | +| 3095 | This Code Integrity policy cannot be refreshed and must be rebooted instead. | +| 3097 | The Code Integrity policy cannot be refreshed. | +| 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. | +| 3101 | Code Integrity started refreshing the policy. | +| 3102 | Code Integrity finished refreshing the policy. | +| 3103 | Code Integrity is ignoring the policy refresh. | +| 3104 | The file under validation does not meet the signing requirements for a PPL (protected process light) process. | +| 3105 | Code Integrity is attempting to refresh the policy. | +| 3108 | Windows mode change event was successful. | +| 3110 | Windows mode change event was unsuccessful. | +| 3111 | The file under validation did not meet the hypervisor-protected code integrity (HVCI) policy. | diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index 6ee1d70486..2ae5aa34a4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -27,13 +27,14 @@ Windows Defender Application Control (WDAC) events include a number of fields wh Represents the type of signature which verified the image. | SignatureType Value | Explanation | -|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|---|----------| | 0 | Unsigned or verification has not been attempted | | 1 | Embedded signature | | 2 | Cached signature; presence of CI EA shows that file had been previously verified | +| 3 | Cached catalog verified via Catalog Database or searching catalog directly | | 4 | Un-cached catalog verified via Catalog Database or searching catalog directly | | 5 | Successfully verified using an EA that informs CI which catalog to try first | -|6 | AppX / MSIX package catalog verified | +| 6 | AppX / MSIX package catalog verified | | 7 | File was verified | ## ValidatedSigningLevel @@ -41,7 +42,7 @@ Represents the type of signature which verified the image. Represents the signature level at which the code was verified. | ValidatedSigningLevel Value | Explanation | -|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|---|----------| | 0 | Signing level has not yet been checked | | 1 | File is unsigned | | 2 | Trusted by WDAC policy | @@ -60,16 +61,22 @@ Represents the signature level at which the code was verified. Represents why verification failed, or if it succeeded. | VerificationError Value | Explanation | -|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +|---|----------| | 0 | Successfully verified signature | +| 1 | File has an invalid hash | | 2 | File contains shared writable sections | +| 3 | File is not signed| | 4 | Revoked signature | | 5 | Expired signature | +| 6 | File is signed using a weak hashing algorithm which does not meet the minimum policy | | 7 | Invalid root certificate | | 8 | Signature was unable to be validated; generic error | | 9 | Signing time not trusted | +| 10 | The file must be signed using page hashes for this scenario | +| 11 | Page hash mismatch | | 12 | Not valid for a PPL (Protected Process Light) | | 13 | Not valid for a PP (Protected Process) | +| 14 | The signature is missing the required ARM EKU | | 15 | Failed WHQL check | | 16 | Default policy signing level not met | | 17 | Custom policy signing level not met; returned when signature doesn't validate against an SBCP-defined set of certs | @@ -80,5 +87,36 @@ Represents why verification failed, or if it succeeded. | 22 | Not IUM (Isolated User Mode) signed; indicates trying to load a non-trustlet binary into a trustlet | | 23 | Invalid image hash | | 24 | Flight root not allowed; indicates trying to run flight-signed code on production OS | +| 25 | Anti-cheat policy violation | | 26 | Explicitly denied by WADC policy | +| 27 | The signing chain appears to be tampered/invalid | | 28 | Resource page hash mismatch | + +## Microsoft Root CAs trusted by Windows + +The rule means trust anything signed by a certificate that chains to this root CA. + +| Root ID | Root Name | +|---|----------| +| 0| None | +| 1| Unknown | +| 2 | Self-Signed | +| 3 | Authenticode | +| 4 | Microsoft Product Root 1997 | +| 5 | Microsoft Product Root 2001 | +| 6 | Microsoft Product Root 2010 | +| 7 | Microsoft Standard Root 2011 | +| 8 | Microsoft Code Verification Root 2006 | +| 9 | Microsoft Test Root 1999 | +| 10 | Microsoft Test Root 2010 | +| 11 | Microsoft DMD Test Root 2005 | +| 12 | Microsoft DMDRoot 2005 | +| 13 | Microsoft DMD Preview Root 2005 | +| 14 | Microsoft Flight Root 2014 | +| 15 | Microsoft Third Party Marketplace Root | +| 16 | Microsoft ECC Testing Root CA 2017 | +| 17 | Microsoft ECC Development Root CA 2018 | +| 18 | Microsoft ECC Product Root CA 2018 | +| 19 | Microsoft ECC Devices Root CA 2017 | + +For well-known roots, the TBS hashes for the certificates are baked into the code for WDAC. For example, they don’t need to be listed as TBS hashes in the policy file. diff --git a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md index 3f411ffb3e..16dd454c61 100644 --- a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md +++ b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md @@ -34,7 +34,7 @@ ms.technology: mde | Per-User and Per-User group rules | Not available (policies are device-wide) | Available on Windows 8+ | | Kernel mode policies | Available on all Windows 10 versions | Not available | | Per-app rules | [Available on 1703+](./use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md) | Not available | -| Managed Installer (MI) | [Available on 1703+](./use-windows-defender-application-control-with-managed-installer.md) | Not available | +| Managed Installer (MI) | [Available on 1703+](./configure-authorized-apps-deployed-with-a-managed-installer.md) | Not available | | Reputation-Based intelligence | [Available on 1709+](./use-windows-defender-application-control-with-intelligent-security-graph.md) | Not available | | Multiple policy support | [Available on 1903+](./deploy-multiple-windows-defender-application-control-policies.md) | Not available | | Path-based rules | [Available on 1903+.](./select-types-of-rules-to-create.md#more-information-about-filepath-rules) Exclusions are not supported. Runtime user-writeability check enforced by default. | Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. | diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 887fc765be..d409657e10 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -1,9 +1,9 @@ --- title: Microsoft recommended driver block rules (Windows 10) -description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. -keywords: security, malware, kernel mode, driver +description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. +keywords: security, malware, kernel mode, driver ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: m365-security +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security @@ -14,8 +14,7 @@ author: jgeurten ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 10/15/2020 -ms.technology: mde +ms.date: --- # Microsoft recommended driver block rules @@ -30,7 +29,7 @@ Microsoft has strict requirements for code running in kernel. Consequently, mali - Hypervisor-protected code integrity (HVCI) enabled devices - Windows 10 in S mode (S mode) devices -Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based-protection-of-code-integrity.md) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. +Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. > [!Note] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. It is recommended that this policy be first validated in audit mode before rolling the rules into enforcement mode. @@ -127,6 +126,40 @@ Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -352,6 +385,40 @@ Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -385,4 +452,4 @@ Microsoft recommends enabling [HVCI](../device-guard/enable-virtualization-based ## More information -- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) \ No newline at end of file +- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index 7924b31d89..a9cd8c8585 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -59,7 +59,7 @@ In addition, we recommend using the [Set-CIPolicyVersion](/powershell/module/con ### Policy rule updates -As new apps are deployed or existing apps are updated by the software publisher, you may need to make revisions to your rules to ensure that these apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you leverage WDAC [managed installer](use-windows-defender-application-control-with-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you are less likely to need policy updates. +As new apps are deployed or existing apps are updated by the software publisher, you may need to make revisions to your rules to ensure that these apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you leverage WDAC [managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you are less likely to need policy updates. ## WDAC event management diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 1314fa6e21..ee556ecef8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -63,7 +63,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | | **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | | **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. | -| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](use-windows-defender-application-control-with-managed-installer.md) | +| **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) | | **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **15 Enabled:Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. NOTE: This option is only supported on Windows 10, version 1709, and above.| @@ -71,6 +71,17 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **18 Disabled:Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. NOTE: This option is only supported on Windows 10, version 1903, and above. | | **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries. NOTE: This option is only supported on Windows 10, version 1803, and above. | +The following options are valid for supplemental policies. However, option 5 is not implemented as it is reserved for future work, and option 7 is not supported. + +| Rule option | Description | +|------------ | ----------- | +| 5 | Enabled: Inherit Default Policy | +| **6** | **Enabled: Unsigned System Integrity Policy** | +| 7 | Allowed: Debug Policy Augmented | +| **13** | **Enabled: Managed Installer** | +| **14** | **Enabled: Intelligent Security Graph Authorization** | +| **18** | **Disabled: Runtime FilePath Rule Protection** | + ## Windows Defender Application Control file rule levels File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as granular as the hash of each binary or as general as a CA certificate. You specify file rule levels when using WDAC PowerShell cmdlets to create and modify policies. @@ -98,7 +109,8 @@ Each file rule level has its benefit and disadvantage. Use Table 2 to select the > When you create WDAC policies with [New-CIPolicy](/powershell/module/configci/new-cipolicy), you can specify a primary file rule level by including the **-Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **-Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. > [!NOTE] -> WDAC only supports signer rules for RSA certificate signing keys with a maximum of 4096 bits. +> - WDAC only supports signer rules for RSA certificate signing keys with a maximum of 4096 bits. +> - The code uses CN for the CertSubject and CertIssuer fields in the policy. You can use the inbox certutil to look at the underlying format to ensure UTF-8 is not being used for the CN. For example, you can use printable string, IA5, or BMP. ## Example of file rule levels in use @@ -108,6 +120,10 @@ To create the WDAC policy, they build a reference server on their standard hardw As part of normal operations, they will eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they will not need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version. +## File rule precedence order + +WDAC has a built-in file rule conflict logic that translates to precedence order. It will first processes all explicit deny rules it finds. Then, it will process all explicit allow rules. If no deny or allow rule exists, WDAC will check for [Managed Installer EA](deployment/deploy-wdac-policies-with-memcm.md). Lastly, if none of these exists, WDAC will fall back on [ISG](use-windows-defender-application-control-with-intelligent-security-graph.md). + ## More information about filepath rules Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. Path rules are best suited to allow paths that you expect will remain admin-writeable only. You may want to avoid path rules for directories where standard users can modify ACLs on the folder. @@ -126,6 +142,22 @@ Wildcards can be used at the beginning or end of a path rule; only one wildcard You can also use the following macros when the exact volume may vary: `%OSDRIVE%`, `%WINDIR%`, `%SYSTEM32%`. +> [!NOTE] +> For