From aa124a34650fc833dd943f831e643d2d71330bb6 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Tue, 3 Jan 2023 17:10:40 -0500 Subject: [PATCH] Changes per Nick's notes. --- .../mdm/policy-csp-abovelock.md | 1 - .../mdm/policy-csp-accounts.md | 3 +- .../mdm/policy-csp-admx-controlpanel.md | 1 - .../policy-csp-admx-controlpaneldisplay.md | 3 - .../mdm/policy-csp-admx-credui.md | 1 - .../mdm/policy-csp-admx-eaime.md | 12 +- .../mdm/policy-csp-admx-explorer.md | 1 - .../mdm/policy-csp-admx-framepanes.md | 212 +++--- .../mdm/policy-csp-admx-iscsi.md | 669 ++++++++++++++---- .../mdm/policy-csp-admx-kdc.md | 585 ++++++++------- 10 files changed, 986 insertions(+), 502 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 5adb27e901..9be972e3d9 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -98,7 +98,6 @@ If you disable this setting, the system will need to be unlocked for the user to -Added in Windows 10, version 1607. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 59adf963ba..5da980cc1a 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -146,7 +146,6 @@ Allows IT Admins the ability to disable the Microsoft Account Sign-In Assistant -Added in Windows 10, version 1703. @@ -234,7 +233,7 @@ This setting determines whether to only allow enterprise device authentication f -Added in Windows 11, version 22H2. Most restricted value is 1. +Most restricted value is 1. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index 721c8e5306..25cd051506 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -194,7 +194,6 @@ If users try to select a Control Panel item from the Properties item on a contex -Available in the latest Windows 10 Insider Preview Build. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 324a63ed77..013ba7d794 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -240,7 +240,6 @@ If you disable or do not configure this policy setting, users that are not requi -Available in the latest Windows 10 Insider Preview Build. @@ -364,7 +363,6 @@ If you disable or do not configure this setting, the default theme will be appli -Available in the latest Windows 10 Insider Preview Build. @@ -1099,7 +1097,6 @@ If you enable this setting, none of the mouse pointer scheme settings can be cha -Available in the latest Windows 10 Insider Preview Build. diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index 5b2471b164..63b8ff4f26 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -111,7 +111,6 @@ If you turn this policy setting on, local users won’t be able to set up and us -Available in the latest Windows 10 Insider Preview Build. diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index 12856554a1..0b3e24725b 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -4,7 +4,7 @@ description: Learn more about the ADMX_EAIME Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 12/21/2022 +ms.date: 01/03/2023 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -52,7 +52,7 @@ If you disable or do not configure this policy setting, both Publishing Standard This policy setting applies to Japanese Microsoft IME only. -Note: Changes to this setting will not take effect until the user logs off. +**Note**: Changes to this setting will not take effect until the user logs off. @@ -128,7 +128,7 @@ If you disable or do not configure this policy setting, no range of characters a This policy setting applies to Japanese Microsoft IME only. -Note: Changes to this setting will not take effect until the user logs off. +**Note**: Changes to this setting will not take effect until the user logs off. @@ -195,7 +195,7 @@ If you disable or do not configure this policy setting, the custom dictionary ca This policy setting is applied to Japanese Microsoft IME. -Note: Changes to this setting will not take effect until the user logs off. +**Note**: Changes to this setting will not take effect until the user logs off. @@ -259,7 +259,7 @@ If you disable or do not configure this policy setting, history-based predictive This policy setting applies to Japanese Microsoft IME only. -Note: Changes to this setting will not take effect until the user logs off. +**Note**: Changes to this setting will not take effect until the user logs off. @@ -325,7 +325,7 @@ If you disable or do not configure this policy setting, the search integration f This policy setting applies to Japanese Microsoft IME. -Note: Changes to this setting will not take effect until the user logs off. +**Note**: Changes to this setting will not take effect until the user logs off. diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index a2e6109ed4..6a9ecf5e4d 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -170,7 +170,6 @@ Note: When the menu bar is not displayed, users can access the menu bar by press -Available in the latest Windows 10 Insider Preview Build. diff --git a/windows/client-management/mdm/policy-csp-admx-framepanes.md b/windows/client-management/mdm/policy-csp-admx-framepanes.md index 5e1a31bd4d..30f0229ac8 100644 --- a/windows/client-management/mdm/policy-csp-admx-framepanes.md +++ b/windows/client-management/mdm/policy-csp-admx-framepanes.md @@ -1,139 +1,161 @@ --- -title: Policy CSP - ADMX_FramePanes -description: Learn about the Policy CSP - ADMX_FramePanes. +title: ADMX_FramePanes Policy CSP +description: Learn more about the ADMX_FramePanes Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/03/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 09/14/2021 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_FramePanes > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
