deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 21:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Acrolinx enhancement effort

Browse Source
This commit is contained in:
Siddarth Mandalika 2022-03-30 12:14:37 +05:30
parent 4adf355b69
commit 9c8783f1de
10 changed files with 101 additions and 101 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
windows/client-management/mdm/policy-csp-autoplay.md
View File

@ -72,9 +72,9 @@ manager: dansimp
<!--Description--> <!--Description-->
This policy setting disallows AutoPlay for MTP devices like cameras or phones. This policy setting disallows AutoPlay for MTP devices like cameras or phones.
If you enable this policy setting, AutoPlay is not allowed for MTP devices like cameras or phones. If you enable this policy setting, AutoPlay isn't allowed for MTP devices like cameras or phones.
If you disable or do not configure this policy setting, AutoPlay is enabled for non-volume devices. If you disable or don't configure this policy setting, AutoPlay is enabled for non-volume devices.
<!--/Description--> <!--/Description-->
@ -121,11 +121,11 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting sets the default behavior for Autorun commands. This policy setting sets the default behavior for Autorun commands.
Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines. Autorun commands are stored in autorun.inf files. They often launch the installation program or other routines.
Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention. Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention.
This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog. This automatic execution creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.
If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to: If you enable this policy setting, an Administrator can change the default Windows Vista or later behavior for autorun to:
@ -183,13 +183,13 @@ Autoplay begins reading from a drive as soon as you insert media in the drive. A
Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives. Prior to Windows XP SP2, Autoplay is disabled by default on removable drives, such as the floppy disk drive (but not the CD-ROM drive), and on network drives.
Starting with Windows XP SP2, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices. With Windows XP SP2 onward, Autoplay is enabled for removable drives as well, including Zip drives and some USB mass storage devices.
If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives. If you enable this policy setting, Autoplay is disabled on CD-ROM and removable media drives, or disabled on all drives.
This policy setting disables Autoplay on additional types of drives. You cannot use this setting to enable Autoplay on drives on which it is disabled by default. This policy setting disables Autoplay on other types of drives. You can't use this setting to enable Autoplay on drives on which it's disabled by default.
If you disable or do not configure this policy setting, AutoPlay is enabled. If you disable or don't configure this policy setting, AutoPlay is enabled.
Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration. Note: This policy setting appears in both the Computer Configuration and User Configuration folders. If the policy settings conflict, the policy setting in Computer Configuration takes precedence over the policy setting in User Configuration.

8
windows/client-management/mdm/policy-csp-bitlocker.md
View File

@ -1,6 +1,6 @@
--- ---
title: Policy CSP - Bitlocker title: Policy CSP - BitLocker
description: Use the Policy configuration service provider (CSP) - Bitlocker to manage encryption of PCs and devices. description: Use the Policy configuration service provider (CSP) - BitLocker to manage encryption of PCs and devices.
ms.author: dansimp ms.author: dansimp
ms.topic: article ms.topic: article
ms.prod: w10 ms.prod: w10
@ -12,7 +12,7 @@ ms.reviewer:
manager: dansimp manager: dansimp
--- ---
# Policy CSP - Bitlocker # Policy CSP - BitLocker
@ -22,7 +22,7 @@ manager: dansimp
<hr/> <hr/>
<!--Policies--> <!--Policies-->
## Bitlocker policies ## BitLocker policies
<dl> <dl>
<dd> <dd>