others to better understand the WDAC policies that has been deployed, we recommend maintaining separate ALLOW and DENY policies on Windows 10, version 1903 and later. + +## More information about hashes + +### Why does scan create four hash rules per XML file? + +The PowerShell cmdlet will produce an Authenticode Sha1 Hash, Sha256 Hash, Sha1 Page Hash, Sha256 Page Hash. +During validation CI will choose which hashes to calculate depending on how the file is signed. For example, if the file is page-hash signed the entire file would not get paged in to do a full sha256 authenticode and we would just match using the first page hash. + +In the cmdlets, rather than try to predict which hash CI will use, we pre-calculate and use the four hashes (sha1/sha2 authenticode, and sha1/sha2 of first page). This is also resilient, if the signing status of the file changes and necessary for deny rules to ensure that changing/stripping the signature doesn’t result in a different hash than what was in the policy being used by CI. + +### Why does scan create eight hash rules for certain XML files? + +Separate rules are created for UMCI and KMCI. In some cases, files which are purely user-mode or purely kernel-mode may still generate both sets, as CI cannot always precisely determine what is purely user vs. kernel mode and errs on the side of caution. + ## Windows Defender Application Control filename rules File name rule levels let you specify file attributes to base a rule on. File name rules provide the same security guarantees that explicit signer rules do, as they are based on non-mutable file attributes. Specification of the file name level occurs when creating new policy rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md index 9443134723..7640970646 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md @@ -40,13 +40,13 @@ You should consider using WDAC as part of your organization's application contro ## Decide what policies to create -Beginning with Windows 10, version 1903, WDAC allows [multiple simultaneous policies](deploy-multiple-windows-defender-application-control-policies.md) to be applied to each device. While this opens up many new use cases for organizations, your policy management can easily become unwieldy without a well-thought-out plan for the number and types of policies to create. +Beginning with Windows 10, version 1903, WDAC allows [multiple simultaneous policies](deploy-multiple-windows-defender-application-control-policies.md) to be applied to each device. This opens up many new use cases for organizations, but your policy management can easily become unwieldy without a well-thought-out plan for the number and types of policies to create. The first step is to define the desired "circle-of-trust" for your WDAC policies. By "circle-of-trust", we mean a description of the business intent of the policy expressed in natural language. This "circle-of-trust" definition will guide you as you create the actual policy rules for your policy XML. For example, the DefaultWindows policy, which can be found under %OSDrive%\Windows\schemas\CodeIntegrity\ExamplePolicies, establishes a "circle-of-trust" that allows Windows, 3rd-party hardware and software kernel drivers, and applications from the Microsoft Store. -Microsoft Endpoint Configuration Manager, previously known as System Center Configuration Manager, uses the DefaultWindows policy as the basis for its policy but then modifies the policy rules to allow Configuration Manager and its dependencies, sets the managed installer policy rule, and additionally configures Configuration Manager as a managed installer. It also can optionally authorize apps with positive reputation and perform a one-time scan of folder paths specified by the Configuration Manager administrator which adds rules for any apps found in the specified paths on the managed endpoint. This establishes the "circle-of-trust" for Configuration Manager's native WDAC integration. +Microsoft Endpoint Configuration Manager, previously known as System Center Configuration Manager, uses the DefaultWindows policy as the basis for its policy but then modifies the policy rules to allow Configuration Manager and its dependencies, sets the managed installer policy rule, and additionally configures Configuration Manager as a managed installer. It also can optionally authorize apps with positive reputation and perform a one-time scan of folder paths specified by the Configuration Manager administrator, which adds rules for any apps found in the specified paths on the managed endpoint. This establishes the "circle-of-trust" for Configuration Manager's native WDAC integration. The following questions can help you plan your WDAC deployment and determine the right "circle-of-trust" for your policies. They are not in priority or sequential order and are not meant to be an exhaustive set of design considerations. @@ -54,31 +54,31 @@ The following questions can help you plan your WDAC deployment and determine the ### How are apps managed and deployed in your organization? -Organizations with well-defined, centrally-managed app management and deployment processes can create more restrictive, more secure policies. Other organizations may be able to deploy WDAC with more relaxed rules or may choose to deploy WDAC in audit mode to gain better visibility to the apps being used in their organization. +Organizations with well-defined, centrally managed app management and deployment processes can create more restrictive, more secure policies. Other organizations may be able to deploy WDAC with more relaxed rules or may choose to deploy WDAC in audit mode to gain better visibility to the apps being used in their organization. | Possible answers | Design considerations| | - | - | -| All apps are centrally managed and deployed using endpoint management tools like [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). | Organizations that centrally manage all apps are best-suited for application control. WDAC options like [managed installer](use-windows-defender-application-control-with-managed-installer.md) can make it easy to authorize apps that are deployed by the organization's app distribution management solution. | -| Some apps are centrally managed and deployed, but teams can install additional apps for their members. | [Supplemental policies](deploy-multiple-windows-defender-application-control-policies.md) can be used to allow team-specific exceptions to your core organization-wide WDAC policy. Alternatively, teams can leverage managed installers to install their team-specific apps or admin-only file path rules can be used to allow apps installed by admin users. | +| All apps are centrally managed and deployed using endpoint management tools like [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). | Organizations that centrally manage all apps are best-suited for application control. WDAC options like [managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) can make it easy to authorize apps that are deployed by the organization's app distribution management solution. | +| Some apps are centrally managed and deployed, but teams can install other apps for their members. | [Supplemental policies](deploy-multiple-windows-defender-application-control-policies.md) can be used to allow team-specific exceptions to your core organization-wide WDAC policy. Alternatively, teams can use managed installers to install their team-specific apps or admin-only file path rules can be used to allow apps installed by admin users. | | Users and teams are free to download and install apps but the organization wants to restrict that right to prevalent and reputable apps only. | WDAC can integrate with Microsoft's [Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md) (the same source of intelligence that powers Microsoft Defender Antivirus and Windows Defender SmartScreen) to allow only apps and binaries that have positive reputation. | | Users and teams are free to download and install apps without restriction. | WDAC policies can be deployed in audit mode to gain insight into the apps and binaries running in your organization without impacting user and team productivity.| -### Are internally-developed line-of-business (LOB) apps and apps developed by 3rd parties digitally signed? +### Are internally developed line-of-business (LOB) apps and apps developed by third-party companies digitally signed? Traditional Win32 apps on Windows can run without being digitally signed. This practice can expose Windows devices to malicious or tampered code and presents a security vulnerability to your Windows devices. Adopting code-signing as part of your organization's app development practices or augmenting apps with signed catalog files as part of your app ingestion and distribution can greatly improve the integrity and security of apps used. | Possible answers | Design considerations | | - | - | | All apps used in your organization must be signed. | Organizations that enforce [codesigning](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) for all executable code are best-positioned to protect their Windows computers from malicious code execution. WDAC rules can be created to authorize apps and binaries from the organization's internal development teams and from trusted independent software vendors (ISV). | -| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows 10 tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific App Catalog signatures to existing apps as a part of the app deployment process which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed App Catalogs. | +| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows 10 tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific App Catalog signatures to existing apps as a part of the app deployment process, which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed App Catalogs. | ### Are there specific groups in your organization that need customized application control policies? -Most business teams or departments have specific security requirements that pertain to data access and the applications used to access that data. You should consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. There is overhead in managing policies which may lead you to choose between broad, organization-wide policies and multiple team-specific policies. +Most business teams or departments have specific security requirements that pertain to data access and the applications used to access that data. Consider the scope of the project for each group and the group’s priorities before you deploy application control policies for the entire organization. There is overhead in managing policies that might lead you to choose between broad, organization-wide policies and multiple team-specific policies. | Possible answers | Design considerations | | - | - | -| Yes | WDAC policies can be created unique per team, or team-specific supplemental policies can be used to expand what is allowed by a common, centrally-defined base policy.| +| Yes | WDAC policies can be created unique per team, or team-specific supplemental policies can be used to expand what is allowed by a common, centrally defined base policy.| | No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.| ### Does your IT department have resources to analyze application usage, and to design and manage the policies? @@ -87,7 +87,7 @@ The time and resources that are available to you to perform the research and ana | Possible answers | Design considerations | | - | - | -| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are as simply constructed as possible.| +| Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are constructed as simply as possible.| | No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. | ### Does your organization have Help Desk support? diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md index a654d57870..498c736696 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -37,7 +37,7 @@ Before signing WDAC policies for the first time, be sure to enable rule options To sign a WDAC policy with SignTool.exe, you need the following components: -- SignTool.exe, found in the Windows SDK (Windows 7 or later) +- SignTool.exe, found in the [Windows SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk/) (Windows 7 or later) - The binary format of the WDAC policy that you generated in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) or another WDAC policy that you have created @@ -47,26 +47,29 @@ If you do not have a code signing certificate, see [Optional: Create a code sign 1. Initialize the variables that will be used: - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - - `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + ```powershell + $CIPolicyPath=$env:userprofile+"\Desktop\" + $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" + ``` > [!NOTE] - > This example uses the WDAC policy that you created in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. + > This example uses the WDAC policy that you created in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section. If you are signing another policy, be sure to update the **$CIPolicyPath** variable with the correct information. 