mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Merge pull request #5956 from MicrosoftDocs/master
Publish 11/11/2021, 10:30 AM
This commit is contained in:
Diana Hanson
GitHub
commit
b21c5e0b21
@ -35,16 +35,16 @@ You should read and understand the following information before reading this doc
|
||||
|
||||
- [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760)
|
||||
|
||||
**Note**
|
||||
Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk <strong>*</strong> review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
|
||||
> [!Note]
|
||||
> Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk `*`, review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
|
||||
|
||||
Finally, this document will provide you with the information to configure the computer running App-V client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI).
|
||||
|
||||
To help determine what information is relevant to your environment you should review each section’s brief overview and applicability checklist.
|
||||
To help determine what information is relevant to your environment, you should review each section’s brief overview and applicability checklist.
|
||||
|
||||
## <a href="" id="---------app-v-5-1-in-stateful--non-persistent-deployments"></a> App-V in stateful\* non-persistent deployments
|
||||
|
||||
This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. A number of conditions must be met and steps followed to provide the optimal user experience.
|
||||
This section provides information about an approach that helps ensure a user will have access to all virtual applications within seconds after logging in. This is achieved by uniquely addressing the often long-running App-V publishing refresh. As you will discover the basis of the approach, the fastest publishing refresh, is one that doesn’t have to actually do anything. Many conditions must be met and steps followed to provide the optimal user experience.
|
||||
|
||||
Use the information in the following section for more information:
|
||||
|
||||
@ -72,199 +72,97 @@ Use the information in the following section for more information:
|
||||
|
||||
### <a href="" id="applicability-checklist-"></a>Applicability Checklist
|
||||
|
||||
Deployment Environment
|
||||
|Checklist|Deployment Environment|
|
||||
|--- |--- |
|
||||
||Non-Persistent VDI or RDSH.|
|
||||
||User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).|
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><img src="images/checklistbox.gif" alt="Checklist box" /></td>
|
||||
<td align="left"><p>Non-Persistent VDI or RDSH.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><img src="images/checklistbox.gif" alt="Checklist box" /></td>
|
||||
<td align="left"><p>User Experience Virtualization (UE-V), other UPM solutions or User Profile Disks (UPD).</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
Expected Configuration
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><img src="images/checklistbox.gif" alt="Checklist box" /></td>
|
||||
<td align="left"><p>User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><img src="images/checklistbox.gif" alt="Checklist box" /></td>
|
||||
<td align="left"><p>App-V Shared Content Store (SCS) is configured or can be configured.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
IT Administration
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><img src="images/checklistbox.gif" alt="Checklist box" /></td>
|
||||
<td align="left"><p>Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Checklist|Expected Configuration|
|
||||
|--- |--- |
|
||||
||User Experience Virtualization (UE-V) with the App-V user state template enabled or User Profile Management (UPM) software. Non-UE-V UPM software must be capable of triggering on Login or Process/Application Start and Logoff.|
|
||||
||App-V Shared Content Store (SCS) is configured or can be configured.|
|
||||
|
||||
|
||||
|Checklist|IT Administration|
|
||||
|--- |--- |
|
||||
||Admin may need to update the VM base image regularly to ensure optimal performance or Admin may need to manage multiple images for different user groups.|
|
||||
|
||||
### <a href="" id="bkmk-us"></a>Usage Scenarios
|
||||
|
||||
As you review the two scenarios, keep in mind that these approach the extremes. Based on your usage requirements, you may choose to apply these steps to a subset of users, virtual application packages, or both.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Optimized for Performance</th>
|
||||
<th align="left">Optimized for Storage</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.</p>
|
||||
<p>The following describes many performance improvements in stateful non-persistent deployments. For more information, see <a href="#sequencing-steps-to-optimize-packages-for-publishing-performance" data-raw-source="[Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance)">Sequencing Steps to Optimize Packages for Publishing Performance</a> later in this topic.</p></td>
|
||||
<td align="left"><p>The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.</p>
|
||||
<p>The impact of this alteration is detailed in the <a href="#bkmk-uewt" data-raw-source="[User Experience Walk-through](#bkmk-uewt)">User Experience Walk-through</a> section of this document.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
- **Performance**: To provide the most optimal user experience, this approach uses the capabilities of a UPM solution and requires extra image preparation and can incur some more image management overhead.