30
windows/client-management/mdm/policy-csp-bits.md
View File

@ -78,7 +78,7 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy specifies the bandwidth throttling **end time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. This policy specifies the bandwidth throttling **end time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting doesn't affect foreground transfers. This policy is based on the 24-hour clock.
Value type is integer. Default value is 17 (5 PM). Value type is integer. Default value is 17 (5 PM).
@ -88,10 +88,10 @@ You can specify a limit to use during a specific time interval and at all other
Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. If you disable or don't configure this policy setting, BITS uses all available unused bandwidth.
> [!NOTE] > [!NOTE]
> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. > You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting doesn't affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
@ -144,7 +144,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy specifies the bandwidth throttling **start time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. This policy specifies the bandwidth throttling **start time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting doesn't affect foreground transfers. This policy is based on the 24-hour clock.
Value type is integer. Default value is 8 (8 am). Value type is integer. Default value is 8 (8 am).
@ -152,12 +152,12 @@ Supported value range: 0 - 23
You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours.
Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. BITS, by using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. If you disable or don't configure this policy setting, BITS uses all available unused bandwidth.
> [!NOTE] > [!NOTE]
> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. > You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting doesn't affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
@ -210,7 +210,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy specifies the bandwidth throttling **transfer rate** in kilobits per second (Kbps) that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy specifies the bandwidth throttling **transfer rate** in kilobits per second (Kbps) that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting doesn't affect foreground transfers.
Value type is integer. Default value is 1000. Value type is integer. Default value is 1000.
@ -218,12 +218,12 @@ Supported value range: 0 - 4294967200
You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours. You can specify a limit to use during a specific time interval and at all other times. For example, limit the use of network bandwidth to 10 Kbps from 8:00 A.M. to 5:00 P.M., and use all available unused bandwidth the rest of the day's hours.
Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), BITS will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0. BITS, by using the three policies together (BandwidthThrottlingStartTime, BandwidthThrottlingEndTime, BandwidthThrottlingTransferRate), will limit its bandwidth usage to the specified values. You can specify the limit in kilobits per second (Kbps). If you specify a value less than 2 kilobits, BITS will continue to use approximately 2 kilobits. To prevent BITS transfers from occurring, specify a limit of 0.
If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. If you disable or don't configure this policy setting, BITS uses all available unused bandwidth.
> [!NOTE] > [!NOTE]
> You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. > You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting doesn't affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose.
Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs).
@ -278,7 +278,7 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers. This policy setting defines the default behavior that the Background Intelligent Transfer Service (BITS) uses for background transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of background transfers.
If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting doesn't override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority.
For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are: For example, you can specify that background jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:
- 1 - Always transfer - 1 - Always transfer
@ -338,7 +338,7 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting defines the default behavior that the foreground Intelligent Transfer Service (BITS) uses for foreground transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of foreground transfers. This policy setting defines the default behavior that the foreground Intelligent Transfer Service (BITS) uses for foreground transfers when the system is connected to a costed network (3G, etc.). Download behavior policies further limit the network usage of foreground transfers.
If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting does not override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority. If you enable this policy setting, you can define a default download policy for each BITS job priority. This setting doesn't override a download policy explicitly configured by the application that created the BITS job, but does apply to jobs that are created by specifying only a priority.
For example, you can specify that foreground jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are: For example, you can specify that foreground jobs are by default to transfer only when on uncosted network connections, but foreground jobs should proceed only when not roaming. The values that can be assigned are:
- 1 - Always transfer - 1 - Always transfer
@ -406,9 +406,9 @@ Value type is integer. Default is 90 days.
Supported values range: 0 - 999 Supported values range: 0 - 999
Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs. Consider increasing the timeout value if computers tend to stay offline for a long period of time and still have pending jobs.
Consider decreasing this value if you are concerned about orphaned jobs occupying disk space. Consider decreasing this value if you're concerned about orphaned jobs occupying disk space.
If you disable or do not configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout. If you disable or don't configure this policy setting, the default value of 90 (days) will be used for the inactive job timeout.
<!--/Description--> <!--/Description-->
<!--ADMXMapped--> <!--ADMXMapped-->