2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the WDAC policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). 3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. 4. Navigate to your desktop as the working directory: - - `cd $env:USERPROFILE\Desktop` + + ```powershell + cd $env:USERPROFILE\Desktop + ``` 5. Use [Add-SignerRule](/powershell/module/configci/add-signerrule) to add an update signer certificate to the WDAC policy: - `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` + ```powershell + Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update + ``` > [!NOTE] > *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. @@ -74,17 +77,30 @@ If you do not have a code signing certificate, see [Optional: Create a code sign 6. Use [Set-RuleOption](/powershell/module/configci/set-ruleoption) to remove the unsigned policy rule option: - `Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete` + ```powershell + Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete + ``` -7. Use [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) to convert the policy to binary format: +7. Reset the policy ID and use [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy) to convert the policy to binary format: - `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + ```powershell + $PolicyID= Set-CIPolicyIdInfo -FilePath $InitialCIPolicy -ResetPolicyID + $PolicyID = $PolicyID.Substring(11) + $CIPolicyBin = $env:userprofile + "\Desktop\" + $PolicyID + ".cip" + ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin + ``` 8. Sign the WDAC policy by using SignTool.exe: - ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` + ```powershell + sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin + ``` > [!NOTE] > The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy. -9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy WDAC policies, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). \ No newline at end of file +9. Validate the signed file. When complete, the commands should output a signed policy file called {PolicyID}.cip to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy WDAC policies, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). + + +> [!NOTE] +> The device with the signed policy must be rebooted one time with Secure Boot enabled for the UEFI lock to be set. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index 7ad4a8467b..082eb3a3f1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -31,7 +31,9 @@ Beginning with Windows 10, version 1709, you can set an option to automatically ## How does the integration between WDAC and the Intelligent Security Graph work? -The ISG uses the same vast security intelligence and machine learning analytics that power Microsoft Defender SmartScreen and Microsoft Defender Antivirus to help classify applications as having known good, known bad, or unknown reputation. When a binary runs on a system with WDAC enabled with the ISG option, WDAC checks the file's reputation by sending its hash and signing information to the cloud. If the ISG reports that the file has a known good reputation, the $KERNEL.SMARTLOCKER.ORIGINCLAIM kernel Extended Attribute (EA) is written to the file. Every time the binary runs, it is allowed based on its positive reputation unless there is an explicit deny rule set in the WDAC policy. Conversely, a file that has unknown or known bad reputation will be allowed if your WDAC policy explicitly allows it. +The ISG uses the same vast security intelligence and machine learning analytics that power Microsoft Defender SmartScreen and Microsoft Defender Antivirus to help classify applications as having "known good," "known bad," or "unknown" reputation. When a binary runs on a system, with WDAC enabled with the ISG option, WDAC checks the file's reputation, by sending its hash and signing information to the cloud. If the ISG reports that the file has a "known good" reputation, the $KERNEL.SMARTLOCKER.ORIGINCLAIM kernel Extended Attribute (EA) is written to the file. + +If your WDAC policy does not have an explicit rule to allow or deny a binary to run, then WDAC will make a call to the cloud to determine whether the binary is familiar and safe. However, if your policy already authorizes or denies the binary, then WDAC will not make a call to the cloud. If the file with good reputation is an application installer, its reputation will pass along to any files that it writes to disk. This way, all the files needed to install and run an app inherit the positive reputation data from the installer. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md deleted file mode 100644 index 66afc7f933..0000000000 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Authorize apps installed by a managed installer (Windows 10) -description: Explains how to automatically allow applications deployed and installed by a managed installer. -keywords: security, malware -ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: m365-security -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -audience: ITPro -ms.collection: M365-security-compliance -author: jsuther1974 -ms.reviewer: jogeurte -ms.author: dansimp -manager: dansimp -ms.date: 04/20/2021 -ms.technology: mde ---- - -# Authorize apps deployed by a managed installer - -**Applies to:** - -- Windows 10 -- Windows Server 2019 - -Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called managed installer, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager. - -## How does a managed installer work? - -A new rule collection in AppLocker specifies binaries that are trusted by the organization as an authorized source for application deployment. When one of these binaries runs, Windows will monitor the binary's process (and processes it launches) and tag all files it writes as having originated from a managed installer. The managed installer rule collection is configured using Group Policy and can be applied with the Set-AppLockerPolicy PowerShell cmdlet. You can't currently set managed installers with the AppLocker CSP through MDM. - -Having defined your managed installers using AppLocker, you can then configure WDAC to trust files installed by a managed installer by adding the Enabled:Managed Installer option to your WDAC policy. Once that option is set, WDAC will check for managed installer origin information when determining whether or not to allow a binary to run. As long as there are no deny rules present for the file, WDAC will allow a file to run based on its managed installer origin. - -You should ensure that the WDAC policy allows the system to boot and any other authorized applications that can't be deployed through a managed installer. - -For an example of a managed installer use case, see [Creating a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md). - -## Security considerations with managed installer - -Since managed installer is a heuristic-based mechanism, it doesn't provide the same security guarantees that explicit allow or deny rules do. -It is best suited for use where each user operates as a standard user and where all software is deployed and installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager. - -Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of Windows Defender Application Control when the managed installer option is allowed. - -If a managed installer process runs in the context of a user with standard privileges, then it is possible that standard users or malware running as standard user may be able to circumvent the intent of Windows Defender Application Control. - -Some application installers may automatically run the application at the end of the installation process. If this happens when the installer is run by a managed installer, then the managed installer's heuristic tracking and authorization will extend to all files created during the first run of the application. This could result in over-authorization for executables that were not intended. To avoid that outcome, ensure that the application deployment solution used as a managed installer limits running applications as part of installation. - -## Known limitations with managed installer - -- Application control based on managed installer does not support applications that self-update. If an application deployed by a managed installer later updates itself, the updated application files won't include the managed installer origin information and may not be able to run. When you rely on managed installers, you must deploy and install all application updates using a managed installer or include rules to authorize the app in the WDAC policy. In some cases, it may be possible to also designate an application binary that performs self-updates as a managed installer. Proper review for functionality and security should be performed for the application before using this method. - -- [Packaged apps (MSIX)](/windows/msix/) deployed through a managed installer aren't tracked by the managed installer heuristic and will need to be separately authorized in your WDAC policy. See [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md). - -- Some applications or installers may extract, download, or generate binaries and immediately attempt to run them. Files run by such a process may not be allowed by the managed installer heuristic. In some cases, it may be possible to also designate an application binary that performs such an operation as a managed installer. Proper review for functionality and security should be performed for the application before using this method. - -- The managed installer heuristic doesn't authorize kernel drivers. The WDAC policy must have rules that allow the necessary drivers to run. diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md index 03f0eb6f0d..ce2acde0e8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md @@ -26,36 +26,36 @@ ms.technology: mde - Windows 10 - Windows Server 2016 and above -Windows 10 includes two technologies that can be used for application control depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. +Windows 10 includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. ## Windows Defender Application Control -WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows 10 clients. WDAC was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria) defined by the Microsoft Security Response Center (MSRC). +WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows 10 clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on: - Attributes of the codesigning certificate(s) used to sign an app and its binaries - Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file - The reputation of the app as determined by Microsoft's [Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md) -- The identity of the process that initiated the installation of the app and its binaries ([managed installer](use-windows-defender-application-control-with-managed-installer.md)) +- The identity of the process that initiated the installation of the app and its binaries ([managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md)) - The [path from which the app or file is launched](select-types-of-rules-to-create.md#more-information-about-filepath-rules) (beginning with Windows 10 version 1903) - The process that launched the app or binary -Note that prior to Windows 10, version 1709, Windows Defender Application Control was known as configurable code integrity (CCI). WDAC was also one of the features which comprised the now-defunct term 'Device Guard'. +Note that prior to Windows 10 version 1709, Windows Defender Application Control was known as configurable code integrity (CCI). WDAC was also one of the features that comprised the now-defunct term "Device Guard." ### WDAC System Requirements -WDAC policies can be created on any client edition of Windows 10 build 1903+ or on Windows Server 2016 and above. +WDAC policies can be created on any client edition of Windows 10 build 1903+, or on Windows Server 2016 and above. -WDAC policies can be applied to devices running any edition of Windows 10 or Windows Server 2016 and above via a Mobile Device Management (MDM) solution like Intune, a management interface like Configuration Manager, or a script host like PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 Enterprise edition or Windows Server 2016 and above, but cannot deploy policies to devices running non-Enterprise SKUs of Windows 10. +WDAC policies