|
||||
|
||||
The following describes many performance improvements in stateful non-persistent deployments. For more information, see [Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance) (in this article).
|
||||
|
||||
- **Storage**: The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.
|
||||
|
||||
The impact of this alteration is detailed in the [User Experience Walk-through](#bkmk-uewt) (in this article).
|
||||
|
||||
### <a href="" id="bkmk-pe"></a>Preparing your Environment
|
||||
|
||||
The following table displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach.
|
||||
The following information displays the required steps to prepare the base image and the UE-V or another UPM solution for the approach.
|
||||
|
||||
**Prepare the Base Image**
|
||||
#### Prepare the Base Image
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Optimized for Performance</th>
|
||||
<th align="left">Optimized for Storage</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p></p>
|
||||
<ul>
|
||||
<li><p>Enable the App-V client as described in <a href="appv-enable-the-app-v-desktop-client.md" data-raw-source="[Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md)">Enable the App-V in-box client</a>.</p></li>
|
||||
<li><p>Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.</p></li>
|
||||
<li><p>Configure for Shared Content Store (SCS) mode. For more information see <a href="appv-deploying-the-appv-sequencer-and-client.md" data-raw-source="[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)">Deploying the App-V Sequencer and Configuring the Client</a>.</p></li>
|
||||
<li><p>Configure Preserve User Integrations on Login Registry DWORD.</p></li>
|
||||
<li><p>Pre-configure all user- and global-targeted packages for example, <strong>Add-AppvClientPackage</strong>.</p></li>
|
||||
<li><p>Pre-configure all user- and global-targeted connection groups for example, <strong>Add-AppvClientConnectionGroup</strong>.</p></li>
|
||||
<li><p>Pre-publish all global-targeted packages.</p>
|
||||
<p></p>
|
||||
<p>Alternatively,</p>
|
||||
<ul>
|
||||
<li><p>Perform a global publishing/refresh.</p></li>
|
||||
<li><p>Perform a user publishing/refresh.</p></li>
|
||||
<li><p>Un-publish all user-targeted packages.</p></li>
|
||||
<li><p>Delete the following user-Virtual File System (VFS) entries.</p></li>
|
||||
</ul>
|
||||
<p><code>AppData\Local\Microsoft\AppV\Client\VFS</code></p>
|
||||
<p><code>AppData\Roaming\Microsoft\AppV\Client\VFS</code></p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p></p>
|
||||
<ul>
|
||||
<li><p>Enable the App-V client as described in <a href="appv-enable-the-app-v-desktop-client.md" data-raw-source="[Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md)">Enable the App-V in-box client</a>.</p></li>
|
||||
<li><p>Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.</p></li>
|
||||
<li><p>Configure for Shared Content Store (SCS) mode. For more information see <a href="appv-deploying-the-appv-sequencer-and-client.md" data-raw-source="[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)">Deploying the App-V Sequencer and Configuring the Client</a>.</p></li>
|
||||
<li><p>Configure Preserve User Integrations on Login Registry DWORD.</p></li>
|
||||
<li><p>Pre-configure all global-targeted packages for example, <strong>Add-AppvClientPackage</strong>.</p></li>
|
||||
<li><p>Pre-configure all global-targeted connection groups for example, <strong>Add-AppvClientConnectionGroup</strong>.</p></li>
|
||||
<li><p>Pre-publish all global-targeted packages.</p>
|
||||
<p></p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
- **Performance**:
|
||||
|
||||
- Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).
|
||||
- Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
|
||||
- Configure for Shared Content Store (SCS) mode. For more information, see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
|
||||
- Configure Preserve User Integrations on Login Registry DWORD.
|
||||
- Pre-configure all user and global-targeted packages, for example, **Add-AppvClientPackage**.
|
||||
- Pre-configure all user- and global-targeted connection groups, for example, **Add-AppvClientConnectionGroup**.
|
||||
- Pre-publish all global-targeted packages. Or:
|
||||
- Perform a global publishing/refresh.
|
||||
- Perform a user publishing/refresh.
|
||||
- Unpublish all user-targeted packages.