18
windows/client-management/mdm/policy-csp-bluetooth.md
View File

@ -75,7 +75,7 @@ manager: dansimp
<!--Description--> <!--Description-->
Specifies whether the device can send out Bluetooth advertisements. Specifies whether the device can send out Bluetooth advertisements.
If this is not set or it is deleted, the default value of 1 (Allow) is used. If this policy isn't set or is deleted, the default value of 1 (Allow) is used.
Most restricted value is 0. Most restricted value is 0.
@ -83,7 +83,7 @@ Most restricted value is 0.
<!--SupportedValues--> <!--SupportedValues-->
The following list shows the supported values: The following list shows the supported values:
- 0 – Not allowed. When set to 0, the device will not send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is not received by the peripheral. - 0 – Not allowed. When set to 0, the device won't send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement isn't received by the peripheral.
- 1 (default) – Allowed. When set to 1, the device will send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is received by the peripheral. - 1 (default) – Allowed. When set to 1, the device will send out advertisements. To verify, use any Bluetooth LE app and enable it to do advertising. Then, verify that the advertisement is received by the peripheral.
<!--/SupportedValues--> <!--/SupportedValues-->
@ -120,7 +120,7 @@ The following list shows the supported values:
<!--Description--> <!--Description-->
Specifies whether other Bluetooth-enabled devices can discover the device. Specifies whether other Bluetooth-enabled devices can discover the device.
If this is not set or it is deleted, the default value of 1 (Allow) is used. If this policy isn't set or is deleted, the default value of 1 (Allow) is used.
Most restricted value is 0. Most restricted value is 0.
@ -128,7 +128,7 @@ Most restricted value is 0.
<!--SupportedValues--> <!--SupportedValues-->
The following list shows the supported values: The following list shows the supported values:
- 0 – Not allowed. When set to 0, other devices will not be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that you cannot see the name of the device. - 0 – Not allowed. When set to 0, other devices won't be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that you can't see the name of the device.
- 1 (default) – Allowed. When set to 1, other devices will be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel and verify that you can discover it. - 1 (default) – Allowed. When set to 1, other devices will be able to detect the device. To verify, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel and verify that you can discover it.
<!--/SupportedValues--> <!--/SupportedValues-->
@ -247,9 +247,9 @@ The following list shows the supported values:
<!--Description--> <!--Description-->
Sets the local Bluetooth device name. Sets the local Bluetooth device name.
If this is set, the value that it is set to will be used as the Bluetooth device name. To verify the policy is set, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that the value that was specified. If this name is set, the value that it's set to will be used as the Bluetooth device name. To verify the policy is set, open the Bluetooth control panel on the device. Then, go to another Bluetooth-enabled device, open the Bluetooth control panel, and verify that the value that was specified.
If this policy is not set or it is deleted, the default local radio name is used. If this policy isn't set or is deleted, the default local radio name is used.
<!--/Description--> <!--/Description-->
<!--/Policy--> <!--/Policy-->
@ -327,7 +327,7 @@ The following list shows the supported values:
- 0 (default) - All Bluetooth traffic is allowed. - 0 (default) - All Bluetooth traffic is allowed.
- N - A number from 1 through 16 representing the bytes that must be used in the encryption process. Currently, 16 is the largest allowed value for N and 16 bytes is the largest key size that Bluetooth supports. If you want to enforce Windows to always use Bluetooth encryption, ignoring the precise encryption key strength, use 1 as the value for N. - N - A number from 1 through 16 representing the bytes that must be used in the encryption process. Currently, 16 is the largest allowed value for N and 16 bytes is the largest key size that Bluetooth supports. If you want to enforce Windows to always use Bluetooth encryption, ignoring the precise encryption key strength, use 1 as the value for N.
For more information on allowed key sizes, refer to Bluetooth Core Specification v5.1. For more information on allowed key sizes, see Bluetooth Core Specification v5.1.
<!--/SupportedValues--> <!--/SupportedValues-->
<!--Example--> <!--Example-->
@ -346,7 +346,7 @@ For more information on allowed key sizes, refer to Bluetooth Core Specification
## ServicesAllowedList usage guide ## ServicesAllowedList usage guide
When the Bluetooth/ServicesAllowedList policy is provisioned, it will only allow pairing and connections of Windows PCs and phones to explicitly defined Bluetooth profiles and services. It is an allowed list, enabling admins to still allow custom Bluetooth profiles that are not defined by the Bluetooth Special Interests Group (SIG). When the Bluetooth/ServicesAllowedList policy is provisioned, it will only allow pairing and connections of Windows PCs and phones to explicitly defined Bluetooth profiles and services. It's an allowed list, enabling admins to still allow custom Bluetooth profiles that aren't defined by the Bluetooth Special Interests Group (SIG).
- Disabling a service shall block incoming and outgoing connections for such services - Disabling a service shall block incoming and outgoing connections for such services
- Disabling a service shall not publish an SDP record containing the service being blocked - Disabling a service shall not publish an SDP record containing the service being blocked
@ -381,7 +381,7 @@ Hands Free Profile UUID = base UUID + 0x111E to the beginning = 0000**111E**-000
|Headset Service Class|For older voice-enabled headsets|0x1108| |Headset Service Class|For older voice-enabled headsets|0x1108|
|PnP Information|Used to identify devices occasionally|0x1200| |PnP Information|Used to identify devices occasionally|0x1200|
This means that if you only want Bluetooth headsets, the UUIDs to include are: If you only want Bluetooth headsets, the UUIDs to include are:
{0000111E-0000-1000-8000-00805F9B34FB};{00001203-0000-1000-8000-00805F9B34FB};{00001108-0000-1000-8000-00805F9B34FB};{00001200-0000-1000-8000-00805F9B34FB} {0000111E-0000-1000-8000-00805F9B34FB};{00001203-0000-1000-8000-00805F9B34FB};{00001108-0000-1000-8000-00805F9B34FB};{00001200-0000-1000-8000-00805F9B34FB}