can be applied to devices running any edition of Windows 10, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 Enterprise edition, or Windows Server 2016 and above, but cannot deploy policies to devices running non-Enterprise SKUs of Windows 10. -For more information on which individual WDAC features are available on which WDAC builds, see [WDAC feature availability](feature-availability.md). +For more information on which individual WDAC features are available on specific WDAC builds, see [WDAC feature availability](feature-availability.md). ## AppLocker -AppLocker was introduced with Windows 7 and allows organizations to control which applications are allowed to run on their Windows clients. AppLocker helps to prevent end users from running unapproved software on their computers, but it does not meet the servicing criteria for being a security feature. +AppLocker was introduced with Windows 7, and allows organizations to control which applications are allowed to run on their Windows clients. AppLocker helps to prevent end-users from running unapproved software on their computers but does not meet the servicing criteria for being a security feature. -AppLocker policies can apply to all users on a computer or to individual users and groups. AppLocker rules can be defined based on: +AppLocker policies can apply to all users on a computer, or to individual users and groups. AppLocker rules can be defined based on: - Attributes of the codesigning certificate(s) used to sign an app and its binaries - Attributes of the app's binaries that come from the signed metadata for the files, such as Original Filename and version, or the hash of the file @@ -68,13 +68,13 @@ AppLocker policies can be deployed using Group Policy or MDM. ## Choose when to use WDAC or AppLocker -Generally, it is recommended that customers who are able to implement application control using WDAC rather than AppLocker do so. WDAC is undergoing continual improvements and will be getting added support from Microsoft management platforms. Although AppLocker will continue to receive security fixes, it will not undergo new feature improvements. +Generally, it is recommended that customers, who are able to implement application control using WDAC rather than AppLocker, do so. WDAC is undergoing continual improvements, and will be getting added support from Microsoft management platforms. Although AppLocker will continue to receive security fixes, it will not undergo new feature improvements. -In some cases, however, AppLocker may be the more appropriate technology for your organization. AppLocker is best when: +However, in some cases, AppLocker may be the more appropriate technology for your organization. AppLocker is best when: - You have a mixed Windows operating system (OS) environment and need to apply the same policy controls to Windows 10 and earlier versions of the OS. - You need to apply different policies for different users or groups on shared computers. - You do not want to enforce application control on application files such as DLLs or drivers. -AppLocker can also be deployed as a complement to WDAC to add user- or group-specific rules for shared device scenarios where it is important to prevent some users from running specific apps. +AppLocker can also be deployed as a complement to WDAC to add user or group-specific rules for shared device scenarios, where it is important to prevent some users from running specific apps. As a best practice, you should enforce WDAC at the most restrictive level possible for your organization, and then you can use AppLocker to further fine-tune the restrictions. diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md deleted file mode 100644 index bb47f523e4..0000000000 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md +++ /dev/null @@ -1,88 +0,0 @@ ---- -title: How Windows Defender System Guard protect Windows 10 from firmware exploits -description: Windows Defender System Guard in Windows 10 uses a hardware-based root of trust to securely protect systems against firmware exploits. -ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.reviewer: -manager: dansimp -ms.author: deniseb -author: denisebmsft -search.appverid: met150 -ms.prod: m365-security -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -ms.date: 03/01/2019 -ms.custom: asr -ms.technology: mde ---- - - -# Windows Defender System Guard: How a hardware-based root of trust helps protect Windows 10 - -In order to protect critical resources such as the Windows authentication stack, single sign-on tokens, the Windows Hello biometric stack, and the Virtual Trusted Platform Module, a system's firmware and hardware must be trustworthy. - -Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make these security guarantees: - -- Protect and maintain the integrity of the system as it starts up -- Validate that system integrity has truly been maintained through local and remote attestation - -## Maintaining the integrity of the system as it starts - -### Static Root of Trust for Measurement (SRTM) - -With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. -This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege. - -With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) a hardware-based root of trust helps ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader. -This hardware-based root of trust comes from the device’s Secure Boot feature, which is part of the Unified Extensible Firmware Interface (UEFI). -This technique of measuring the static early boot UEFI components is called the Static Root of Trust for Measurement (SRTM). - -As there are thousands of PC vendors that produce numerous models with different UEFI BIOS versions, there becomes an incredibly large number of SRTM measurements upon bootup. -Two techniques exist to establish trust here—either maintain a list of known 'bad' SRTM measurements (also known as a block list), or a list of known 'good' SRTM measurements (also known as an allow list). -Each option has a drawback: - -- A list of known 'bad' SRTM measurements allows a hacker to change just 1 bit in a component to create an entirely new SRTM hash that needs to be listed. This means that the SRTM flow is inherently brittle - a minor change can invalidate the entire chain of trust. -- A list of known 'good' SRTM measurements requires each new BIOS/PC combination measurement to be carefully added, which is slow. -In addition, a bug fix for UEFI code can take a long time to design, build, retest, validate, and redeploy. - -### Secure Launch—the Dynamic Root of Trust for Measurement (DRTM) - -Windows Defender System Guard Secure Launch, first introduced in Windows 10 version 1809, aims to alleviate these issues by leveraging a technology known as the Dynamic Root of Trust for Measurement (DRTM). -DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. -This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. - - -![System Guard Secure Launch](images/system-guard-secure-launch.png) - -Secure Launch simplifies management of SRTM measurements because the launch code is now unrelated to a specific hardware configuration. This means the number of valid code measurements is small, and future updates can be deployed more widely and quickly. - -### System Management Mode (SMM) protection - -System Management Mode (SMM) is a special-purpose CPU mode in x86 microcontrollers that handles power management, hardware configuration, thermal monitoring, and anything else the manufacturer deems useful. -Whenever one of these system operations is requested, a non-maskable interrupt (SMI) is invoked at runtime, which executes SMM code installed by the BIOS. -SMM code executes in the highest privilege level and is invisible to the OS, which makes it an attractive target for malicious activity. Even if System Guard Secure Launch is used to late launch, SMM code can potentially access hypervisor memory and change the hypervisor. -To defend against this, two techniques are used: - -1. Paging protection to prevent inappropriate access to code and data -2. SMM hardware supervision and attestation - -Paging protection can be implemented to lock certain code tables to be read-only to prevent tampering. -This prevents access to any memory that has not been specifically assigned. - -A hardware-enforced processor feature known as a supervisor SMI handler can monitor the SMM and make sure it does not access any part of the address space that it is not supposed to. - -SMM protection is built on top of the Secure Launch technology and requires it to function. -In the future, Windows 10 will also measure this SMI Handler’s behavior and attest that no OS-owned memory has been tampered with. - -## Validating platform integrity after Windows is running (run time) - -While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We should be able to trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. When it comes to platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity. - -As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch will not support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. - - -![Boot time integrity](images/windows-defender-system-guard-boot-time-integrity.png) - -After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Endpoint Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. - diff --git a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md index c1121baa73..90d5fd2514 100644 --- a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md +++ b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md @@ -67,7 +67,7 @@ To enable a specific audit event, run the corresponding command in an administra |**Audit #**|**Enable command**|**Link**| |:-----|:-----|:-----| |**5157**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable`|[5157(F): The Windows Filtering Platform has blocked a connection.](../auditing/event-5157.md)| -|**5152**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable`|[5152(F): The Windows Filtering Platform blocked a packet.](../auditing/event-5152.md)| +|**5152**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Packet Drop" /success:enable /failure:enable`|[5152(F): The Windows Filtering Platform blocked a packet.](../auditing/event-5152.md)| ## Example flow of debugging packet drops with filter origin @@ -168,4 +168,4 @@ For more information on how to debug drops caused by UWP default block filters, **WSH default** -Network drops from Windows Service Hardening (WSH) default filters indicate that there wasn’t an explicit Windows Service Hardening allow rule to allow network traffic for the protected service. The service owner will need to configure allow rules for the service if the block is not expected. \ No newline at end of file +Network drops from Windows Service Hardening (WSH) default filters indicate that there wasn’t an explicit Windows Service Hardening allow rule to allow network traffic for the protected service. The service owner will need to configure allow rules for the service if the block is not expected. diff --git a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md index 417dd71e21..dc7c58f214 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -77,4 +77,16 @@ LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files It can export local policy to a GPO backup. It can export the contents of a Registry Policy file to the “LGPO text” format that can then be edited, and can build a Registry Policy file from an LGPO text file. -Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](/archive/blogs/secguide/lgpo-exe-local-group-policy-object-utility-v1-0) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). \ No newline at end of file +Documentation for the LGPO tool can be found on the [Microsoft Security Guidance blog](/archive/blogs/secguide/lgpo-exe-local-group-policy-object-utility-v1-0) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). + +## What is the Set Object Security tool? + +SetObjectSecurity.exe enables you to set the security descriptor for just about any type of Windows securable object, such as files, directories, registry keys, event logs, services, and SMB shares. For file system and registry objects, you can choose whether to apply inheritance rules. You can also choose to output the security descriptor in a .reg-file-compatible representation of the security descriptor for a REG_BINARY registry value. + +Documentation for the Set Object Security tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). + +## What is the GPO to Policy Rules tool? + +Automate the conversion of GPO backups to Policy Analyzer .PolicyRules files and skip the GUI. GPO2PolicyRules is a command-line tool that is included with the Policy Analyzer download. + +Documentation for the GPO to PolicyRules tool can be found on the [Microsoft Security Baselines blog](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/new-amp-updated-security-tools/ba-p/1631613) or by [downloading the tool](https://www.microsoft.com/download/details.aspx?id=55319). diff --git a/windows/sv/TOC.yml b/windows/sv/TOC.yml deleted file mode 100644 index b5ef71ac32..0000000000 --- a/windows/sv/TOC.yml +++ /dev/null @@ -1,2 +0,0 @@ -- name: Index - href: index.md \ No newline at end of file diff --git a/windows/sv/breadcrumb/toc.yml b/windows/sv/breadcrumb/toc.yml deleted file mode 100644 index 61d8fca61e..0000000000 --- a/windows/sv/breadcrumb/toc.yml +++ /dev/null @@ -1,3 +0,0 @@ -- name: Docs - tocHref: / - topicHref: / \ No newline at end of file diff --git a/windows/sv/docfx.json b/windows/sv/docfx.json deleted file mode 100644 index 7035c4cd69..0000000000 --- a/windows/sv/docfx.