|
||||
- Delete the following user-Virtual File System (VFS) entries:
|
||||
|
||||
- `AppData\Local\Microsoft\AppV\Client\VFS`
|
||||
- `AppData\Roaming\Microsoft\AppV\Client\VFS`
|
||||
|
||||
**Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information:
|
||||
- **Storage**:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Configuration Setting</th>
|
||||
<th align="left">What does this do?</th>
|
||||
<th align="left">How should I use it?</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Shared Content Store (SCS) Mode</p>
|
||||
<ul>
|
||||
<li><p>Configurable in Windows PowerShell with <code>Set-AppvClientConfiguration -SharedContentStoreMode 1</code><br>or configurable with Group Policy, as described in <a href="appv-deploying-the-appv-sequencer-and-client.md" data-raw-source="[Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)">Deploying the App-V Sequencer and Configuring the Client</a>.</p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p>When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).</p>
|
||||
<p>This helps to conserve local storage and minimize disk I/O per second (IOPS).</p></td>
|
||||
<td align="left"><p>This is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>PreserveUserIntegrationsOnLogin</p>
|
||||
<ul>
|
||||
<li><p>Configure in the Registry under <strong>HKEY_LOCAL_MACHINE</strong> \ <strong>Software</strong> \ <strong>Microsoft</strong> \ <strong>AppV</strong> \ <strong>Client</strong> \ <strong>Integration</strong>.</p></li>
|
||||
<li><p>Create the DWORD value <strong>PreserveUserIntegrationsOnLogin</strong> with a value of <strong>1</strong>.</p></li>
|
||||
<li><p>Restart the App-V client service or restart the computer running the App-V Client.</p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p>If you have not pre-configured (<strong>Add-AppvClientPackage</strong>) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then re-integrate*.</p>
|
||||
<p>For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.</p></td>
|
||||
<td align="left"><p>If you don’t plan to pre-configure every available user package in the base image, use this setting.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>MaxConcurrentPublishingRefresh</p>
|
||||
<ul>
|
||||
<li><p>Configure in the Registry under <strong>HKEY_LOCAL_MACHINE</strong> \ <strong>Software</strong> \ <strong>Microsoft</strong> \ <strong>AppV</strong> \ <strong>Client</strong> \ <strong>Publishing</strong>.</p></li>
|
||||
<li><p>Create the DWORD value <strong>MaxConcurrentPublishingrefresh</strong> with the desired maximum number of concurrent publishing refreshes.</p></li>
|
||||
<li><p>The App-V client service and computer do not need to be restarted.</p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p>This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.</p></td>
|
||||
<td align="left"><p>Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.</p>
|
||||
<p>If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
- Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).
|
||||
- Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
|
||||
- Configure for Shared Content Store (SCS) mode. For more information, see [Deploying the
|
||||
App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
|
||||
- Configure Preserve User Integrations on Login Registry DWORD.
|
||||
- Pre-configure all global-targeted packages, for example, **Add-AppvClientPackage**.
|
||||
- Pre-configure all global-targeted connection groups, for example, **Add-AppvClientConnectionGroup**.
|
||||
- Pre-publish all global-targeted packages.
|
||||
|
||||
#### Configurations
|
||||
|
||||
For critical App-V Client configurations and for a little more context and how-to, review the following configuration settings:
|
||||
|
||||
- **Shared Content Store (SCS) Mode**: When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM). This helps to conserve local storage and minimize disk I/O per second (IOPS).
|
||||
|
||||
This setting is recommended when low-latency connections are available between the App-V Client endpoint and the SCS content server, SAN.
|
||||
|
||||
- Configurable in Windows PowerShell: `Set-AppvClientConfiguration -SharedContentStoreMode 1`
|
||||
- Configurable with Group Policy: See [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
|
||||
|
||||
- **PreserveUserIntegrationsOnLogin**: If you have not pre-configured (**Add-AppvClientPackage**) a specific package and this setting is not configured, the App-V Client will de-integrate* the persisted user integrations, then reintegrate*.
|
||||
|
||||
For every package that meets the above conditions, effectively twice the work will be done during publishing/refresh.
|
||||
|
||||
If you don’t plan to pre-configure every available user package in the base image, use this setting.
|
||||
|
||||
- Configure in the Registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Integration`.
|
||||
- Create the DWORD value **PreserveUserIntegrationsOnLogin** with a value of 1.
|
||||
- Restart the App-V client service or restart the computer running the App-V Client.
|
||||
|
||||
- **MaxConcurrentPublishingRefresh**: This setting determines the number of users that can perform a publishing refresh/sync at the same time. The default setting is no limit.