- -## ADMX_FramePanes policies + + + -
-
- ADMX_FramePanes/NoReadingPane -
-
- ADMX_FramePanes/NoPreviewPane -
-
+ +## NoPreviewPane + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```User +./User/Vendor/MSFT/Policy/Config/ADMX_FramePanes/NoPreviewPane +``` + - -**ADMX_FramePanes/NoReadingPane** - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - + + This policy setting shows or hides the Details Pane in File Explorer. -If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and can't be turned on by the user. +If you enable this policy setting and configure it to hide the pane, the Details Pane in File Explorer is hidden and cannot be turned on by the user. -If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and can't be hidden by the user. +If you enable this policy setting and configure it to show the pane, the Details Pane is always visible and cannot be hidden by the user. -> [!NOTE] -> This has a side effect of not being able to toggle to the Preview Pane since the two can't be displayed at the same time. +**Note**: This has a side effect of not being able to toggle to the Preview Pane since the two cannot be displayed at the same time. -If you disable, or don't configure this policy setting, the Details Pane is hidden by default and can be displayed by the user. +If you disable, or do not configure this policy setting, the Details Pane is hidden by default and can be displayed by the user. This is the default policy setting. + -This setting is the default policy setting. + + + - + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Turn on or off details pane* -- GP name: *NoReadingPane* -- GP path: *Windows Components\File Explorer\Explorer Frame Pane* -- GP ADMX file name: *FramePanes.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_FramePanes/NoPreviewPane** +**ADMX mapping**: +| Name | Value | +|:--|:--| +| Name | NoPreviewPane | +| Friendly Name | Turn on or off details pane | +| Location | User Configuration | +| Path | WindowsComponents > File Explorer > Explorer Frame Pane | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | +| ADMX File Name | FramePanes.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## NoReadingPane -> [!div class = "checklist"] -> * User + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :x: Device
:heavy_check_mark: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```User +./User/Vendor/MSFT/Policy/Config/ADMX_FramePanes/NoReadingPane +``` + - - + + Hides the Preview Pane in File Explorer. -If you enable this policy setting, the Preview Pane in File Explorer is hidden and can't be turned on by the user. +If you enable this policy setting, the Preview Pane in File Explorer is hidden and cannot be turned on by the user. -If you disable, or don't configure this setting, the Preview Pane is hidden by default and can be displayed by the user. +If you disable, or do not configure this setting, the Preview Pane is hidden by default and can be displayed by the user. + - + + + - -ADMX Info: -- GP Friendly name: *Turn off Preview Pane* -- GP name: *NoPreviewPane* -- GP path: *Windows Components\File Explorer\Explorer Frame Pane* -- GP ADMX file name: *FramePanes.admx* + +**Description framework properties**: - - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -## Related topics +**ADMX mapping**: -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) \ No newline at end of file +| Name | Value | +|:--|:--| +| Name | NoReadingPane | +| Friendly Name | Turn off Preview Pane | +| Location | User Configuration | +| Path | WindowsComponents > File Explorer > Explorer Frame Pane | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\Explorer | +| Registry Value Name | NoReadingPane | +| ADMX File Name | FramePanes.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-iscsi.md b/windows/client-management/mdm/policy-csp-admx-iscsi.md index 44fac81071..f7308d08d7 100644 --- a/windows/client-management/mdm/policy-csp-admx-iscsi.md +++ b/windows/client-management/mdm/policy-csp-admx-iscsi.md @@ -1,183 +1,604 @@ --- -title: Policy CSP - ADMX_iSCSI -description: Learn about the Policy CSP - ADMX_iSCSI. +title: ADMX_iSCSI Policy CSP +description: Learn more about the ADMX_iSCSI Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/03/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 12/17/2020 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_iSCSI > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