50
windows/client-management/mdm/policy-csp-browser.md
View File

@ -304,7 +304,7 @@ To verify AllowAutofill is set to 0 (not allowed):
1. Open Microsoft Edge. 1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**. 2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 3. Click **Settings** in the dropdown list, and select **View Advanced Settings**.
4. Verify the setting **Save form entries** is grayed out. 4. Verify the setting **Save form entries** is grayed out.
<!--/Validation--> <!--/Validation-->
@ -418,7 +418,7 @@ To verify AllowCookies is set to 0 (not allowed):
1. Open Microsoft Edge. 1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**. 2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 3. Click **Settings** in the dropdown list, and select **View Advanced Settings**.
4. Verify the setting **Cookies** is disabled. 4. Verify the setting **Cookies** is disabled.
<!--/Validation--> <!--/Validation-->
@ -520,7 +520,7 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
Supported values: Supported values:
- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit. - Blank (default) - Don't send tracking information but let users choose to send tracking information to sites they visit.
- 0 - Never send tracking information. - 0 - Never send tracking information.
- 1 - Send tracking information. - 1 - Send tracking information.
@ -531,7 +531,7 @@ To verify AllowDoNotTrack is set to 0 (not allowed):
1. Open Microsoft Edge. 1. Open Microsoft Edge.
2. In the upper-right corner of the browser, click **…**. 2. In the upper-right corner of the browser, click **…**.
3. Click **Settings** in the drop down list, and select **View Advanced Settings**. 3. Click **Settings** in the dropdown list, and select **View Advanced Settings**.
4. Verify the setting **Send Do Not Track requests** is grayed out. 4. Verify the setting **Send Do Not Track requests** is grayed out.
<!--/Validation--> <!--/Validation-->
@ -689,7 +689,7 @@ ADMX Info:
Supported values: Supported values:
- 0 – Load and run Adobe Flash content automatically. - 0 – Load and run Adobe Flash content automatically.
- 1 (default) – Does not load or run Adobe Flash content automatically. Requires action from the user. - 1 (default) – Doesn't load or run Adobe Flash content automatically. Requires action from the user.
Most restricted value: 1 Most restricted value: 1
@ -981,7 +981,7 @@ Most restricted value: 1
To verify AllowPopups is set to 0 (not allowed): To verify AllowPopups is set to 0 (not allowed):
1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. 1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**.
2. Verify the setting **Block pop-ups** is disabled. 2. Verify whether the setting **Block pop-ups** is disabled.
<!--/Validation--> <!--/Validation-->
<!--/Policy--> <!--/Policy-->
@ -1324,7 +1324,7 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
Supported values: Supported values:
- 0 - Prevented/not allowed. Disabling does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, set the **ApplicationManagement/AllowDeveloperUnlock** policy to 1 (enabled). - 0 - Prevented/not allowed. Disabling doesn't prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this sideloading, set the **ApplicationManagement/AllowDeveloperUnlock** policy to 1 (enabled).
- 1 (default) - Allowed. - 1 (default) - Allowed.
Most restricted value: 0 Most restricted value: 0
@ -1383,7 +1383,7 @@ ADMX Info:
Supported values: Supported values:
- Blank - Users can choose to use Windows Defender SmartScreen. - Blank - Users can choose to use Windows Defender SmartScreen.
- 0 – Turned off. Do not protect users from potential threats and prevent users from turning it on. - 0 – Turned off. Don't protect users from potential threats and prevent users from turning it on.
- 1 (default) – Turned on. Protect users from potential threats and prevent users from turning it off. - 1 (default) – Turned on. Protect users from potential threats and prevent users from turning it off.
Most restricted value: 1 Most restricted value: 1
@ -1624,12 +1624,12 @@ Most restricted value: 1
<!--/SupportedValues--> <!--/SupportedValues-->
<!--Validation--> <!--Validation-->
To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set to 1): To verify whether browsing data is cleared on exit (ClearBrowsingDataOnExit is set to 1):
1. Open Microsoft Edge and browse to websites. 1. Open Microsoft Edge and browse to websites.
2. Close the Microsoft Edge window. 2. Close the Microsoft Edge window.
3. Open Microsoft Edge and start typing the same URL in address bar. 3. Open Microsoft Edge and start typing the same URL in address bar.
4. Verify that it does not auto-complete from history. 4. Verify that it doesn't auto-complete from history.
<!--/Validation--> <!--/Validation-->
<!--/Policy--> <!--/Policy-->
@ -1686,7 +1686,7 @@ ADMX Info:
Supported values: Supported values:
- 0 (default) – Prevented/not allowed. Microsoft Edge uses the search engine specified in App settings.<p><p>If you enabled this policy and now want to disable it, disabling removes all previously configured search engines. - 0 (default) – Prevented/not allowed. Microsoft Edge uses the search engine specified in App settings.<p><p>If you enabled this policy and now want to disable it, disabling removes all previously configured search engines.
- 1 – Allowed. Add up to five additional search engines and set any one of them as the default.<p><p>For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](/microsoft-edge/dev-guide/browser/search-provider-discovery). - 1 – Allowed. Add up to five more search engines and set any one of them as the default.<p><p>For each search engine added, you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](/microsoft-edge/dev-guide/browser/search-provider-discovery).
Most restricted value: 0 Most restricted value: 0
<!--/SupportedValues--> <!--/SupportedValues-->
@ -1871,7 +1871,7 @@ Supported values:
- If it’s one of many apps, Microsoft Edge runs as normal. - If it’s one of many apps, Microsoft Edge runs as normal.
**1**: **1**:
- If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. _**For single-app public browsing:**_ If you do not configure the Configure kiosk reset after idle timeout policy and you enable this policy, Microsoft Edge kiosk resets after 5 minutes of idle time. - If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. _**For single-app public browsing:**_ If you don't configure the Configure kiosk reset after idle timeout policy and you enable this policy, Microsoft Edge kiosk resets after 5 minutes of idle time.
- If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge. - If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge.
<!--/SupportedValues--> <!--/SupportedValues-->
@ -2113,7 +2113,7 @@ Most restricted value: 0
[!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../includes/disable-lockdown-of-start-pages-shortdesc.md)] [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../includes/disable-lockdown-of-start-pages-shortdesc.md)]
     