|
||||
|
||||
Limiting the number of concurrent publishing refreshes prevents excessive CPU usage that could impact computer performance. This limit is recommended in an RDS environment, where multiple users can log in to the same computer at the same time and perform a publishing refresh sync.
|
||||
|
||||
If the concurrent publishing refresh threshold is reached, the time required to publish new applications and make them available to end users after they log in could take an indeterminate amount of time.
|
||||
|
||||
- Configure in the Registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\AppV\Client\Publishing`.
|
||||
- Create the DWORD value **MaxConcurrentPublishingrefresh** with the desired maximum number of concurrent publishing refreshes.
|
||||
- The App-V client service and computer do not need to be restarted.
|
||||
|
||||
### Configure UE-V solution for App-V Approach
|
||||
|
||||
@ -278,8 +176,8 @@ For more information, see:
|
||||
|
||||
In essence all that is required is to enable the UE-V service and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information about UE-V templates, see [User Experience Virtualization (UE-V) for Windows client overview](/windows/configuration/ue-v/uev-for-windows).
|
||||
|
||||
**Note**
|
||||
Without performing an additional configuration step, User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default.
|
||||
> [!Note]
|
||||
> Without performing an additional configuration step, User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default.
|
||||
|
||||
UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following two scenarios, because the net result will be that the shortcut will be valid on one but not all devices.
|
||||
|
||||
@ -287,12 +185,10 @@ UE-V will only support removing the .lnk file type from the exclusion list in th
|
||||
|
||||
- If a user has an application installed on one device but not another with .lnk files enabled.
|
||||
|
||||
**Important**
|
||||
This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
|
||||
> [!Important]
|
||||
> This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
|
||||
|
||||
|
||||
|
||||
Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types.
|
||||
Using the Microsoft Registry Editor (regedit.exe), navigate to `HKEY\_LOCAL\_MACHINE\Software\Microsoft\UEV\Agent\Configuration\ExcludedFileTypes` and remove `.lnk` from the excluded file types.
|
||||
|
||||
## Configure other User Profile Management (UPM) solutions for App-V Approach
|
||||
|
||||
@ -308,12 +204,11 @@ To enable an optimized login experience, for example the App-V approach for the
|
||||
|
||||
- Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations.
|
||||
|
||||
**Note**
|
||||
App-V is supported when using UPD only when the entire profile is stored on the user profile disk.
|
||||
|
||||
App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders.
|
||||
|
||||
|
||||
> [!Note]
|
||||
>
|
||||
> App-V is supported when using UPD only when the entire profile is stored on the user profile disk.
|
||||
>
|
||||
> App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders.
|
||||
|
||||
- Capturing changes to the locations, which constitute the user integrations, prior to session logoff.
|
||||
|
||||
@ -355,83 +250,61 @@ Registry – HKEY\_CURRENT\_USER
|
||||
|
||||
This following is a step-by-step walk-through of the App-V and UPM operations and the expectations users should expect.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Optimized for Performance</th>
|
||||
<th align="left">Optimized for Storage</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>After implementing this approach in the VDI/RDSH environment, on first login,</p>
|
||||
<ul>
|
||||
<li><p>(Operation) A user-publishing/refresh is initiated. (Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.</p></li>
|
||||
<li><p>(Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.</p></li>
|
||||
</ul>
|
||||
<p>On subsequent logins:</p>
|
||||
<ul>
|
||||
<li><p>(Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.</p>
|
||||
<p>(Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.</p></li>
|
||||
<li><p>(Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements. (Expectation) If there are no entitlement changes, publishing1 will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity* of virtual applications</p></li>
|
||||
<li><p>(Operation) UPM solution will capture user integrations again at logoff. (Expectation) Same as previous.</p></li>
|
||||
</ul>
|
||||
<p>¹ The publishing operation (<strong>Publish-AppVClientPackage</strong>) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.</p></td>
|
||||
<td align="left"><p>After implementing this approach in the VDI/RDSH environment, on first login,</p>
|
||||
<ul>
|
||||
<li><p>(Operation) A user-publishing/refresh is initiated. (Expectation)</p>
|
||||
<ul>
|
||||
<li><p>If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.</p></li>
|
||||
<li><p>First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).</p>
|
||||
<p></p></li>
|
||||
</ul></li>
|
||||
<li><p>(Operation) After the publishing/refresh, the UPM solution captures the user integrations. (Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state</p></li>
|
||||
</ul>
|
||||
<p>On subsequent logins:</p>
|
||||
<ul>
|
||||
<li><p>(Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.</p></li>
|
||||
<li><p>(Operation) Add/refresh must pre-configure all user targeted applications. (Expectation)</p>
|
||||
<ul>
|
||||
<li><p>This may increase the time to application availability significantly (on the order of 10’s of seconds).</p></li>
|
||||
<li><p>This will increase the publishing refresh time relative to the number and complexity* of virtual applications.</p>
|
||||
<p></p></li>
|
||||
</ul></li>
|
||||
<li><p>(Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
- **Performance**: After implementing this approach in the VDI/RDSH environment, on first login,
|
||||
- (Operation) A user-publishing/refresh is initiated.