+ + + - -## ADMX_iSCSI policies + +## iSCSIDiscovery_ConfigureiSNSServers -
-
- ADMX_iSCSI/iSCSIGeneral_RestrictAdditionalLogins -
-
- ADMX_iSCSI/iSCSIGeneral_ChangeIQNName -
-
- ADMX_iSCSI/iSCSISecurity_ChangeCHAPSecret -
-
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSIDiscovery_ConfigureiSNSServers +``` + -
+ + +If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. If disabled then new iSNS servers may be added and thus new targets discovered via those iSNS servers; existing iSNS servers may be removed. + - -**ADMX_iSCSI/iSCSIGeneral_RestrictAdditionalLogins** + + + - + +**Description framework properties**: -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -[Scope](./policy-configuration-service-provider.md#policy-scope): +**ADMX mapping**: -> [!div class = "checklist"] -> * Device +| Name | Value | +|:--|:--| +| Name | iSCSIDiscovery_ConfigureiSNSServers | +| Friendly Name | Do not allow manual configuration of iSNS servers | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Target Discovery | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | ConfigureiSNSServers | +| ADMX File Name | iSCSI.admx | + -
+ + + - - -If enabled then new iSNS servers may not be added and thus new targets discovered via those iSNS servers; existing iSNS servers may not be removed. + -If disabled then new iSNS servers may be added and thus new targets discovered via those iSNS servers; existing iSNS servers may be removed. + +## iSCSIDiscovery_ConfigureTargetPortals + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + - + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSIDiscovery_ConfigureTargetPortals +``` + - -ADMX Info: -- GP Friendly name: *Do not allow manual configuration of iSNS servers* -- GP name: *iSCSIGeneral_RestrictAdditionalLogins* -- GP path: *System\iSCSI\iSCSI Target Discovery* -- GP ADMX file name: *iSCSI.admx* + + +If enabled then new target portals may not be added and thus new targets discovered on those portals; existing target portals may not be removed. If disabled then new target portals may be added and thus new targets discovered on those portals; existing target portals may be removed. + - - -
+ + + - -**ADMX_iSCSI/iSCSIGeneral_ChangeIQNName** + +**Description framework properties**: - +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -
+**ADMX mapping**: - -[Scope](./policy-configuration-service-provider.md#policy-scope): +| Name | Value | +|:--|:--| +| Name | iSCSIDiscovery_ConfigureTargetPortals | +| Friendly Name | Do not allow manual configuration of target portals | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Target Discovery | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | ConfigureTargetPortals | +| ADMX File Name | iSCSI.admx | + -> [!div class = "checklist"] -> * Device + + + -
+ - - -If enabled then new target portals may not be added and thus new targets discovered on those portals; existing target portals may not be removed. + +## iSCSIDiscovery_ConfigureTargets -If disabled then new target portals may be added and thus new targets discovered on those portals; existing target portals may be removed. + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + - + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSIDiscovery_ConfigureTargets +``` + - -ADMX Info: -- GP Friendly name: *Do not allow manual configuration of target portals* -- GP name: *iSCSIGeneral_ChangeIQNName* -- GP path: *System\iSCSI\iSCSI Target Discovery* -- GP ADMX file name: *iSCSI.admx* + + +If enabled then discovered targets may not be manually configured. If disabled then discovered targets may be manually configured. - - -
+**Note**: if enabled there may be cases where this will break VDS. + - -**ADMX_iSCSI/iSCSISecurity_ChangeCHAPSecret** + + + - + +**Description framework properties**: -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -[Scope](./policy-configuration-service-provider.md#policy-scope): +**ADMX mapping**: -> [!div class = "checklist"] -> * Device +| Name | Value | +|:--|:--| +| Name | iSCSIDiscovery_ConfigureTargets | +| Friendly Name | Do not allow manual configuration of discovered targets | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Target Discovery | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | ConfigureTargets | +| ADMX File Name | iSCSI.admx | + -
+ + + - - -If enabled then don't allow the initiator CHAP secret to be changed. + -If disabled then the initiator CHAP secret may be changed. + +## iSCSIDiscovery_NewStaticTargets - + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSIDiscovery_NewStaticTargets +``` + - -ADMX Info: -- GP Friendly name: *Do not allow changes to initiator CHAP secret* -- GP name: *iSCSISecurity_ChangeCHAPSecret* -- GP path: *System\iSCSI\iSCSI Security* -- GP ADMX file name: *iSCSI.admx* + + +If enabled then new targets may not be manually configured by entering the target name and target portal; already discovered targets may be manually configured. If disabled then new and already discovered targets may be manually configured. - - -