> [!NOTE] > [!NOTE]
> This policy has no effect when the Browser/HomePages policy is not configured.  > This policy has no effect when the Browser/HomePages policy isn't configured. 
> [!IMPORTANT] > [!IMPORTANT]
> This setting can be used only with domain-joined or MDM-enrolled devices. For more information, see the [Microsoft browser extension policy](/legal/windows/agreements/microsoft-browser-extension-policy). > This setting can be used only with domain-joined or MDM-enrolled devices. For more information, see the [Microsoft browser extension policy](/legal/windows/agreements/microsoft-browser-extension-policy).
@ -2235,7 +2235,7 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
Supported values: Supported values:
- 0 (default) - Turned off. Microsoft Edge does not check the Enterprise Mode Site List, and in this case, users might experience problems while using legacy apps. - 0 (default) - Turned off. Microsoft Edge doesn't check the Enterprise Mode Site List, and in this case, users might experience problems while using legacy apps.
- 1 - Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 second, but uses the existing file. To add the location to your site list, enter it in the {URI} box.<p>For details on how to configure the Enterprise Mode Site List, see [Interoperability and enterprise guidance](/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp). - 1 - Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 second, but uses the existing file. To add the location to your site list, enter it in the {URI} box.<p>For details on how to configure the Enterprise Mode Site List, see [Interoperability and enterprise guidance](/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp).
@ -2312,13 +2312,13 @@ Supported values:
[!INCLUDE [configure-start-pages-shortdesc](../includes/configure-start-pages-shortdesc.md)] [!INCLUDE [configure-start-pages-shortdesc](../includes/configure-start-pages-shortdesc.md)]
**Version 1607**<br> **Version 1607**<br>
Starting with this version, the HomePages policy enforces that users cannot change the Start pages settings. From this version, the HomePages policy enforces that users can't change the Start pages settings.
**Version 1703**<br> **Version 1703**<br>
If you don't want to send traffic to Microsoft, use the \<about:blank\> value, which honors both domain and non-domain-joined devices when it's the only configured URL. If you don't want to send traffic to Microsoft, use the \<about:blank\> value, which honors both domain and non-domain-joined devices when it's the only configured URL.
**Version 1809**<br> **Version 1809**<br>
When you enable the Configure Open Microsoft Edge With policy and select an option, and you enter the URLs of the pages your want to load as the Start pages in this policy, the Configure Open Microsoft Edge With policy takes precedence, ignoring the HomePages policy. When you enable the Configure Open Microsoft Edge With policy and select an option, and you enter the URLs of the pages you want to load as the Start pages in this policy, the Configure Open Microsoft Edge With policy takes precedence, ignoring the HomePages policy.
> [!NOTE] > [!NOTE]
@ -2763,7 +2763,7 @@ Supported values:
- Blank (default) - Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. - Blank (default) - Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored.
- String - Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper extension prevents users from turning it off:<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_Microsoft.OneNoteWebClipper8wekyb3d8bbwe_<p>After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune. <p>Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. - String - Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper extension prevents users from turning it off:<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;_Microsoft.OneNoteWebClipper8wekyb3d8bbwe_<p>After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune. <p>Removing extensions from the list doesn't uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy doesn't prevent users from debugging and altering the logic on an extension.
<!--/SupportedValues--> <!--/SupportedValues-->
<!--Example--> <!--Example-->
@ -2933,7 +2933,7 @@ ADMX Info:
Supported values: Supported values:
- 0 (default) - All sites, including intranet sites, open in Microsoft Edge automatically. - 0 (default) - All sites, including intranet sites, open in Microsoft Edge automatically.
- 1 - Only intranet sites open in Internet Explorer 11 automatically.<p><p>Enabling this policy automatically opens all intranet sites in IE11, even if the users have Microsoft Edge as their default browser.<ol><li>In Group Policy Editor, navigate to:<br><br>**Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** and click **Enable**.<p></li><li>Refresh the policy and then view the affected sites in Microsoft Edge.<p><p>A message displays saying that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.</li></ol> - 1 - Only intranet sites open in Internet Explorer 11 automatically.<p><p>Enabling this policy automatically opens all intranet sites in IE11, even if the users have Microsoft Edge as their default browser.<ol><li>In Group Policy Editor, navigate to:<br><br>**Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** and click **Enable**.<p></li><li>Refresh the policy and then view the affected sites in Microsoft Edge.<p><p>A message displays saying that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it isn't yet running, or in a new tab.</li></ol>
Most restricted value: 0 Most restricted value: 0
@ -2993,9 +2993,9 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
Supported values: Supported values:
- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](#browser-allowsearchenginecustomization) policy, users cannot make changes. - Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](#browser-allowsearchenginecustomization) policy, users can't make changes.
- 0 - Microsoft Edge removes the policy-set search engine and uses the Microsoft Edge specified engine for the market. - 0 - Microsoft Edge removes the policy-set search engine and uses the Microsoft Edge specified engine for the market.
- 1 - Microsoft Edge uses the policy-set search engine specified in the OpenSearch XML file. Users cannot change the default search engine.<p><p>Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.<p><p>If you want users to use the default Microsoft Edge settings for each market, set the string to **EDGEDEFAULT**.<p><p>If you want users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**. - 1 - Microsoft Edge uses the policy-set search engine specified in the OpenSearch XML file. Users can't change the default search engine.<p><p>Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.<p><p>If you want users to use the default Microsoft Edge settings for each market, set the string to **EDGEDEFAULT**.<p><p>If you want users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**.
Most restricted value: 1 Most restricted value: 1
<!--/SupportedValues--> <!--/SupportedValues-->
@ -3160,9 +3160,9 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
Supported values: Supported values:
- 0 (default) – No additional message displays. - 0 (default) – No other message displays.
- 1 – Show an additional message stating that a site has opened in IE11. - 1 – Show another message stating that a site has opened in IE11.
- 2 - Show an additional message with a "Keep going in Microsoft Edge" link. - 2 - Show another message with a "Keep going in Microsoft Edge" link.
Most restricted value: 0 Most restricted value: 0
<!--/SupportedValues--> <!--/SupportedValues-->
@ -3198,8 +3198,8 @@ Most restricted value: 0
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy allows Enterprise Admins to turn off the notification for company devices that the Edge Legacy browser is no longer supported after 3/9/2021 to avoid confusion for their enterprise users and reduce help desk calls. This policy allows Enterprise Admins to turn off the notification for company devices that the Edge Legacy browser is no longer supported after March 9, 2021, to avoid confusion for their enterprise users and reduce help desk calls.
By default, a notification will be presented to the user informing them of this upon application startup. By default, a notification will be presented to the user informing them of this update upon application startup.
With this policy, you can either allow (default) or suppress this notification. With this policy, you can either allow (default) or suppress this notification.
<!--/Description--> <!--/Description-->