|
||||
|
||||
(Expectation) If this is the first time a user has published virtual applications (e.g. non-persistent), this will take the usual duration of a publishing/refresh.
|
||||
|
||||
- (Operation) After the publishing/refresh, the UPM solution captures the user integrations.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Outcome</th>
|
||||
<th align="left">Outcome</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p></p>
|
||||
<ul>
|
||||
<li><p>Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.</p></li>
|
||||
<li><p>The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.</p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p>Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
(Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.
|
||||
|
||||
**On subsequent logins**:
|
||||
|
||||
- (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.
|
||||
|
||||
(Expectation) There will be shortcuts present on the desktop, or in the start menu, which work immediately. When the publishing/refresh completes (i.e., package entitlements change), some may go away.
|
||||
|
||||
- (Operation) Publishing/refresh will process un-publish and publish operations for changes in user package entitlements.
|
||||
|
||||
(Expectation) If there are no entitlement changes, publishing will complete in seconds. Otherwise, the publishing/refresh will increase relative to the number and complexity of virtual applications
|
||||
|
||||
The publishing operation (**Publish-AppVClientPackage**) adds entries to the user catalog, maps entitlement to the user, identifies the local store, and finishes by completing any integration steps.
|
||||
|
||||
- (Operation) UPM solution will capture user integrations again at logoff.
|
||||
|
||||
(Expectation) Same as previous.
|
||||
|
||||
**Outcome**:
|
||||
|
||||
- Because the user integrations are entirely preserved, there will be no work for example, integration for the publishing/refresh to complete. All virtual applications will be available within seconds of login.
|
||||
- The publishing/refresh will process changes to the users entitled virtual applications which impacts the experience.
|
||||
|
||||
- **Storage**: After implementing this approach in the VDI/RDSH environment, on first login
|
||||
|
||||
- (Operation) A user-publishing/refresh is initiated.
|
||||
|
||||
(Expectation):
|
||||
|
||||
- If this is the first time a user has published virtual applications (e.g., non-persistent), this will take the usual duration of a publishing/refresh.
|
||||
- First and subsequent logins will be impacted by pre-configuring of packages (add/refresh).
|
||||
|
||||
- (Operation) After the publishing/refresh, the UPM solution captures the user integrations.
|
||||
|
||||
(Expectation) Depending on how the UPM solution is configured, this may occur as part of the logoff process. This will incur the same/similar overhead as persisting the user state.
|
||||
|
||||
**On subsequent logins**:
|
||||
|
||||
- (Operation) UPM solution applies the user integrations to the system prior to publishing/refresh.
|
||||
- (Operation) Add/refresh must pre-configure all user targeted applications.
|
||||
|
||||
- (Expectation):
|
||||
- This may increase the time to application availability significantly (on the order of 10’s of seconds).
|
||||
- This will increase the publishing refresh time relative to the number and complexity* of virtual applications.
|
||||
|
||||
- (Operation) Publishing/refresh will process un-publish and publish operations for changes to user package entitlements.
|
||||
|
||||
**Outcome**: Because the add/refresh must re-configure all the virtual applications to the VM, the publishing refresh time on every login will be extended.
