From 91c9cad165c61a12e18e6d1e759d6cc285bafd09 Mon Sep 17 00:00:00 2001 From: Shesh <56231259+sheshachary@users.noreply.github.com> Date: Mon, 30 May 2022 18:18:12 +0530 Subject: [PATCH] improved the consistency in articles --- .../client-management/mdm/policy-csp-power.md | 24 ++++++----- .../mdm/policy-csp-printers.md | 43 +++++++++++-------- .../mdm/policy-csp-privacy.md | 42 ++++++------------ .../mdm/policy-csp-remoteassistance.md | 33 ++++++++------ .../mdm/policy-csp-remotedesktop.md | 8 +++- .../mdm/policy-csp-remotedesktopservices.md | 22 +++++----- 6 files changed, 88 insertions(+), 84 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 30eb1c679f..5976b7128d 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -93,11 +93,11 @@ manager: dansimp > [!TIP] -> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
@@ -341,7 +341,7 @@ If you enable this policy setting, you must provide a value, in seconds, indicat If you disable or don't configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the display from turning off. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the display from turning off. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. @@ -500,7 +500,7 @@ If you enable this policy setting, you must provide a value, in seconds, indicat If you disable or don't configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. @@ -548,11 +548,10 @@ If you enable this policy setting, you must provide a value, in seconds, indicat If you disable or don't configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. - ADMX Info: - GP Friendly name: *Specify the system hibernate timeout (plugged in)* @@ -1103,7 +1102,7 @@ If you enable this policy setting, you must provide a value, in seconds, indicat If you disable or don't configure this policy setting, users control this setting. -If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. +If the user has configured a slide show to run on the lock screen when the machine is locked, this slide show can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. @@ -1163,8 +1162,8 @@ ADMX Info: The following are the supported values for Hybrid sleep (on battery): -- 0 - no hibernation file for sleep (default) -- 1 - hybrid sleep +- 0 - no hibernation file for sleep (default). +- 1 - hybrid sleep. @@ -1221,8 +1220,8 @@ ADMX Info: The following are the supported values for Hybrid sleep (plugged in): -- 0 - no hibernation file for sleep (default) -- 1 - hybrid sleep +- 0 - no hibernation file for sleep (default). +- 1 - hybrid sleep. @@ -1353,3 +1352,6 @@ Default value for unattended sleep timeout (plugged in): +## Related topics + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index 48b7f7722b..5ca2bba194 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -15,7 +15,6 @@ manager: dansimp # Policy CSP - Printers -
@@ -46,11 +45,11 @@ manager: dansimp > [!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
@@ -105,7 +104,8 @@ manager: dansimp This policy implements the print portion of the Device Control requirements. -These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers, while either directly connected to the corporate network or when using a VPN connection to the corporate network. + This policy will contain the comma-separated list of approved USB Vid&Pid combinations that the print spooler will allow to print when Device Control is enabled. The format of this setting is `/[,/]` @@ -176,7 +176,8 @@ ADMX Info: This policy implements the print portion of the Device Control requirements. -These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers, while either directly connected to the corporate network or when using a VPN connection to the corporate network. + This policy will contain the comma separated list of approved USB Vid&Pid combinations that the print spooler will allow to print when Device Control is enabled. The format of this setting is `/[,/]` @@ -244,7 +245,8 @@ ADMX Info: This policy implements the print portion of the Device Control requirements. -These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers, while either directly connected to the corporate network or when using a VPN connection to the corporate network. + This policy will control whether the print spooler will attempt to restrict printing as part of Device Control. The default value of the policy will be Unconfigured. @@ -253,7 +255,6 @@ If the policy value is either Unconfigured or Disabled, the print spooler won't If the policy value is Enabled, the print spooler will restrict local printing to USB devices in the Approved Device list. - @@ -320,7 +321,8 @@ ADMX Info: This policy implements the print portion of the Device Control requirements. -These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network. +These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers, while either directly connected to the corporate network or when using a VPN connection to the corporate network. + This policy will control whether the print spooler will attempt to restrict printing as part of Device Control. The default value of the policy will be Unconfigured. @@ -329,7 +331,6 @@ If the policy value is either Unconfigured or Disabled, the print spooler won't If the policy value is Enabled, the print spooler will restrict local printing to USB devices in the Approved Device list. - @@ -382,9 +383,9 @@ If you don't configure this policy setting: - Windows Vista client computers can point and print to any server. -- Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print. +- Windows Vista computers will show a warning and an elevated command prompt, when users create a printer connection to any server using Point and Print. -- Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated. +- Windows Vista computers will show a warning and an elevated command prompt, when an existing printer connection driver needs to be updated. - Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print. @@ -392,9 +393,9 @@ If you disable this policy setting: - Windows