+**Note**: if enabled there may be cases where this will break VDS. + + + + - + +**Description framework properties**: -## Related topics +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) \ No newline at end of file + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSIDiscovery_NewStaticTargets | +| Friendly Name | Do not allow adding new targets via manual configuration | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Target Discovery | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | NewStaticTargets | +| ADMX File Name | iSCSI.admx | + + + + + + + + + +## iSCSIGeneral_ChangeIQNName + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSIGeneral_ChangeIQNName +``` + + + + +If enabled then do not allow the initiator iqn name to be changed. If disabled then the initiator iqn name may be changed. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSIGeneral_ChangeIQNName | +| Friendly Name | Do not allow changes to initiator iqn name | +| Location | Computer Configuration | +| Path | System > iSCSI > General iSCSI | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | ChangeIQNName | +| ADMX File Name | iSCSI.admx | + + + + + + + + + +## iSCSIGeneral_RestrictAdditionalLogins + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSIGeneral_RestrictAdditionalLogins +``` + + + + +If enabled then only those sessions that are established via a persistent login will be established and no new persistent logins may be created. If disabled then additional persistent and non persistent logins may be established. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSIGeneral_RestrictAdditionalLogins | +| Friendly Name | Do not allow additional session logins | +| Location | Computer Configuration | +| Path | System > iSCSI > General iSCSI | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | RestrictAdditionalLogins | +| ADMX File Name | iSCSI.admx | + + + + + + + + + +## iSCSISecurity_ChangeCHAPSecret + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSISecurity_ChangeCHAPSecret +``` + + + + +If enabled then do not allow the initiator CHAP secret to be changed. If disabled then the initiator CHAP secret may be changed. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSISecurity_ChangeCHAPSecret | +| Friendly Name | Do not allow changes to initiator CHAP secret | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Security | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | ChangeCHAPSecret | +| ADMX File Name | iSCSI.admx | + + + + + + + + + +## iSCSISecurity_RequireIPSec + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSISecurity_RequireIPSec +``` + + + + +If enabled then only those connections that are configured for IPSec may be established. If disabled then connections that are configured for IPSec or connections not configured for IPSec may be established. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSISecurity_RequireIPSec | +| Friendly Name | Do not allow connections without IPSec | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Security | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | RequireIPSec | +| ADMX File Name | iSCSI.admx | + + + + + + + + + +## iSCSISecurity_RequireMutualCHAP + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSISecurity_RequireMutualCHAP +``` + + + + +If enabled then only those sessions that are configured for mutual CHAP may be established. If disabled then sessions that are configured for mutual CHAP or sessions not configured for mutual CHAP may be established. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSISecurity_RequireMutualCHAP | +| Friendly Name | Do not allow sessions without mutual CHAP | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Security | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | RequireMutualCHAP | +| ADMX File Name | iSCSI.admx | + + + + + + + + + +## iSCSISecurity_RequireOneWayCHAP + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_iSCSI/iSCSISecurity_RequireOneWayCHAP +``` + + + + +If enabled then only those sessions that are configured for one-way CHAP may be established. If disabled then sessions that are configured for one-way CHAP or sessions not configured for one-way CHAP may be established. + +**Note** that if the "Do not allow sessions without mutual CHAP" setting is enabled then that setting overrides this one. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | iSCSISecurity_RequireOneWayCHAP | +| Friendly Name | Do not allow sessions without one way CHAP | +| Location | Computer Configuration | +| Path | System > iSCSI > iSCSI Security | +| Registry Key Name | Software\Policies\Microsoft\Windows\iSCSI | +| Registry Value Name | RequireOneWayCHAP | +| ADMX File Name | iSCSI.admx | + + + + + + + + + + + + + + +## Related articles + +[Policy configuration service provider](policy-configuration-service-provider.md) diff --git a/windows/client-management/mdm/policy-csp-admx-kdc.md b/windows/client-management/mdm/policy-csp-admx-kdc.md index c0cab32903..beb1234d4b 100644 --- a/windows/client-management/mdm/policy-csp-admx-kdc.md +++ b/windows/client-management/mdm/policy-csp-admx-kdc.md @@ -1,206 +1,258 @@ --- -title: Policy CSP - ADMX_kdc -description: Learn about the Policy CSP - ADMX_kdc. +title: ADMX_kdc Policy CSP +description: Learn more about the ADMX_kdc Area in Policy CSP +author: vinaypamnani-msft +manager: aaroncz ms.author: vinpa +ms.date: 01/03/2023 ms.localizationpriority: medium -ms.topic: article ms.prod: windows-client ms.technology: itpro-manage -author: vinaypamnani-msft -ms.date: 08/13/2020 -ms.reviewer: -manager: aaroncz +ms.topic: reference --- + + + # Policy CSP - ADMX_kdc ->[!TIP] -> These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](../understanding-admx-backed-policies.md). +> [!TIP] +> Some of these are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). > -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](../understanding-admx-backed-policies.md#enabling-a-policy). +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). > -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). -
+ + + - -## ADMX_kdc policies + +## CbacAndArmor -
-
- ADMX_kdc/CbacAndArmor -
-
- ADMX_kdc/ForestSearch -
-
- ADMX_kdc/PKINITFreshness -
-
- ADMX_kdc/RequestCompoundId -
-
- ADMX_kdc/TicketSizeThreshold -
-
- ADMX_kdc/emitlili -
-
+ +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/CbacAndArmor +``` + -
- - -**ADMX_kdc/CbacAndArmor** - - - -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| - - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - + + This policy setting allows you to configure a domain controller to support claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication. If you enable this policy setting, client computers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware will use this feature for Kerberos authentication messages. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. -If you disable or don't configure this policy setting, the domain controller doesn't support claims, compound authentication or armoring. +If you disable or do not configure this policy setting, the domain controller does not support claims, compound authentication or armoring. -If you configure the "Not supported" option, the domain controller doesn't support claims, compound authentication or armoring, which is the default behavior for domain controllers running Windows Server 2008 R2 or earlier operating systems. +If you configure the "Not supported" option, the domain controller does not support claims, compound authentication or armoring which is the default behavior for domain controllers running Windows Server 2008 R2 or earlier operating systems. -> [!NOTE] -> For the following options of this KDC policy to be effective, the Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must be enabled on supported systems. If the Kerberos policy setting isn't enabled, Kerberos authentication messages won't use these features. +**Note**: For the following options of this KDC policy to be effective, the Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must be enabled on supported systems. If the Kerberos policy setting is not enabled, Kerberos authentication messages will not use these features. If you configure "Supported", the domain controller supports claims, compound authentication and Kerberos armoring. The domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring. -**Domain functional level requirements** - -For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier, then domain controllers behave as if the "Supported" option is selected. +Domain functional level requirements +For the options "Always provide claims" and "Fail unarmored authentication requests", when the domain functional level is set to Windows Server 2008 R2 or earlier then domain controllers behave as if the "Supported" option is selected. When the domain functional level is set to Windows Server 2012 then the domain controller advertises to Kerberos client computers that the domain is capable of claims and compound authentication for Dynamic Access Control and Kerberos armoring, and: - - If you set the "Always provide claims" option, always returns claims for accounts and supports the RFC behavior for advertising the flexible authentication secure tunneling (FAST). - If you set the "Fail unarmored authentication requests" option, rejects unarmored Kerberos messages. -> [!WARNING] -> When "Fail unarmored authentication requests" is set, then client computers which don't support Kerberos armoring will fail to authenticate to the domain controller. +**Warning**: When "Fail unarmored authentication requests" is set, then client computers which do not support Kerberos armoring will fail to authenticate to the domain controller. To ensure this feature is effective, deploy enough domain controllers that support claims and compound authentication for Dynamic Access Control and are Kerberos armor-aware to handle the authentication requests. Insufficient number of domain controllers that support this policy result in authentication failures whenever Dynamic Access Control or Kerberos armoring is required (that is, the "Supported" option is enabled). Impact on domain controller performance when this policy setting is enabled: +- Secure Kerberos domain capability discovery is required resulting in additional message exchanges. +- Claims and compound authentication for Dynamic Access Control increases the size and complexity of the data in the message which results in more processing time and greater Kerberos service ticket size. +- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors which results in increased processing time, but does not change the service ticket size. + -- Secure Kerberos domain capability discovery is required, resulting in more message exchanges. -- Claims and compound authentication for Dynamic Access Control increase the size and complexity of the data in the message, which results in more processing time and greater Kerberos service ticket size. -- Kerberos armoring fully encrypts Kerberos messages and signs Kerberos errors, which result in increased processing time, but doesn't change the service ticket size. + + + - + +**Description framework properties**: +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - -ADMX Info: -- GP Friendly name: *KDC support for claims, compound authentication and Kerberos armoring* -- GP name: *CbacAndArmor* -- GP path: *System/KDC* -- GP ADMX file name: *kdc.admx* + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - - -
+**ADMX mapping**: - -**ADMX_kdc/ForestSearch** +| Name | Value | +|:--|:--| +| Name | CbacAndArmor | +| Friendly Name | KDC support for claims, compound authentication and Kerberos armoring | +| Location | Computer Configuration | +| Path | System > KDC | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters | +| Registry Value Name | EnableCbacAndArmor | +| ADMX File Name | kdc.admx | + - + + + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + - -
+ +## emitlili - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -> [!div class = "checklist"] -> * Device + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/emitlili +``` + -
+ + +This policy setting controls whether the domain controller provides information about previous logons to client computers. - - +If you enable this policy setting, the domain controller provides the information message about previous logons. + +For Windows Logon to leverage this feature, the "Display information about previous logons during user logon" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled. + +If you disable or do not configure this policy setting, the domain controller does not provide information about previous logons unless the "Display information about previous logons during user logon" policy setting is enabled. + +**Note**: Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting does not affect anything. + + + + + + + +**Description framework properties**: + +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + + + +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +**ADMX mapping**: + +| Name | Value | +|:--|:--| +| Name | emitlili | +| Friendly Name | Provide information about previous logons to client computers | +| Location | Computer Configuration | +| Path | System > KDC | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters | +| Registry Value Name | EmitLILI | +| ADMX File Name | kdc.admx | + + + + + + + + + +## ForestSearch + + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + + + +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/ForestSearch +``` + + + + This policy setting defines the list of trusting forests that the Key Distribution Center (KDC) searches when attempting to resolve two-part service principal names (SPNs). -If you enable this policy setting, the KDC will search the forests in this list if it's unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain. +If you enable this policy setting, the KDC will search the forests in this list if it is unable to resolve a two-part SPN in the local forest. The forest search is performed by using a global catalog or name suffix hints. If a match is found, the KDC will return a referral ticket to the client for the appropriate domain. -If you disable or don't configure this policy setting, the KDC won't search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name isn't found, NTLM authentication might be used. +If you disable or do not configure this policy setting, the KDC will not search the listed forests to resolve the SPN. If the KDC is unable to resolve the SPN because the name is not found, NTLM authentication might be used. To ensure consistent behavior, this policy setting must be supported and set identically on all domain controllers in the domain. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Use forest search order* -- GP name: *ForestSearch* -- GP path: *System/KDC* -- GP ADMX file name: *kdc.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_kdc/PKINITFreshness** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | ForestSearch | +| Friendly Name | Use forest search order | +| Location | Computer Configuration | +| Path | System > KDC | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters | +| Registry Value Name | UseForestSearch | +| ADMX File Name | kdc.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## PKINITFreshness -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/PKINITFreshness +``` + - - -Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain isn't at Windows Server 2016 DFL or higher, this policy won't be applied. + + +Support for PKInit Freshness Extension requires Windows Server 2016 domain functional level (DFL). If the domain controller’s domain is not at Windows Server 2016 DFL or higher this policy will not be applied. This policy setting allows you to configure a domain controller (DC) to support the PKInit Freshness Extension. @@ -208,177 +260,174 @@ If you enable this policy setting, the following options are supported: Supported: PKInit Freshness Extension is supported on request. Kerberos clients successfully authenticating with the PKInit Freshness Extension will get the fresh public key identity SID. -Required: PKInit Freshness Extension is required for successful authentication. Kerberos clients that don't support the PKInit Freshness Extension will always fail when using public key credentials. +Required: PKInit Freshness Extension is required for successful authentication. Kerberos clients which do not support the PKInit Freshness Extension will always fail when using public key credentials. -If you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID. +If you disable or not configure this policy setting, then the DC will never offer the PKInit Freshness Extension and accept valid authentication requests without checking for freshness. Users will never receive the fresh public key identity SID. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *KDC support for PKInit Freshness Extension* -- GP name: *PKINITFreshness* -- GP path: *System/KDC* -- GP ADMX file name: *kdc.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_kdc/RequestCompoundId** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | PKINITFreshness | +| Friendly Name | KDC support for PKInit Freshness Extension | +| Location | Computer Configuration | +| Path | System > KDC | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters | +| ADMX File Name | kdc.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## RequestCompoundId -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/RequestCompoundId +``` + - - + + This policy setting allows you to configure a domain controller to request compound authentication. -> [!NOTE] -> For a domain controller to request compound authentication, the policy "KDC support for claims, compound authentication, and Kerberos armoring" must be configured and enabled. +**Note**: For a domain controller to request compound authentication, the policy "KDC support for claims, compound authentication, and Kerberos armoring" must be configured and enabled. If you enable this policy setting, domain controllers will request compound authentication. The returned service ticket will contain compound authentication only when the account is explicitly configured. This policy should be applied to all domain controllers to ensure consistent application of this policy in the domain. -If you disable or don't configure this policy setting, domain controllers will return service tickets that contain compound authentication anytime the client sends a compound authentication request regardless of the account configuration. +If you disable or do not configure this policy setting, domain controllers will return service tickets that contain compound authentication any time the client sends a compound authentication request regardless of the account configuration. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Request compound authentication* -- GP name: *RequestCompoundId* -- GP path: *System/KDC* -- GP ADMX file name: *kdc.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_kdc/TicketSizeThreshold** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | RequestCompoundId | +| Friendly Name | Request compound authentication | +| Location | Computer Configuration | +| Path | System > KDC | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters | +| Registry Value Name | RequestCompoundId | +| ADMX File Name | kdc.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + +## TicketSizeThreshold -> [!div class = "checklist"] -> * Device + +| Scope | Editions | Applicable OS | +|:--|:--|:--| +| :heavy_check_mark: Device