|
||||
|
||||
### <a href="" id="bkmk-plc"></a>Impact to Package Life Cycle
|
||||
|
||||
@ -489,36 +362,9 @@ Server Performance Tuning Guidelines for
|
||||
|
||||
Several App-V features facilitate new scenarios or enable new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Step</th>
|
||||
<th align="left">Consideration</th>
|
||||
<th align="left">Benefits</th>
|
||||
<th align="left">Tradeoffs</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>No Feature Block 1 (FB1, also known as Primary FB)</p></td>
|
||||
<td align="left"><p>No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch. If there are network limitations, FB1 will:</p>
|
||||
<ul>
|
||||
<li><p>Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.</p></li>
|
||||
<li><p>Delay launch until the entire FB1 has been streamed.</p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p>Stream faulting decreases the launch time.</p></td>
|
||||
<td align="left"><p>Virtual application packages with FB1 configured will need to be re-sequenced.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Step|Consideration|Benefits|Tradeoffs|
|
||||
|--- |--- |--- |--- |
|
||||
|No Feature Block 1 (FB1, also known as Primary FB)|No FB1 means the application will launch immediately and stream fault (application requires file, DLL and must pull down over the network) during launch. If there are network limitations, FB1 will:<br><li>Reduce the number of stream faults and network bandwidth used when you launch an application for the first time.<li>Delay launch until the entire FB1 has been streamed.|Stream faulting decreases the launch time.|Virtual application packages with FB1 configured will need to be re-sequenced.|
|
||||
|
||||
### Removing FB1
|
||||
|
||||
@ -554,36 +400,12 @@ Removing FB1 does not require the original application installer. After completi
|
||||
|
||||
"C:\\UpgradedPackages"
|
||||
|
||||
**Note**
|
||||
This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Step</th>
|
||||
<th align="left">Considerations</th>
|
||||
<th align="left">Benefits</th>
|
||||
<th align="left">Tradeoffs</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>No SXS Install at Publish (Pre-Install SxS assemblies)</p></td>
|
||||
<td align="left"><p>Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.</p></td>
|
||||
<td align="left"><p>The SxS Assembly dependencies will not install at publishing time.</p></td>
|
||||
<td align="left"><p>SxS Assembly dependencies must be pre-installed.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
> [!Note]
|
||||
> This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file.
|
||||
|
||||
|Step|Considerations|Benefits|Tradeoffs|
|
||||
|--- |--- |--- |--- |
|
||||
|No SXS Install at Publish (Pre-Install SxS assemblies)|Virtual Application packages do not need to be re-sequenced. SxS Assemblies can remain in the virtual application package.|The SxS Assembly dependencies will not install at publishing time.|SxS Assembly dependencies must be pre-installed.|
|
||||
|
||||
|
||||
### Creating a new virtual application package on the sequencer
|
||||
@ -594,33 +416,9 @@ If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is ins
|
||||
|
||||
When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Step</th>
|
||||
<th align="left">Considerations</th>
|
||||
<th align="left">Benefits</th>
|
||||
<th align="left">Tradeoffs</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Selectively Employ Dynamic Configuration files</p></td>
|
||||
<td align="left"><p>The App-V client must parse and process these Dynamic Configuration files.</p>
|
||||
<p>Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.</p>
|
||||
<p>Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.</p></td>
|
||||
<td align="left"><p>Publishing times will improve if these files are used selectively or not at all.</p></td>
|
||||
<td align="left"><p>Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Step|Considerations|Benefits|Tradeoffs|
|
||||
|--- |--- |--- |--- |
|
||||
|Selectively Employ Dynamic Configuration files|The App-V client must parse and process these Dynamic Configuration files. <br> <br>Be conscious of size and complexity (script execution, VREG inclusions/exclusions) of the file.<br> <br>Numerous virtual application packages may already have User- or computer–specific dynamic configurations files.|Publishing times will improve if these files are used selectively or not at all.|Virtual application packages would need to be reconfigured individually or via the App-V server management console to remove associated Dynamic Configuration files.|
|
||||
|
||||
|
||||
### Disabling a Dynamic Configuration by using Windows PowerShell
|
||||
@ -639,39 +437,10 @@ For documentation on How to Apply a Dynamic Configuration, see:
|
||||
|
||||
- [How to Apply the Deployment Configuration File by Using Windows PowerShell](appv-apply-the-deployment-configuration-file-with-powershell.md)
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Step</th>
|
||||
<th align="left">Considerations</th>
|
||||
<th align="left">Benefits</th>
|
||||