Vista client computers can create a printer connection to any server using Point and Print. -- Windows Vista computers won't show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print. +- Windows Vista computers won't show a warning or an elevated command prompt, when users create a printer connection to any server using Point and Print. -- Windows Vista computers won't show a warning or an elevated command prompt when an existing printer connection driver needs to be updated. +- Windows Vista computers won't show a warning or an elevated command prompt, when an existing printer connection driver needs to be updated. - Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. @@ -465,9 +466,9 @@ If you don't configure this policy setting: - Windows Vista client computers can point and print to any server. -- Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print. +- Windows Vista computers will show a warning and an elevated command prompt, when users create a printer connection to any server using Point and Print. -- Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated. +- Windows Vista computers will show a warning and an elevated command prompt, when an existing printer connection driver needs to be updated. - Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print. @@ -475,9 +476,9 @@ If you disable this policy setting: - Windows Vista client computers can create a printer connection to any server using Point and Print. -- Windows Vista computers won't show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print. +- Windows Vista computers won't show a warning or an elevated command prompt, when users create a printer connection to any server using Point and Print. -- Windows Vista computers won't show a warning or an elevated command prompt when an existing printer connection driver needs to be updated. +- Windows Vista computers won't show a warning or an elevated command prompt, when an existing printer connection driver needs to be updated. - Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. @@ -524,11 +525,12 @@ ADMX Info: Determines whether the computer's shared printers can be published in Active Directory. -If you enable this setting or don't configure it, users can use the "List in directory" option in the Printer's Properties' Sharing tab to publish shared printers in Active Directory. +If you enable this setting or don't configure it, users can use the "List in directory" option in the Printer's Properties' on the Sharing tab, to publish shared printers in Active Directory. If you disable this setting, this computer's shared printers can't be published in Active Directory, and the "List in directory" option isn't available. -Note: This setting takes priority over the setting "Automatically publish new printers in the Active Directory". +> [!NOTE] +> This setting takes priority over the setting "Automatically publish new printers in the Active Directory". @@ -545,3 +547,6 @@ ADMX Info: +## Related topics + +[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 0bcba72d88..9be580547c 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -15,7 +15,6 @@ manager: dansimp # Policy CSP - Privacy -
@@ -328,7 +327,6 @@ Allows or disallows the automatic acceptance of the pairing and privacy user con > [!NOTE] > There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709. - Most restricted value is 0. @@ -419,7 +417,7 @@ The following list shows the supported values: -Updated in Windows 10, version 1809. This policy specifies whether users on the device have the option to enable online speech recognition. When enabled, users can use their voice for dictation and to talk to Cortana and other apps that use Microsoft cloud-based speech recognition. Microsoft will use voice input to help improve our speech services. If the policy value is set to 0, online speech recognition will be disabled and users cannot enable online speech recognition via settings. If policy value is set to 1 or is not configured, control is deferred to users. +Updated in Windows 10, version 1809. This policy specifies whether users on the device have the option to enable online speech recognition. When enabled, users can use their voice for dictation, and talk to Cortana and other apps that use Microsoft cloud-based speech recognition. Microsoft will use voice input to help improve our speech services. If the policy value is set to 0, online speech recognition will be disabled and users cannot enable online speech recognition via settings. If policy value is set to 1 or is not configured, control is deferred to users. Most restricted value is 0. @@ -523,7 +521,8 @@ The following list shows the supported values: Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. -Value type is integer. +Supported value type is integer. + - 0 (default) - Allow the "choose privacy settings for your device" screen for a new user during their first logon or when an existing user logs in for the first time after an upgrade. - 1 - Do not allow the "choose privacy settings for your device" screen when a new user logs in or an existing user logs in for the first time after an upgrade. @@ -591,7 +590,7 @@ ADMX Info: The following list shows the supported values: -- 0 – Disabled. Apps/OS can't publish the activities and roaming is disabled. (not published to the cloud). +- 0 – Disabled. Apps/OS can't publish the activities and roaming is disabled (not published to the cloud). - 1 – (default) Enabled. Apps/OS can publish the activities and will be roamed across device graph. @@ -627,7 +626,6 @@ The following list shows the supported values: Specifies whether Windows apps can access account information. - Most restricted value is 2. @@ -809,7 +807,7 @@ ADMX Info: Specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. -Value type is integer. +Supported value type is integer. @@ -864,7 +862,7 @@ The following list shows the supported values: List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. -Value type is chr. +Supported