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "build": { - "content": [ - { - "files": [ - "**/*.md", - "**/*.yml" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**", - "README.md", - "LICENSE", - "LICENSE-CODE", - "ThirdPartyNotices.md" - ] - } - ], - "resource": [ - { - "files": [ - "**/*.png", - "**/*.jpg" - ], - "exclude": [ - "**/obj/**", - "**/includes/**", - "_themes/**", - "_themes.pdf/**", - "**/docfx.json", - "_repo.en-us/**" - ] - } - ], - "overwrite": [], - "externalReference": [], - "globalMetadata": { - "breadcrumb_path": "/windows/sv/breadcrumb/toc.json", - "extendBreadcrumb": true, - "feedback_system": "None" - }, - "fileMetadata": {}, - "template": [], - "dest": "SV", - "markdownEngineName": "markdig" - } -} \ No newline at end of file diff --git a/windows/sv/index.md b/windows/sv/index.md deleted file mode 100644 index 700bfbca0e..0000000000 --- a/windows/sv/index.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: No title -description: No description -keywords: ["Windows 10"] -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.author: greglin -manager: laurawi -ms.localizationpriority: high -ms.topic: article ---- - -# _ \ No newline at end of file diff --git a/windows/whats-new/TOC.yml b/windows/whats-new/TOC.yml index b0d672f68c..a9ae9e12ba 100644 --- a/windows/whats-new/TOC.yml +++ b/windows/whats-new/TOC.yml @@ -1,19 +1,33 @@ -- name: What's new in Windows 10 +- name: What's new in Windows href: index.yml -- name: What's new in Windows 10, version 21H1 - href: whats-new-windows-10-version-21H1.md -- name: What's new in Windows 10, version 20H2 - href: whats-new-windows-10-version-20H2.md -- name: What's new in Windows 10, version 2004 - href: whats-new-windows-10-version-2004.md -- name: What's new in Windows 10, version 1909 - href: whats-new-windows-10-version-1909.md -- name: What's new in Windows 10, version 1903 - href: whats-new-windows-10-version-1903.md -- name: What's new in Windows 10, version 1809 - href: whats-new-windows-10-version-1809.md +- name: Windows 11 + expanded: true + items: + - name: Windows 11 overview + href: windows-11.md + - name: Windows 11 requirements + href: windows-11-requirements.md + - name: Plan for Windows 11 + href: windows-11-plan.md + - name: Prepare for Windows 11 + href: windows-11-prepare.md +- name: Windows 10 + expanded: true + items: + - name: What's new in Windows 10, version 21H1 + href: whats-new-windows-10-version-21H1.md + - name: What's new in Windows 10, version 20H2 + href: whats-new-windows-10-version-20H2.md + - name: What's new in Windows 10, version 2004 + href: whats-new-windows-10-version-2004.md + - name: What's new in Windows 10, version 1909 + href: whats-new-windows-10-version-1909.md + - name: What's new in Windows 10, version 1903 + href: whats-new-windows-10-version-1903.md - name: Previous versions items: + - name: What's new in Windows 10, version 1809 + href: whats-new-windows-10-version-1809.md - name: What's new in Windows 10, version 1803 href: whats-new-windows-10-version-1803.md - name: What's new in Windows 10, version 1709 diff --git a/windows/whats-new/docfx.json b/windows/whats-new/docfx.json index 04908deceb..fe5bc2fe98 100644 --- a/windows/whats-new/docfx.json +++ b/windows/whats-new/docfx.json @@ -3,8 +3,8 @@ "content": [ { "files": [ - "**/*.md", - "**/*.yml" + "**/**/*.md", + "**/**/*.yml" ], "exclude": [ "**/obj/**", @@ -19,9 +19,9 @@ "resource": [ { "files": [ - "**/*.png", - "**/*.jpg", - "**/*.gif" + "**/**/*.png", + "**/**/*.jpg", + "**/**/*.gif" ], "exclude": [ "**/obj/**", @@ -34,7 +34,6 @@ "globalMetadata": { "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", "uhfHeaderId": "MSDocsHeader-M365-IT", - "ms.technology": "windows", "ms.topic": "article", "audience": "ITPro", "feedback_system": "GitHub", diff --git a/windows/whats-new/index.yml b/windows/whats-new/index.yml index 45c6930684..375f946870 100644 --- a/windows/whats-new/index.yml +++ b/windows/whats-new/index.yml @@ -1,11 +1,11 @@ ### YamlMime:Landing -title: What's new in Windows 10 # < 60 chars -summary: Find out about new features and capabilities in the latest release of Windows 10. # < 160 chars +title: What's new in Windows # < 60 chars +summary: Find out about new features and capabilities in the latest release of Windows 10 and Windows 11. # < 160 chars metadata: - title: What's new in Windows 10 # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Find out about new features and capabilities in the latest release of Windows 10. # Required; article description that is displayed in search results. < 160 chars. + title: What's new in Windows # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Find out about new features and capabilities in the latest release of Windows 10 and Windows 11. # Required; article description that is displayed in search results. < 160 chars. services: windows-10 ms.service: windows-10 #Required; service per approved list. service slug assigned to your service by ACOM. ms.subservice: subservice @@ -13,7 +13,7 @@ metadata: ms.collection: windows-10 author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - ms.date: 02/09/2021 #Required; mm/dd/yyyy format. + ms.date: 06/24/2021 #Required; mm/dd/yyyy format. localization_priority: medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -22,7 +22,21 @@ landingContent: # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) - - title: What's new in Windows 10 + + - title: Windows 11 + linkLists: + - linkListType: overview + links: + - text: Windows 11 overview + url: windows-11.md + - text: Windows 11 requirements + url: windows-11-requirements.md + - text: Plan for Windows 11 + url: windows-11-plan.md + - text: Prepare for Windows 11 + url: windows-11-prepare.md + + - title: Windows 10 linkLists: - linkListType: overview links: @@ -36,8 +50,6 @@ landingContent: url: whats-new-windows-10-version-1909.md - text: What's new in Windows 10, version 1903 url: whats-new-windows-10-version-1903.md - - text: What's new in Windows 10, version 1809 - url: whats-new-windows-10-version-1809.md # Card (optional) @@ -45,11 +57,11 @@ landingContent: linkLists: - linkListType: overview links: - - text: Windows 10 release information + - text: Windows release information url: /windows/release-health/release-information - - text: Windows 10 release health dashboard + - text: Windows release health dashboard url: /windows/release-information/ - - text: Windows 10 update history + - text: Windows update history url: https://support.microsoft.com/topic/windows-10-update-history-7dd3071a-3906-fa2c-c342-f7f86728a6e3 - text: Windows 10 features we’re no longer developing url: /windows/deployment/planning/windows-10-deprecated-features @@ -57,13 +69,5 @@ landingContent: url: /windows/deployment/planning/windows-10-removed-features - text: Compare Windows 10 Editions url: https://go.microsoft.com/fwlink/p/?LinkId=690485 - - # Card (optional) - - title: See also - linkLists: - - linkListType: overview - links: - text: Windows 10 Enterprise LTSC url: ltsc/index.md - - text: Edit an existing topic using the Edit link - url: contribute-to-a-topic.md \ No newline at end of file diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 74b961fb89..cd82d2c618 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -484,9 +484,9 @@ Previously, the customized taskbar could only be deployed using Group Policy or ### Windows Insider for Business -We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (AAD). By enrolling devices in AAD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](/windows/deployment/update/waas-windows-insider-for-business). +We recently added the option to download Windows 10 Insider Preview builds using your corporate credentials in Azure Active Directory (Azure AD). By enrolling devices in Azure AD, you increase the visibility of feedback submitted by users in your organization – especially on features that support your specific business needs. For details, see [Windows Insider Program for Business](https://insider.windows.com/for-business). -You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](/windows/deployment/update/waas-windows-insider-for-business#getting-started-with-windows-insider-program-for-business). +You can now register your Azure AD domains to the Windows Insider Program. For more information, see [Windows Insider Program for Business](https://insider.windows.com/for-business). ### Optimize update delivery @@ -642,4 +642,4 @@ See the following example: ## See Also -[Windows 10 Enterprise LTSC](index.md): A short description of the LTSC servicing channel with links to information about each release. \ No newline at end of file +[Windows 10 Enterprise LTSC](index.md): A short description of the LTSC servicing channel with links to information about each release. diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 0f28f72c7e..b83bdda9a7 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -171,7 +171,7 @@ The new [security baseline for Windows 10 version 1803](/windows/security/threat ### Microsoft Defender Antivirus -Microsoft Defender Antivirus now shares detection status between M365 services and interoperates with Microsoft Defender for Endpoint. Additional policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/microsoft-365/security/defender-endpoint/utilize-microsoft-cloud-protection-microsoft-defender-antivirus). +Microsoft Defender Antivirus now shares detection status between M365 services and interoperates with Microsoft Defender for Endpoint. Additional policies have also been implemented to enhance cloud based protection, and new channels are available for emergency protection. For more information, see [Virus and threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection) and [Use next-gen technologies in Microsoft Defender Antivirus through cloud-delivered protection](/microsoft-365/security/defender-endpoint/cloud-protection-microsoft-defender-antivirus). ### Windows Defender Exploit Guard diff --git a/windows/whats-new/whats-new-windows-10-version-21H1.md b/windows/whats-new/whats-new-windows-10-version-21H1.md index c56c65dac3..70725f4a9b 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H1.md +++ b/windows/whats-new/whats-new-windows-10-version-21H1.md @@ -47,7 +47,7 @@ For a full list of what's new in Microsoft Intune, see [What's new in Microsoft ### Windows Assessment and Deployment Toolkit (ADK) -There is no new ADK for Windows 10, version 21H1. The ADK for Windows 10, version 2004 will also work with Windows 10, version 20H2. For more information, see [Download and install the Windows ADK](/windows-hardware/get-started/adk-install). +There is no new ADK for Windows 10, version 21H1. The ADK for Windows 10, version 2004 will also work with Windows 10, version 21H1. For more information, see [Download and install the Windows ADK](/windows-hardware/get-started/adk-install). ## Device management @@ -60,7 +60,7 @@ Windows Management Instrumentation (WMI) Group Policy Service (GPSVC) has a perf WDAG performance is improved with optimized document opening times: - An issue is fixed that could cause a one minute or more delay when you open a Microsoft Defender Application Guard (WDAG) Office document. This can occur when you try to open a file using a Universal Naming Convention (UNC) path or Server Message Block (SMB) share link. -- A memory issue is fixed that could casue a WDAG container to use almost 1 GB of working set memory when the container is idle. +- A memory issue is fixed that could cause a WDAG container to use almost 1 GB of working set memory when the container is idle. - The performance of Robocopy is improved when copying files over 400 MB in size. ### Windows Hello @@ -136,4 +136,4 @@ This release includes the following enhancements and issues fixed: [What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
[Announcing more ways we’re making app development easier on Windows](https://blogs.windows.com/windowsdeveloper/2020/09/22/kevin-gallo-microsoft-ignite-2020/): Simplifying app development in Windows.