<th align="left">Tradeoffs</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Account for Synchronous Script Execution during Package Lifecycle.</p></td>
|
||||
<td align="left"><p>If script collateral is embedded in the package, Add cmdlets may be significantly slower.</p>
|
||||
<p>Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.</p></td>
|
||||
<td align="left"><p>Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.</p></td>
|
||||
<td align="left"><p>This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Remove Extraneous Virtual Fonts from Package.</p></td>
|
||||
<td align="left"><p>The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.</p></td>
|
||||
<td align="left"><p>Virtual Fonts impact publishing refresh performance.</p></td>
|
||||
<td align="left"><p>Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Step|Considerations|Benefits|Tradeoffs|
|
||||
|--- |--- |--- |--- |
|
||||
|Account for Synchronous Script Execution during Package Lifecycle.|If script collateral is embedded in the package, Add cmdlets may be significantly slower.<br>Running of scripts during virtual application launch (StartVirtualEnvironment, StartProcess) and/or Add+Publish will impact the perceived performance during one or more of these lifecycle operations.|Use of Asynchronous (Non-Blocking) Scripts will ensure that the lifecycle operations complete efficiently.|This step requires working knowledge of all virtual application packages with embedded script collateral, which have associated dynamic configurations files and which reference and run scripts synchronously.|
|
||||
|Remove Extraneous Virtual Fonts from Package.|The majority of applications investigated by the App-V product team contained a small number of fonts, typically fewer than 20.|Virtual Fonts impact publishing refresh performance.|Desired fonts will need to be enabled/installed natively. For instructions, see Install or uninstall fonts.|
|
||||
|
||||
### Determining what virtual fonts exist in the package
|
||||
|
||||
@ -681,15 +450,15 @@ For documentation on How to Apply a Dynamic Configuration, see:
|
||||
|
||||
- Open AppxManifest.xml and locate the following:
|
||||
|
||||
```
|
||||
```xml
|
||||
<appv:Extension Category="AppV.Fonts">
|
||||
<appv:Fonts>
|
||||
<appv:Font Path="[{Fonts}]\private\CalibriL.ttf" DelayLoad="true"></appv:Font>
|
||||
</appv:Fonts>
|
||||
```
|
||||
|
||||
**Note** If there are fonts marked as **DelayLoad**, those will not impact first launch.
|
||||
|
||||
> [!Note]
|
||||
> If there are fonts marked as **DelayLoad**, those will not impact first launch.
|
||||
|
||||
### Excluding virtual fonts from the package
|
||||
|
||||
@ -699,7 +468,7 @@ Use the dynamic configuration file that best suits the user scope – deployment
|
||||
|
||||
Fonts
|
||||
|
||||
```
|
||||
```xml
|
||||
-->
|
||||
<Fonts Enabled="false" />
|
||||
<!--
|
||||
|
||||
@ -54,56 +54,35 @@ Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages glo
|
||||
|
||||
1. Using the information in the following table, create a new registry key using the name of the executable file, for example, **MyApp.exe**.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Package publishing method</th>
|
||||
<th align="left">Where to create the registry key</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Published globally</p></td>
|
||||
<td align="left"><p>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual</p>
|
||||
<p><strong>Example</strong>: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Published to the user</p></td>
|
||||
<td align="left"><p>HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual</p>
|
||||
<p><strong>Example</strong>: HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Connection group can contain:</p>
|
||||
<ul>
|
||||
<li><p>Packages that are published just globally or just to the user</p></li>
|
||||
<li><p>Packages that are published globally and to the user</p></li>
|
||||
</ul></td>
|
||||
<td align="left"><p>Either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER key, but all of the following must be true:</p>
|
||||
<ul>
|
||||
<li><p>If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.</p></li>
|
||||
<li><p>Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.</p></li>
|
||||
<li><p>The key under which you create the subkey must match the publishing method you used for the package.</p>
|
||||
<p>For example, if you published the package to the user, you must create the subkey under <code>HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual</code>. Do not add a key for the same application under both hives.</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
- **Published globally**: Create the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual` registry key.
|
||||
|
||||
|
||||
For example, create `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe`.
|
||||
|
||||
- **Published to the user**: Create the `HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual` registry key.
|
||||
|
||||
For example, create `HKEY_CURRENT_USER \SOFTWARE\Microsoft\AppV\Client\RunVirtual\MyApp.exe`.