8
windows/client-management/mdm/policy-csp-cellular.md
View File

@ -82,11 +82,11 @@ You can specify either a default setting for all apps or a per-app setting by sp
If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. If you choose the "User is in control" option, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization cannot change it. If you choose the "Force Allow" option, Windows apps are allowed to access cellular data and employees in your organization can't change it.
If you choose the "Force Deny" option, Windows apps are not allowed to access cellular data and employees in your organization cannot change it. If you choose the "Force Deny" option, Windows apps aren't allowed to access cellular data and employees in your organization can't change it.
If you disable or do not configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device. If you disable or don't configure this policy setting, employees in your organization can decide whether Windows apps can access cellular data by using Settings > Network - Internet > Cellular on the device.
If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.” If an app is open when this Group Policy object is applied on a device, employees must restart the app or device for the policy changes to be applied to the app.”
@ -271,7 +271,7 @@ ADMX Info:
This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX. This policy setting configures the visibility of the link to the per-application cellular access control page in the cellular setting UX.
If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page. If this policy setting is enabled, a drop-down list box presenting possible values will be active. Select "Hide" or "Show" to hide or show the link to the per-application cellular access control page.
If this policy setting is disabled or is not configured, the link to the per-application cellular access control page is showed by default. If this policy setting is disabled or isn't configured, the link to the per-application cellular access control page is shown by default.
<!--/Description--> <!--/Description-->