[Features and functionality removed in Windows 10](/windows/deployment/planning/windows-10-removed-features): Removed features.
-[Windows 10 features we’re no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.
\ No newline at end of file +[Windows 10 features we’re no longer developing](/windows/deployment/planning/windows-10-deprecated-features): Features that are not being developed.
diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md new file mode 100644 index 0000000000..17d61a7125 --- /dev/null +++ b/windows/whats-new/windows-11-plan.md @@ -0,0 +1,122 @@ +--- +title: Plan for Windows 11 +description: Windows 11 deployment planning, IT Pro content. +keywords: ["get started", "windows 11", "plan"] +ms.prod: w11 +ms.mktglfcycl: deploy +ms.sitesec: library +author: greg-lindsay +ms.author: greglin +ms.date: 06/24/2021 +ms.reviewer: +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# Plan for Windows 11 + +**Applies to** + +- Windows 11 + +## Deployment planning + +This article provides guidance to help you plan for Windows 11 in your organization. + +Since Windows 11 is built on the same foundation as Windows 10, you can use the same deployment capabilities, scenarios, and tools—as well as the same basic deployment strategy that you use today for Windows 10. You will need to review and update your servicing strategy to adjust for changes in [Servicing and support](#servicing-and-support) for Windows 11. + +At a high level, this strategy should include the following steps: +- [Create a deployment plan](/windows/deployment/update/create-deployment-plan) +- [Define readiness criteria](/windows/deployment/update/plan-define-readiness) +- [Evaluate infrastructure and tools](/windows/deployment/update/eval-infra-tools) +- [Determine application readiness](/windows/deployment/update/plan-determine-app-readiness) +- [Define your servicing strategy](/windows/deployment/update/plan-define-strategy) + +If you are looking for ways to optimize your approach to deploying Windows 11, or if deploying a new version of an operating system is not a familiar process for you, some items to consider are provided below. + +## Determine eligibility + +As a first step, you will need to know which of your current devices meet the Windows 11 hardware requirements. Most devices purchased in the last 18-24 months will be compatible with Windows 11. Verify that your device meets or exceeds [Windows 11 requirements](windows-11-requirements.md) to ensure it is compatible. + +Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the **PC Health Check** app to determine their eligibility for Windows 11. end-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.  + +Enterprise organizations looking to evaluate device readiness in their environments can expect this capability to be integrated into existing Microsoft tools, such as Endpoint analytics and Update Compliance. This capability will be available when Windows 11 is generally available. Microsoft is also working with software publishing partners to facilitate adding Windows 11 device support into their solutions. + +## Windows 11 availability + +The availability of Windows 11 will vary according to a device's hardware and whether the device receives updates directly, or from a management solution that is maintained by an IT administrator. + +##### Managed devices + +Managed devices are devices that are under organization control. Managed devices include those managed by Microsoft Intune, Microsoft Endpoint Configuration Manager, or other endpoint management solutions. + +If you manage devices on behalf of your organization, you will be able to upgrade eligible devices to Windows 11 using your existing deployment and management tools at no cost when the upgrade reaches general availability. Organizations that use Windows Update for Business will have added benefits, such as: + +- Ensuring that devices that don't meet the minimum hardware requirements are not automatically offered the Windows 11 upgrade. +- Additional insight into safeguard holds. While safeguard holds will function for Windows 11 devices just as they do for Windows 10 today, administrators using Windows Update for Business will have access to information on which safeguard holds are preventing individual devices from taking the upgrade to Windows 11. + +> [!NOTE] +> If you use Windows Update for Business to manage feature update deployments today, you will need to leverage the **Target Version** policy rather than **Feature Update deferrals** to move from Windows 10 to Windows 11. Deferrals are great for quality updates or to move to newer version of the same product (from example, from Windows 10, version 20H2 to 21H1), but they cannot migrate a device between products (from Windows 10 to Windows 11).
+> Also, Windows 11 has a new End User License Agreement. If you are deploying with Windows Update for Business **Target Version** or with Windows Server Update Services, you are accepting this new End User License Agreement on behalf of the end-users within your organization. + +##### Unmanaged devices + +Unmanaged devices are devices that are not managed by an IT administrator on behalf of an organization. For operating system (OS) deployment, these devices are not subject to organizational policies that manage upgrades or updates. + +Windows 11 will be offered to eligible Windows 10 devices beginning later in the 2021 calendar year. Messaging on new devices will vary by PC manufacturer, but users will see labels such as **This PC will upgrade to Windows 11 once available** on products that are available for purchase. + +The Windows 11 upgrade will be available initially on eligible, unmanaged devices to users who manually seek the upgrade through Windows Update. As with all Windows Update managed devices, the **Windows Update Settings** page will confirm when a device is eligible, and users can upgrade if they choose to. + +Just like Windows 10, the machine learning based [intelligent rollout](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/using-machine-learning-to-improve-the-windows-10-update/ba-p/877860) process will be used when rolling out upgrades. Machine learning uses a combination of testing, close partner engagement, feedback, diagnostic data, and real-life insights to manage quality. This process improves the update experience, and ensures that devices first nominated for updates are the devices likely to have a seamless experience. Devices that might have compatibility issues with the upgrade get the benefit of resolving these issues before the upgrade is offered. + +## Windows 11 readiness considerations + +The recommended method to determine if your infrastructure, deployment processes, and management tools are ready for Windows 11 is to join the [Windows Insider Program for Business](https://insider.windows.com/for-business). As a participant in the [Release Preview Channel](/windows-insider/business/validate-Release-Preview-Channel), you can validate that your devices and applications work as expected, and explore new features. + +As you plan your endpoint management strategy for Windows 11, consider moving to cloud-based mobile device management (MDM), such as [Microsoft Intune](/mem/intune/fundamentals/what-is-intune). If a cloud-only approach isn't right for your organization just yet, you can still modernize and streamline essential pieces of your endpoint management strategy as follows: +- Create a [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview) (CMG) to manage Configuration Manager clients over the internet. +- Attach your existing Configuration Management estate to the cloud with [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions) so you can manage all devices from within the Microsoft Endpoint Manager admin center. +- Use [co-management](/mem/configmgr/comanage/overview) to concurrently manage devices using both Configuration Manager and Microsoft Intune. This allows you to take advantage of cloud-powered capabilities like [Conditional Access](/azure/active-directory/conditional-access/overview). + +For more information on the benefits of these approaches, see [Cloud Attach Your Future: The Big 3](https://techcommunity.microsoft.com/t5/configuration-manager-blog/cloud-attach-your-future-part-ii-quot-the-big-3-quot/ba-p/1750664). + +The introduction of Windows 11 is also a good time to review your hardware refresh plans and prioritize eligible devices to ensure an optimal experience for your users. + +## Servicing and support + +Along with end-user experience and security improvements, Windows 11 introduces enhancements to Microsoft's servicing approach based on your suggestions and feedback. + +**Quality updates**: Windows 11 and Windows 10 devices will receive regular monthly quality updates to provide security updates and bug fixes. + +**Feature updates**: Microsoft will provide a single Windows 11 feature update annually, targeted for release in the second half of each calendar year. + +**Lifecycle**: +- Home, Pro, Pro for Workstations, and Pro for Education editions of Windows 11 will receive 24 months of support from the general availability date. +- Enterprise and Education editions of Windows 11 will be supported for 36 months from the general availability date. + +When Windows 11 reaches general availability, a consolidated Windows 11 update history will be available on support.microsoft.com, similar to what is [available today for Windows 10](https://support.microsoft.com/topic/windows-10-update-history-1b6aac92-bf01-42b5-b158-f80c6d93eb11). Similarly, the [Windows release health](/windows/release-health/) hub will offer quick access to Windows 11 servicing announcements, known issues, and safeguard holds. + +It is important that organizations have adequate time to plan for Windows 11. Microsoft also recognizes that many organizations will have a mix of Windows 11 and Windows 10 devices across their ecosystem. Devices on in-service versions of Windows 10 will continue to receive monthly Windows 10 security updates through 2025, as well as incremental improvements to Windows 10 to support ongoing Microsoft 365 deployments. For more information, see the [Windows 10 release information](/windows/release-health/release-information) page, which offers information about the Windows 10 Semi-Annual Channel and Long-term Servicing Channel (LTSC) releases. + +## Application compatibility + +Microsoft's compatibility promise for Windows 10 is maintained for Windows 11. Data from the App Assure program shows that Windows 10 compatibility rates are over 99.7% for enterprise organizations, including line of business (LOB) apps. Microsoft remains committed to ensuring that the apps you rely upon continue to work as expected when you upgrade. Windows 11 is subject to the same app compatibility validation requirements that are in place for Windows 10 today, for both feature and quality updates. + +#### App Assure and Test Base for Microsoft 365 + +If you run into compatibility issues or want to ensure that your organization's applications are compatible from day one, App Assure and Test Base for Microsoft 365 can help. + +**App Assure**: With enrollment in the [App Assure](/windows/compatibility/app-assure) service, any app compatibility issues that you find with Windows 11 can be resolved. Microsoft will help you remedy application issues at no cost. Since 2018, App Assure has evaluated almost 800,000 apps, and subscriptions are free for eligible customers with 150+ seats. + +**Test Base for Microsoft 365**: For software publishers, systems integrators, and IT administrators, [Test Base for Microsoft 365](https://aka.ms/testbase) (currently in private preview) is a service that allows you to validate your apps across a variety of Windows feature and quality updates and environments in a Microsoft-managed Azure environment. Enterprise organizations can also nominate their software publishers for participation by completing a short form. + +You might already be using App Assure and Test Base in your Windows 10 environment. Both of these tools will continue to function with Windows 11. + +## Next steps + +[Prepare for Windows 11](windows-11-prepare.md) + +## Also see + +[Plan to deploy updates for Windows 10 and Microsoft 365 Apps](/learn/modules/windows-plan/) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md new file mode 100644 index 0000000000..5ccbff2c5b --- /dev/null +++ b/windows/whats-new/windows-11-prepare.md @@ -0,0 +1,126 @@ +--- +title: Prepare for Windows 11 +description: Prepare your infrastructure and tools to deploy Windows 11, IT Pro content. +keywords: ["get started", "windows 11"] +ms.prod: w11 +ms.mktglfcycl: deploy +ms.sitesec: library +author: greg-lindsay +ms.author: greglin +ms.date: 06/24/2021 +ms.reviewer: +manager: laurawi +ms.localizationpriority: high +ms.topic: article +--- + +# Prepare for Windows 11 + +**Applies to** + +- Windows 11 + +Windows 10 and Windows 11 are designed to coexist, so that you can use the same familiar tools and process to manage both operating systems. Using a single management infrastructure that supports common applications across both Windows 10 and Windows 11 helps to simplify the migration process. You can analyze endpoints, determine application compatibility, and manage Windows 11 deployments in the same way that you do with Windows 10. + +After you evaluate your hardware to see if it meets [requirements](windows-11-requirements.md) for Windows 11, it's a good time to review your deployment infrastructure, tools, and overall endpoint and update management processes and look for opportunities to simplify and optimize. This article provides some helpful guidance to accomplish these tasks. + +## Infrastructure and tools + +The tools that you use for core workloads during Windows 10 deployments can still be used for Windows 11. A few nuanced differences are described below. + + > [!IMPORTANT] + > Be sure to check with the providers of any non-Microsoft solutions that you use. Verify compatibility of these tools with Windows 11, particularly if they provide security or data loss prevention capabilities. + +#### On-premises solutions + +- If you use Windows Server Update Service (WSUS), you will need to sync the new **Windows 11** product category. After you sync the product category, you will see Windows 11 offered as an option. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. + + > [!NOTE] + > During deployment, you will be prompted to agree to the End User License Agreement on behalf of your users. Additionally, you will not see an x86 option because Windows 11 is not supported on 32-bit architecture. + +- If you use Microsoft Endpoint Configuration Manager, you can sync the new **Windows 11** product category and begin upgrading eligible devices. If you would like to validate Windows 11 prior to release, you can sync the **Windows Insider Pre-release** category as well. + + > [!NOTE] + > Configuration Manager will prompt you to accept the End User License Agreement on behalf of the users in your organization. + +#### Cloud-based solutions + +- If you use Windows Update for Business Group Policy or Configuration Service Provider (CSP) policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). +- Quality update deferrals will continue to work the same across both Windows 10 and Windows 11. This is true regardless of which management tool you use to configure Windows Update for Business policies. +- If you use Microsoft Intune and have a Microsoft 365 E3 license, you will be able to use feature update deployments to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. + +## Cloud-based management + +If you aren’t already taking advantage of cloud-based management capabilities, like those available in [Microsoft Endpoint Manager](/mem/endpoint-manager-overview), it's worth considering. In addition to consolidating device management and endpoint security into a single platform, Microsoft Endpoint Manager can better support the diverse bring-your-own-device (BYOD) ecosystem that is increasingly the norm with hybrid work scenarios. It can also enable you to track your progress against compliance and business objectives, while protecting end-user privacy. + +The following are some common use cases and the corresponding Microsoft Endpoint Manager capabilities that support them: + +- **Provision and pre-configure new Windows 11 devices**: [Windows Autopilot](/mem/autopilot/windows-autopilot) enables you to deploy new Windows 11 devices in a “business-ready” state that includes your desired applications, settings, and policies. It can also be used to change the edition of Windows. For example, you can upgrade from Pro to Enterprise edition and gain the use of advanced features. +- **Configure rules and control settings for users, apps, and devices**: When you enroll devices in [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), administrators have full control over apps, settings, features, and security for both Windows 11 and Windows 10. You can also use app protection policies to require multi-factor authentication (MFA) for specific apps. +- **Streamline device management for frontline, remote, and onsite workers**: Introduced with Windows 10, [cloud configuration](/mem/intune/fundamentals/cloud-configuration) is a standard, easy-to-manage, device configuration that is cloud-optimized for users with specific workflow needs. It can be deployed to devices running the Pro, Enterprise, and Education editions of Windows 11 by using Microsoft Endpoint Manager. + +If you are exclusively using an on-premises device management solution (for example, Configuration Manager), you can still use the [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview), enable [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions), or enable [co-management](/mem/configmgr/comanage/overview) with Microsoft Intune. These solutions can make it easier to keep devices secure and up-to-date. + +## Review servicing approach and policies + +Every organization will transition to Windows 11 at its own pace. Microsoft is committed to supporting you through your migration to Windows 11, whether you are a fast adopter or will make the transition over the coming months or years. + +When you think of operating system updates as an ongoing process, you will automatically improve your ability to deploy updates. This approach enables you to stay current with less effort, and less impact on productivity. To begin, think about how you roll out Windows feature updates today: which devices, and at what pace. + +Next, craft a deployment plan for Windows 11 that includes deployment groups, rings, users, or devices. There are no absolute rules for exactly how many rings to have for your deployments, but a common structure is: +- Preview (first or canary): Planning and development +- Limited (fast or early adopters): Pilot and validation +- Broad (users or critical): Wide deployment + +For detailed information, see [Create a deployment plan](/windows/deployment/update/create-deployment-plan). + +#### Review policies + +Review deployment-related policies, taking into consideration your organization's security objectives, update compliance deadlines, and device activity. Apply changes where you can gain a clear improvement, particularly with regard to the speed of the update process or security. + +#### Validate apps and infrastructure + +To validate that your apps, infrastructure, and deployment processes are ready for Windows 11, join the [Windows Insider Program for Business](https://insider.windows.com/for-business-getting-started), and opt in to the [Release Preview Channel](/windows-insider/business/validate-Release-Preview-Channel). + +If you use Windows Server Update Services, you can deploy directly from the Windows Insider Pre-release category using one of the following processes: + +- Set **Manage Preview Builds** to **Release Preview** in Windows Update for Business. +- Leverage Azure Virtual Desktop and Azure Marketplace images. +- Download and deploy ISOs from Microsoft’s Windows Insider Program ISO Download page. + +Regardless of the method you choose, you have the benefit of free Microsoft support when validating pre-release builds. Free support is available to any commercial customer deploying Windows 10 or Windows 11 Preview Builds, once they become available through the Windows Insider Program. + +#### Analytics and assessment tools + +If you use Microsoft Endpoint Manager and have onboarded devices to Endpoint analytics, you will have access to a hardware readiness assessment later this year. This tool enables you to quickly identify which of your managed devices are eligible for the Windows 11 upgrade. + +## Prepare a pilot deployment + +A pilot deployment is a proof of concept that rolls out an upgrade to a select number of devices in production, before deploying it broadly across the organization. + +At a high level, the tasks involved are: + +1. Assign a group of users or devices to receive the upgrade. +2. Implement baseline updates. +3. Implement operational updates. +4. Validate the deployment process. +5. Deploy the upgrade to devices. +6. Test and support the pilot devices. +7. Determine broad deployment readiness based on the results of the pilot. + +## End-user readiness + +Do not overlook the importance of end-user readiness to deliver an effective, enterprise-wide deployment of Windows 11. Windows 11 has a familiar design, but your users will see several enhancements to the overall user interface. They will also need to adapt to changes in menus and settings pages. Therefore, consider the following tasks to prepare users and your IT support staff Windows 11: +- Create a communications schedule to ensure that you provide the right message at the right time to the right groups of users, based on when they will see the changes. +- Draft concise emails that inform users of what changes they can expect to see. Offer tips on how to use or customize their experience. Include information about support and help desk options. +- Update help desk manuals with screenshots of the new user interface, the out-of-box experience for new devices, and the upgrade experience for existing devices. + +## Learn more + +See the [Stay current with Windows 10 and Microsoft 365 Apps](/learn/paths/m365-stay-current/) learning path on Microsoft Learn. +- The learning path was created for Windows 10, but the basic principles and tasks outlined for the plan, prepare, and deploy phases also apply to your deployment of Windows 11. + +## See also + +[Plan for Windows 11](windows-11-plan.md)
+[Windows help & learning](https://support.microsoft.com/windows) diff --git a/windows/whats-new/windows-11-requirements.md b/windows/whats-new/windows-11-requirements.md new file mode 100644 index 0000000000..8c87b2c454 --- /dev/null +++ b/windows/whats-new/windows-11-requirements.md @@ -0,0 +1,90 @@ +--- +title: Windows 11 requirements +description: Hardware requirements to deploy Windows 11 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows 11 requirements + +**Applies to** + +- Windows 11 + +This article lists the system requirements for Windows 11. Windows 11 is also supported on a virtual machine (VM). + +## Hardware requirements + +To install or upgrade to Windows 11, devices must meet the following minimum hardware requirements: + +- Processor: 1 gigahertz (GHz) or faster with two or more cores on a [compatible 64-bit processor](https://aka.ms/CPUlist) or system on a chip (SoC). +- RAM: 4 gigabytes (GB) or greater. +- Storage: 64 GB\* or greater available storage is required to install Windows 11. + - Additional storage space might be required to download updates and enable specific features. +- Graphics card: Compatible with DirectX 12 or later, with a WDDM 2.0 driver. +- System firmware: UEFI, Secure Boot capable. +- TPM: [Trusted Platform Module](/windows/security/information-protection/tpm/trusted-platform-module-overview) (TPM) version 2.0. +- Display: High definition (720p) display, 9" or greater monitor, 8 bits per color channel. +- Internet connection: Internet connectivity is necessary to perform updates, and to download and use some features. + - Windows 11 Home edition requires an Internet connection and a Microsoft Account to complete device setup on first use. + +\* There might be additional requirements over time for updates, and to enable specific features within the operating system. For more information, see [Keeping Windows 11 up-to-date](https://www.microsoft.com/windows/windows-10-specifications#primaryR5). + +For information about tools to evaluate readiness, see [Determine eligibility](windows-11-plan.md#determine-eligibility). + +## Operating system requirements + +For the best Windows 11 upgrade experience, eligible devices should be running Windows 10, version 20H1 or later. + +> [!NOTE] +> S mode is only supported on the Home edition of Windows 11. +> If you are running a different edition of Windows in S mode, you will need to first [switch out of S mode](/windows/deployment/windows-10-pro-in-s-mode) prior to upgrading.