value type is chr. @@ -914,7 +912,7 @@ ADMX Info: List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. -Value type is chr. +Supported value type is chr. @@ -965,7 +963,7 @@ ADMX Info: List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. -Value type is chr. +Supported value type is chr. @@ -1012,7 +1010,6 @@ ADMX Info: Specifies whether Windows apps can access the calendar. - Most restricted value is 2. @@ -1191,7 +1188,6 @@ ADMX Info: Specifies whether Windows apps can access call history. - Most restricted value is 2. @@ -1370,7 +1366,6 @@ ADMX Info: Specifies whether Windows apps can access the camera. - Most restricted value is 2. @@ -1549,7 +1544,6 @@ ADMX Info: Specifies whether Windows apps can access contacts. - Most restricted value is 2. @@ -1728,7 +1722,6 @@ ADMX Info: Specifies whether Windows apps can access email. - Most restricted value is 2. @@ -2039,7 +2032,6 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use Specifies whether Windows apps can access location. - Most restricted value is 2. @@ -2218,7 +2210,6 @@ ADMX Info: Specifies whether Windows apps can read or send messages (text or MMS). - Most restricted value is 2. @@ -2397,7 +2388,6 @@ ADMX Info: Specifies whether Windows apps can access the microphone. - Most restricted value is 2. @@ -2576,7 +2566,6 @@ ADMX Info: Specifies whether Windows apps can access motion data. - Most restricted value is 2. @@ -2755,7 +2744,6 @@ ADMX Info: Specifies whether Windows apps can access notifications. - Most restricted value is 2. @@ -2934,7 +2922,6 @@ ADMX Info: Specifies whether Windows apps can make phone calls. - Most restricted value is 2. @@ -3113,7 +3100,6 @@ ADMX Info: Specifies whether Windows apps have access to control radios. - Most restricted value is 2. @@ -3460,7 +3446,6 @@ ADMX Info: Specifies whether Windows apps can access trusted devices. - Most restricted value is 2. @@ -3739,7 +3724,6 @@ The following list shows the supported values: Force allow, force deny or give user control of apps that can get diagnostic information about other running apps. - Most restricted value is 2. @@ -3918,8 +3902,8 @@ ADMX Info: Specifies whether Windows apps can run in the background. - Most restricted value is 2. + > [!WARNING] > Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly. @@ -4013,7 +3997,7 @@ ADMX Info: -List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. +List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability, to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. @@ -4099,7 +4083,6 @@ ADMX Info: Specifies whether Windows apps can sync with devices. - Most restricted value is 2. @@ -4276,7 +4259,7 @@ ADMX Info: -Allows It Admins to enable publishing of user activities to the activity feed. +Allows IT Admins to enable publishing of user activities to the activity feed. @@ -4340,3 +4323,6 @@ ADMX Info: +## Related topics + +[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 64c53af12c..a643911555 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -71,9 +71,9 @@ manager: dansimp This policy setting lets you customize warning messages. -The "Display warning message before sharing control" policy setting allows you to specify a custom message to display before users share control of their computers. +The "Display warning message before sharing control" policy setting allows you to specify a custom message, to display before users share control of their computers. -The "Display warning message before connecting" policy setting allows you to specify a custom message to display before users allow a connection to their computers. +The "Display warning message before connecting" policy setting allows you to specify a custom message, to display before users allow a connection to their computers. If you enable this policy setting, the warning message you specify overrides the default message that is seen by the novice. @@ -181,7 +181,7 @@ If you enable this policy setting, you have two ways to allow helpers to provide The "Maximum ticket time" policy setting sets a limit on the amount of time that a Remote Assistance invitation created by using email or file transfer can remain open. -The "Select the method for sending email invitations" setting specifies which email standard to use to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting isn't available in Windows Vista since SMAPI is the only method supported. +The "Select the method for sending email invitations" setting specifies which email standard to use, to send Remote Assistance invitations. Depending on your email program, you can use either the Mailto standard (the invitation recipient connects through an Internet link) or the SMAPI (Simple MAPI) standard (the invitation is attached to your email message). This policy setting isn't available in Windows Vista, since SMAPI is the only method supported. If you enable this policy setting, you should also enable appropriate firewall exceptions to allow Remote Assistance communications. @@ -246,23 +246,24 @@ If you enable this policy setting, you should also enable firewall exceptions to Windows Vista and later Enable the Remote Assistance exception for the domain profile. The exception must contain: -Port 135:TCP -%WINDIR%\System32\msra.exe -%WINDIR%\System32\raserver.exe + +- Port 135:TCP +- %WINDIR%\System32\msra.exe +- %WINDIR%\System32\raserver.exe Windows XP with Service Pack 2 (SP2) and Windows XP Professional x64 Edition with Service Pack 1 (SP1) -Port 135:TCP -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe -%WINDIR%\System32\Sessmgr.exe +- Port 135:TCP +- %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe +- %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe +- %WINDIR%\System32\Sessmgr.exe For computers running Windows Server 2003 with Service Pack 1 (SP1) -Port 135:TCP -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe -%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe -Allow Remote Desktop Exception +- Port 135:TCP +- %WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe +- %WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe +- Allow Remote Desktop Exception @@ -278,3 +279,7 @@ ADMX Info:
+ +## Related topics + +[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-remotedesktop.md b/windows/client-management/mdm/policy-csp-remotedesktop.md index 7d2559655b..b8e8e886b2 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktop.md +++ b/windows/client-management/mdm/policy-csp-remotedesktop.md @@ -59,7 +59,7 @@ manager: dansimp -This policy allows administrators to enable automatic subscription for the Microsoft Remote Desktop client. If you define this policy, the specified URL is used by the client to silently subscribe the logged on user and retrieve the remote resources assigned to them. To automatically subscribe to Azure Virtual Desktop in the Azure Public cloud, set the URL to `https://rdweb.wvd.microsoft.com/api/arm/feeddiscovery`. +This policy allows administrators to enable automatic subscription for the Microsoft Remote Desktop client. If you define this policy, the specified URL is used by the client to subscribe the logged on user and retrieve the remote resources assigned to them. To automatically subscribe to Azure Virtual Desktop in the Azure Public cloud, set the URL to `https://rdweb.wvd.microsoft.com/api/arm/feeddiscovery`. @@ -93,7 +93,7 @@ This policy allows administrators to enable automatic subscription for the Micro -This policy allows the user to load the DPAPI cred key from their user profile and decrypt any previously encrypted DPAPI data in the user profile or encrypt any new DPAPI data. This policy is needed when using FSLogix user profiles from Azure AD-joined VMs. +This policy allows the user to load the DPAPI cred key from their user profile, and decrypt any previously encrypted DPAPI data in the user profile or encrypt any new DPAPI data. This policy is needed when using FSLogix user profiles from Azure AD-joined VMs. @@ -111,3 +111,7 @@ The following list shows the supported values: + +## Related topics + +[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 6519b2d40c..f2a69c330a 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -14,8 +14,6 @@ manager: dansimp # Policy CSP - RemoteDesktopServices - -
@@ -43,11 +41,11 @@ manager: dansimp > [!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect).
@@ -85,7 +83,8 @@ If you disable this policy setting, users can't connect remotely to the target c If you don't configure this policy setting, Remote Desktop Services uses the Remote Desktop setting on the target computer to determine whether the remote connection is allowed. This setting is found on the Remote tab in the System properties sheet. By default, remote connections aren't allowed. -Note: You can limit which clients are able to connect remotely by using Remote Desktop Services by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication. +> [!NOTE] +> You can limit which clients are able to connect remotely by using Remote Desktop Services by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security\Require user authentication for remote connections by using Network Level Authentication. You can limit the number of users who can connect simultaneously by configuring the policy setting at Computer Configuration\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Limit number of connections, or by configuring the policy setting Maximum Connections by using the Remote Desktop Session Host WMI Provider. @@ -129,7 +128,7 @@ ADMX Info: -Specifies whether to require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you're using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) isn't recommended. This policy doesn't apply to SSL encryption. +Specifies whether it require the use of a specific encryption level to secure communications between client computers and RD Session Host servers during Remote Desktop Protocol (RDP) connections. This policy only applies when you're using native RDP encryption. However, native RDP encryption (as opposed to SSL encryption) isn't recommended. This policy doesn't apply to SSL encryption. If you enable this policy setting, all communications between clients and RD Session Host servers during remote connections must use the encryption method specified in this setting. By default, the encryption level is set to High. The following encryption methods are available: @@ -141,9 +140,8 @@ If you enable this policy setting, all communications between clients and RD Ses If you disable or don't configure this setting, the encryption level to be used for remote connections to RD Session Host servers isn't enforced through Group Policy. -Important - -FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level when communications between clients and RD Session Host servers requires the highest level of encryption. +> [!IMPORTANT] +> FIPS compliance can be configured through the System cryptography. Use FIPS compliant algorithms for encryption, hashing, and signing settings in Group Policy (under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options.) The FIPS compliant setting encrypts and decrypts data sent from the client to the server and from the server to the client, with the Federal Information Processing Standard (FIPS) 140 encryption algorithms, by using Microsoft cryptographic modules. Use this encryption level, when communications between clients and RD Session Host servers requires the highest level of encryption. @@ -343,7 +341,8 @@ If the status is set to Disabled, Remote Desktop Services always requests securi If the status is set to Not Configured, unsecured communication is allowed. -Note: The RPC interface is used for administering and configuring Remote Desktop Services. +> [!NOTE] +> The RPC interface is used for administering and configuring Remote Desktop Services. @@ -360,3 +359,6 @@ ADMX Info: +## Related topics + +[Policy configuration service provider](policy-configuration-service-provider.md) \ No newline at end of file