60
windows/client-management/mdm/policy-csp-connectivity.md
View File

@ -105,9 +105,9 @@ manager: dansimp
Allows the user to enable Bluetooth or restrict access. Allows the user to enable Bluetooth or restrict access.
> [!NOTE] > [!NOTE]
>  This value is not supported in Windows 10. >  This value isn't supported in Windows 10.
If this is not set or it is deleted, the default value of 2 (Allow) is used. If this policy isn't set or is deleted, the default value of 2 (Allow) is used.
Most restricted value is 0. Most restricted value is 0.
@ -115,9 +115,9 @@ Most restricted value is 0.
<!--SupportedValues--> <!--SupportedValues-->
The following list shows the supported values: The following list shows the supported values:
- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be grayed out and the user will not be able to turn Bluetooth on. - 0 – Disallow Bluetooth. If the value is set to 0, the radio in the Bluetooth control panel will be grayed out and the user won't be able to turn on Bluetooth.
- 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. - 1 – Reserved. If the value is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn on Bluetooth.
- 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. - 2 (default) – Allow Bluetooth. If the value is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn on Bluetooth.
<!--/SupportedValues--> <!--/SupportedValues-->
<!--/Policy--> <!--/Policy-->
@ -151,15 +151,15 @@ The following list shows the supported values:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Allows the cellular data channel on the device. Device reboot is not required to enforce the policy. Allows the cellular data channel on the device. Device reboot isn't required to enforce the policy.
<!--/Description--> <!--/Description-->
<!--SupportedValues--> <!--SupportedValues-->
The following list shows the supported values: The following list shows the supported values:
- 0 – Do not allow the cellular data channel. The user cannot turn it on. This value is not supported in Windows 10, version 1511. - 0 – Don't allow the cellular data channel. The user can't turn it on. This value isn't supported in Windows 10, version 1511.
- 1 (default) – Allow the cellular data channel. The user can turn it off. - 1 (default) – Allow the cellular data channel. The user can turn it off.
- 2 - Allow the cellular data channel. The user cannot turn it off. - 2 - Allow the cellular data channel. The user can't turn it off.
<!--/SupportedValues--> <!--/SupportedValues-->
<!--/Policy--> <!--/Policy-->
@ -193,7 +193,7 @@ The following list shows the supported values:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
Allows or disallows cellular data roaming on the device. Device reboot is not required to enforce the policy. Allows or disallows cellular data roaming on the device. Device reboot isn't required to enforce the policy.
Most restricted value is 0. Most restricted value is 0.
@ -209,15 +209,15 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
The following list shows the supported values: The following list shows the supported values:
- 0 – Do not allow cellular data roaming. The user cannot turn it on. This value is not supported in Windows 10, version 1511. - 0 – Don't allow cellular data roaming. The user can't turn it on. This value isn't supported in Windows 10, version 1511.
- 1 (default) – Allow cellular data roaming. - 1 (default) – Allow cellular data roaming.
- 2 - Allow cellular data roaming on. The user cannot turn it off. - 2 - Allow cellular data roaming on. The user can't turn it off.
<!--/SupportedValues--> <!--/SupportedValues-->
<!--Validation--> <!--Validation-->
To validate, the enterprise can confirm by observing the roaming enable switch in the UX. It will be inactive if the roaming policy is being enforced by the enterprise policy. To validate, the enterprise can confirm by observing the roaming enable switch in the UX. It will be inactive if the roaming policy is being enforced by the enterprise policy.
To validate on devices, do the following: To validate on devices, perform the following steps:
1. Go to Cellular & SIM. 1. Go to Cellular & SIM.
2. Click on the SIM (next to the signal strength icon) and select **Properties**. 2. Click on the SIM (next to the signal strength icon) and select **Properties**.
@ -301,8 +301,8 @@ The following list shows the supported values:
<!--Description--> <!--Description-->
This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue tasks, such as reading, email, and other tasks that require linking between Phone and PC. This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue tasks, such as reading, email, and other tasks that require linking between Phone and PC.
If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in 'Continue on PC experiences'. If you disable this policy setting, the Windows device is not allowed to be linked to phones, will remove itself from the device list of any linked Phones, and cannot participate in 'Continue on PC experiences'. If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in 'Continue on PC experiences'. If you disable this policy setting, the Windows device isn't allowed to be linked to phones, will remove itself from the device list of any linked Phones, and can't participate in 'Continue on PC experiences'.
If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. If you don't configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot.
<!--/Description--> <!--/Description-->
<!--ADMXMapped--> <!--ADMXMapped-->
@ -314,14 +314,14 @@ ADMX Info:
<!--SupportedValues--> <!--SupportedValues-->
This setting supports a range of values between 0 and 1. This setting supports a range of values between 0 and 1.
- 0 - Do not link - 0 - Don't link
- 1 (default) - Allow phone-PC linking - 1 (default) - Allow phone-PC linking
<!--/SupportedValues--> <!--/SupportedValues-->
<!--Validation--> <!--Validation-->
Validation: Validation:
If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be grayed out and clicking it will not launch the window for a user to enter their phone number. If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be grayed out and clicking it won't launch the window for a user to enter their phone number.
Device that has previously opt-in to MMX will also stop showing on the device list. Device that has previously opt-in to MMX will also stop showing on the device list.
@ -360,7 +360,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li
> [!NOTE] > [!NOTE]
> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. > Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition.
Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging. Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy doesn't affect USB charging.
Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced. Both Media Transfer Protocol (MTP) and IP over USB are disabled when this policy is enforced.
@ -413,7 +413,7 @@ Most restricted value is 0.
<!--SupportedValues--> <!--SupportedValues-->
The following list shows the supported values: The following list shows the supported values:
- 0 – VPN is not allowed over cellular. - 0 – VPN isn't allowed over cellular.
- 1 (default) – VPN can use any connection, including cellular. - 1 (default) – VPN can use any connection, including cellular.
<!--/SupportedValues--> <!--/SupportedValues-->
@ -493,13 +493,13 @@ The following list shows the supported values:
<!--Description--> <!--Description-->
This policy setting specifies whether to allow printing over HTTP from this client. This policy setting specifies whether to allow printing over HTTP from this client.
Printing over HTTP allows a client to print to printers on the intranet as well as the Internet. Printing over HTTP allows a client to print to printers on the intranet and the Internet.
Note: This policy setting affects the client side of Internet printing only. It does not prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP. Note: This policy setting affects the client side of Internet printing only. It doesn't prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP.
If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP. If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP.
If you disable or do not configure this policy setting, users can choose to print to Internet printers over HTTP. If you disable or don't configure this policy setting, users can choose to print to Internet printers over HTTP.
Also, see the "Web-based printing" policy setting in Computer Configuration/Administrative Templates/Printers. Also, see the "Web-based printing" policy setting in Computer Configuration/Administrative Templates/Printers.
@ -549,11 +549,11 @@ This policy setting specifies whether to allow this client to download print dri
To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP. To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP.
Note: This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP. It only prohibits downloading drivers that are not already installed locally. Note: This policy setting doesn't prevent the client from printing to printers on the Intranet or the Internet over HTTP. It only prohibits downloading drivers that aren't already installed locally.
If you enable this policy setting, print drivers cannot be downloaded over HTTP. If you enable this policy setting, print drivers can't be downloaded over HTTP.
If you disable or do not configure this policy setting, users can download print drivers over HTTP. If you disable or don't configure this policy setting, users can download print drivers over HTTP.
<!--/Description--> <!--/Description-->
@ -601,11 +601,11 @@ This policy setting specifies whether Windows should download a list of provider
These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry. These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry.
If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed. If you enable this policy setting, Windows doesn't download providers, and only the service providers that are cached in the local registry are displayed.
If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards. If you disable or don't configure this policy setting, a list of providers is downloaded when the user uses the web publishing or online ordering wizards.
See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry. For more information, including details on specifying service providers in the registry, see the documentation for the web publishing and online ordering wizards.
<!--/Description--> <!--/Description-->
@ -695,7 +695,7 @@ ADMX Info:
<!--Description--> <!--Description-->
This policy setting configures secure access to UNC paths. This policy setting configures secure access to UNC paths.
If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling additional security requirements. If you enable this policy, Windows only allows access to the specified UNC paths after fulfilling other security requirements.
<!--/Description--> <!--/Description-->
@ -741,11 +741,11 @@ ADMX Info:
<!--Description--> <!--Description-->
Determines whether a user can install and configure the Network Bridge. Determines whether a user can install and configure the Network Bridge.
Important: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. Important: This setting is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting doesn't apply.
The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder. The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder.
If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. If you disable this setting or don't configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting doesn't remove an existing Network Bridge from the user's computer.
<!--/Description--> <!--/Description-->