 
+> Switching a device out of Windows 10 in S mode also requires internet connectivity. If you switch out of S mode, you cannot switch back to S mode later. + +## Feature-specific requirements + +Some features in Windows 11 have requirements beyond those listed above. See the following list of features and associated requirements. + +- **5G support**: requires 5G capable modem. +- **Auto HDR**: requires an HDR monitor. +- **BitLocker to Go**: requires a USB flash drive. This feature is available in Windows Pro and above editions. +- **Client Hyper-V**: requires a processor with second-level address translation (SLAT) capabilities. This feature is available in Windows Pro editions and above. +- **Cortana**: requires a microphone and speaker and is currently available on Windows 11 for Australia, Brazil, Canada, China, France, Germany, India, Italy, Japan, Mexico, Spain, United Kingdom, and United States. +- **DirectStorage**: requires an NVMe SSD to store and run games that use the Standard NVM Express Controller driver and a DirectX12 GPU with Shader Model 6.0 support. +- **DirectX 12 Ultimate**: available with supported games and graphics chips. +- **Presence**: requires sensor that can detect human distance from device or intent to interact with device. +- **Intelligent Video Conferencing**: requires video camera, microphone, and speaker (audio output) +- **Multiple Voice Assistant**: requires a microphone and speaker. +- **Snap**: three-column layouts require a screen that is 1920 effective pixels or greater in width. +- **Mute** and **unmute**: from Taskbar requires video camera, microphone, and speaker (audio output). App must be compatible with feature to enable global mute/unmute. +- **Spatial Sound**: requires supporting hardware and software. +- **Microsoft Teams**: requires video camera, microphone, and speaker (audio output). +- **Touch**: requires a screen or monitor that supports multi-touch. +- **Two-factor authentication**: requires use of PIN, biometric (fingerprint reader or illuminated infrared camera), or a phone with Wi-Fi or Bluetooth capabilities. +- **Voice Typing**: requires a PC with a microphone. +- **Wake on Voice**: requires Modern Standby power model and microphone. +- **Wi-Fi 6E**: requires new WLAN IHV hardware and driver and a Wi-Fi 6E capable AP/router. +- **Windows Hello**: requires a camera configured for near infrared (IR) imaging or fingerprint reader for biometric authentication. Devices without biometric sensors can use Windows Hello with a PIN or portable Microsoft compatible security key. For more information, see [IT tools to support Windows 10, version 21H1](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/it-tools-to-support-windows-10-version-21h1/ba-p/2365103). +- **Windows Projection**: requires a display adapter that supports Windows Display Driver Model (WDDM) 2.0 and a Wi-Fi adapter that supports Wi-Fi Direct. +- **Xbox app**: requires an Xbox Live account, which is not available in all regions. Please go to the Xbox Live Countries and Regions page for the most up-to-date information on availability. Some features in the Xbox app will require an active [Xbox Game Pass](https://www.xbox.com/xbox-game-pass) subscription. + + +## Next steps + +[Plan for Windows 11](windows-11-plan.md)
+[Prepare for Windows 11](windows-11-prepare.md) + +## See also + +[Windows 11 overview](windows-11.md) + diff --git a/windows/whats-new/windows-11.md b/windows/whats-new/windows-11.md new file mode 100644 index 0000000000..260967a467 --- /dev/null +++ b/windows/whats-new/windows-11.md @@ -0,0 +1,86 @@ +--- +title: Windows 11 overview +description: Overview of Windows 11 +ms.assetid: E9E2DED5-DBA7-4300-B411-BA0FD39BE18C +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows 11 overview + +**Applies to** + +- Windows 11 + +This article provides an introduction to Windows 11, and answers some frequently asked questions. + +Also see the following articles to learn more about Windows 11: + +- [Windows 11 requirements](windows-11-requirements.md): Requirements to deploy Windows 11. +- [Plan for Windows 11](windows-11-plan.md): Information to help you plan for Windows 11 in your organization. +- [Prepare for Windows 11](windows-11-prepare.md): Procedures to ensure readiness to deploy Windows 11. + +## Introduction + +Windows 11 is the next evolution of Windows; it is the most significant update to the Windows operating system since Windows 10. It offers many innovations focused on enhancing end-user productivity in a fresh experience that is flexible and fluid. Windows 11 is designed to support today's hybrid work environment, and intended to be the most reliable, secure, connected, and performant Windows operating system ever. + +Windows 11 is built on the same foundation as Windows 10, so the investments you have made in tools for update and device management are carried forward. Windows 11 also sustains the application compatibility promise made with Windows 10, supplemented by programs like App Assure. For Microsoft 365 customers seeking further assistance, FastTrack will continue to be available to support your efforts to adopt Windows 11. + +## How to get Windows 11 + +Windows 11 will be delivered as an upgrade to eligible devices running Windows 10, beginning later in the 2021 calendar year. Windows 11 will also be available on eligible new devices. + +For administrators managing devices on behalf of their organization, Windows 11 will be available through the same, familiar channels that you use today for Windows 10 feature updates. You will be able to use existing deployment and management tools, such as Windows Update for Business, Microsoft Endpoint Manager, and Windows Autopilot. For more information, see [Plan for Windows 11](windows-11-plan.md). + +For devices that are not managed by an organization, the Windows 11 upgrade will be offered to eligible Windows 10 devices through Windows Update using Microsoft's intelligent rollout process to ensure a smooth upgrade experience. + +For more information about device eligibility, see [Windows 11 requirements](windows-11-requirements.md). + +If you are interested in testing Windows 11 before general availability, you can join the [Windows Insider Program](https://insider.windows.com) or [Windows Insider Program for Business](https://insider.windows.com/for-business). You can also preview Windows 11 by enabling pre-release Windows 10 feature updates in [Microsoft Endpoint Configuration Manager](/mem/configmgr/core/servers/manage/pre-release-features) or [Windows Server Update Services](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/publishing-pre-release-windows-10-feature-updates-to-wsus/ba-p/845054) (WSUS). + +## Before you begin + +The following sections provide a quick summary of licensing, compatibility, management, and servicing considerations to help you get started with Windows 11. + +#### Licensing + +There are no unique licensing requirements for Windows 11 beyond what is required for Windows 10 devices. + +Microsoft 365 licenses that include Windows 10 licenses will permit you to run Windows 11 on supported devices. If you have a volume license, it will equally cover Windows 11 and Windows 10 devices before and after upgrade. + +#### Compatibility + +Most accessories and associated drivers that work with Windows 10 are expected to work with Windows 11. Check with your accessory manufacturer for specific details. + +Windows 11 preserves the application compatibility promise made with Windows 10, and does not require changes to existing support processes or tooling to sustain the currency of applications and devices. Microsoft 365 customers can continue to use programs such as App Assure and FastTrack to support IT efforts to adopt and maintain Windows 11. For more information, see [Application compatibility](windows-11-plan.md#application-compatibility). + +#### Familiar processes + +Windows 11 is built on the same foundation as Windows 10. Typically, you can use the same tools and solutions you use today to deploy, manage, and secure Windows 11. Your current management tools and processes will also work to manage monthly quality updates for both Windows 10 and Windows 11. + +> [!IMPORTANT] +> Check with the providers of any non-Microsoft security and management solutions that you use to ensure compatibility with Windows 11, particularly those providing security or data loss prevention capabilities. + +For more information, see [Prepare for Windows 11](windows-11-prepare.md). + +#### Servicing Windows 11 + +Like Windows 10, Windows 11 will receive monthly quality updates. However, it will have a new feature update cadence. Windows 11 feature updates will be released once per year. + +When Windows 11 reaches general availability, important servicing-related announcements and information about known issues and safeguard holds can be found on the [Windows release health](https://aka.ms/windowsreleasehealth) hub. Monthly release notes will also be available from a consolidated Windows 11 update history page at that time. For more information, see [Servicing and support](windows-11-plan.md#servicing-and-support). + +## Next steps + +[Windows 11 requirements](windows-11-requirements.md)
+[Plan for Windows 11](windows-11-plan.md)
+[Prepare for Windows 11](windows-11-prepare.md) \ No newline at end of file