:x: User | :x: Home
:heavy_check_mark: Pro
:heavy_check_mark: Enterprise
:heavy_check_mark: Education
:heavy_check_mark: Windows SE | :heavy_check_mark: Windows 10, version 2004 [10.0.19041.1202] and later
:heavy_check_mark: Windows 10, version 2009 [10.0.19042.1202] and later
:heavy_check_mark: Windows 10, version 21H1 [10.0.19043.1202] and later
:heavy_check_mark: Windows 11, version 21H2 [10.0.22000] and later | + -
+ +```Device +./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/TicketSizeThreshold +``` + - - + + This policy setting allows you to configure at what size Kerberos tickets will trigger the warning event issued during Kerberos authentication. The ticket size warnings are logged in the System log. -If you enable this policy setting, you can set the threshold limit for Kerberos ticket, which triggers the warning events. If set too high, then authentication failures might be occurring even though warning events aren't being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy "Set maximum Kerberos SSPI context token buffer size" or the smallest MaxTokenSize used in your environment if you aren't configuring using Group Policy. +If you enable this policy setting, you can set the threshold limit for Kerberos ticket which trigger the warning events. If set too high, then authentication failures might be occurring even though warning events are not being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy "Set maximum Kerberos SSPI context token buffer size" or the smallest MaxTokenSize used in your environment if you are not configuring using Group Policy. -If you disable or don't configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions. +If you disable or do not configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions. + - + + + + +**Description framework properties**: - -ADMX Info: -- GP Friendly name: *Warning for large Kerberos tickets* -- GP name: *TicketSizeThreshold* -- GP path: *System/KDC* -- GP ADMX file name: *kdc.admx* +| Property name | Property value | +|:--|:--| +| Format | chr (string) | +| Access Type | Add, Delete, Get, Replace | + - - -
+ +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -**ADMX_kdc/emitlili** +**ADMX mapping**: - +| Name | Value | +|:--|:--| +| Name | TicketSizeThreshold | +| Friendly Name | Warning for large Kerberos tickets | +| Location | Computer Configuration | +| Path | System > KDC | +| Registry Key Name | Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters | +| Registry Value Name | EnableTicketSizeThreshold | +| ADMX File Name | kdc.admx | + -|Edition|Windows 10|Windows 11| -|--- |--- |--- | -|Home|No|No| -|Pro|Yes|Yes| -|Windows SE|No|Yes| -|Business|Yes|Yes| -|Enterprise|Yes|Yes| -|Education|Yes|Yes| + + + - -
+ - -[Scope](./policy-configuration-service-provider.md#policy-scope): + + + -> [!div class = "checklist"] -> * Device + -
+## Related articles - - -This policy setting controls whether the domain controller provides information about previous logons to client computers. - -If you enable this policy setting, the domain controller provides the information message about previous logons. - -For Windows Logon to use this feature, the "Display information about previous logons during user logon" policy setting located in the Windows Logon Options node under Windows Components also needs to be enabled. - -If you disable or don't configure this policy setting, the domain controller doesn't provide information about previous logons unless the "Display information about previous logons during user logon" policy setting is enabled. - -> [!NOTE] -> Information about previous logons is provided only if the domain functional level is Windows Server 2008. In domains with a domain functional level of Windows Server 2003, Windows 2000 native, or Windows 2000 mixed, domain controllers cannot provide information about previous logons, and enabling this policy setting doesn't affect anything. - - - - - -ADMX Info: -- GP Friendly name: *Provide information about previous logons to client computers* -- GP name: *emitlili* -- GP path: *System/KDC* -- GP ADMX file name: *kdc.admx* - - - -
- - - - - -## Related topics - -[ADMX-backed policies in Policy CSP](./policies-in-policy-csp-admx-backed.md) \ No newline at end of file +[Policy configuration service provider](policy-configuration-service-provider.md)