4
windows/client-management/mdm/policy-csp-controlpolicyconflict.md
View File

@ -71,9 +71,9 @@ The following list shows the supported values:
- 0 (default) - 0 (default)
- 1 - The MDM policy is used and the GP policy is blocked. - 1 - The MDM policy is used and the GP policy is blocked.
The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the first set of the policy. This activation ensures that:
- GP settings that correspond to MDM applied settings are not conflicting - GP settings that correspond to MDM applied settings aren't conflicting
- The current Policy Manager policies are refreshed from what MDM has set - The current Policy Manager policies are refreshed from what MDM has set
- Any values set by scripts/user outside of GP that conflict with MDM are removed - Any values set by scripts/user outside of GP that conflict with MDM are removed

4
windows/client-management/mdm/policy-csp-credentialsdelegation.md
View File

@ -65,11 +65,11 @@ manager: dansimp
<!--Description--> <!--Description-->
Remote host allows delegation of non-exportable credentials Remote host allows delegation of non-exportable credentials
When using credential delegation, devices provide an exportable version of credentials to the remote host. This exposes users to the risk of credential theft from attackers on the remote host. When credential delegation is being used, devices provide an exportable version of credentials to the remote host. This version exposes users to the risk of credential theft from attackers on the remote host.
If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode. If you enable this policy setting, the host supports Restricted Admin or Remote Credential Guard mode.
If you disable or do not configure this policy setting, Restricted Administration and Remote Credential Guard mode are not supported. User will always need to pass their credentials to the host. If you disable or don't configure this policy setting, Restricted Administration and Remote Credential Guard mode aren't supported. User will always need to pass their credentials to the host.
<!--/Description--> <!--/Description-->

6
windows/client-management/mdm/policy-csp-credentialsui.md
View File

@ -68,9 +68,9 @@ manager: dansimp
<!--Description--> <!--Description-->
This policy setting allows you to configure the display of the password reveal button in password entry user experiences. This policy setting allows you to configure the display of the password reveal button in password entry user experiences.
If you enable this policy setting, the password reveal button will not be displayed after a user types a password in the password entry text box. If you enable this policy setting, the password reveal button won't be displayed after a user types a password in the password entry text box.
If you disable or do not configure this policy setting, the password reveal button will be displayed after a user types a password in the password entry text box. If you disable or don't configure this policy setting, the password reveal button will be displayed after a user types a password in the password entry text box.
By default, the password reveal button is displayed after a user types a password in the password entry text box. To display the password, click the password reveal button. By default, the password reveal button is displayed after a user types a password in the password entry text box. To display the password, click the password reveal button.
@ -118,7 +118,7 @@ ADMX Info:
<!--/Scope--> <!--/Scope-->
<!--Description--> <!--Description-->
This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts are not displayed when the user attempts to elevate a running application. This policy setting controls whether administrator accounts are displayed when a user attempts to elevate a running application. By default, administrator accounts aren't displayed when the user attempts to elevate a running application.
If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password. If you enable this policy setting, all local administrator accounts on the PC will be displayed so the user can choose one and enter the correct password.