|
||||
|
||||
- Connection group can be:
|
||||
- Packages that are published just globally or just to the user
|
||||
- Packages that are published globally and to the user
|
||||
|
||||
Use the `HKEY_LOCAL_MACHINE` or `HKEY_CURRENT_USER` key. But, all of the following must be true:
|
||||
|
||||
- If you want to include multiple packages in the virtual environment, you must include them in an enabled connection group.
|
||||
- Create only one subkey for one of the packages in the connection group. If, for example, you have one package that is published globally, and another package that is published to the user, you create a subkey for either of these packages, but not both. Although you create a subkey for only one of the packages, all of the packages in the connection group, plus the local application, will be available in the virtual environment.
|
||||
- The key under which you create the subkey must match the publishing method you used for the package.
|
||||
|
||||
For example, if you published the package to the user, you must create the subkey under `HKEY_CURRENT_USER\SOFTWARE\Microsoft\AppV\Client\RunVirtual`. Do not add a key for the same application under both hives.
|
||||
|
||||
2. Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore.
|
||||
|
||||
**Syntax**: <PackageId>\_<VersionId>
|
||||
**Syntax**: `<PackageId>_<VersionId>`
|
||||
|
||||
**Example**: 4c909996-afc9-4352-b606-0b74542a09c1\_be463724-Oct1-48f1-8604-c4bd7ca92fa
|
||||
|
||||
The application in the previous example would produce a registry export file (.reg file) like the following:
|
||||
|
||||
``` syntax
|
||||
```registry
|
||||
Windows Registry Editor Version 5.00
|
||||
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\RunVirtual]
|
||||
@=""
|
||||
@ -116,24 +95,24 @@ Starting with App-V 5.0 SP3, when using RunVirtual, you can publish packages glo
|
||||
|
||||
You can use the **Start-AppVVirtualProcess** cmdlet to retrieve the package name and then start a process within the specified package's virtual environment. This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running.
|
||||
|
||||
Use the following example syntax, and substitute the name of your package for **<Package>**:
|
||||
Use the following example syntax, and substitute the name of your package for `<Package>`:
|
||||
|
||||
`$AppVName = Get-AppvClientPackage <Package>`
|
||||
|
||||
`Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe`
|
||||
|
||||
If you don’t know the exact name of your package, you can use the command line <strong>Get-AppvClientPackage \*executable\*</strong>, where **executable** is the name of the application, for example:<br>Get-AppvClientPackage \*Word\*
|
||||
If you don’t know the exact name of your package, you can use the command line `Get-AppvClientPackage YourExecutable`, where `YourExecutable` is the name of the application. For example, enter `Get-AppvClientPackage Word`.
|
||||
|
||||
## <a href="" id="bkmk-cl-switch-appvpid"></a>Command line switch /appvpid:<PID>
|
||||
## <a href="" id="bkmk-cl-switch-appvpid"></a>Command line switch `/appvpid:<PID>`
|
||||
|
||||
|
||||
You can apply the **/appvpid:<PID>** switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running.
|
||||
You can apply the `/appvpid:<PID>` switch to any command, which enables that command to run within a virtual process that you select by specifying its process ID (PID). Using this method launches the new executable in the same App-V environment as an executable that is already running.
|
||||
|
||||
Example: `cmd.exe /appvpid:8108`
|
||||
|
||||
To find the process ID (PID) of your App-V process, run the command **tasklist.exe** from an elevated command prompt.
|
||||
|
||||
## <a href="" id="bkmk-cl-hook-switch-appvve"></a>Command line hook switch /appvve:<GUID>
|
||||
## <a href="" id="bkmk-cl-hook-switch-appvve"></a>Command line hook switch `/appvve:<GUID>`
|
||||
|
||||
|
||||
This switch lets you run a local command within the virtual environment of an App-V package. Unlike the **/appvid** switch, where the virtual environment must already be running, this switch enables you to start the virtual environment.
|
||||
@ -152,25 +131,11 @@ To get the package GUID and version GUID of your application, run the **Get-Appv
|
||||
|
||||
- Version ID of the desired package
|
||||
|
||||
If you don’t know the exact name of your package, use the command line <strong>Get-AppvClientPackage \*executable\*</strong>, where **executable** is the name of the application, for example:<br>Get-AppvClientPackage \*Word\*
|
||||
If you don’t know the exact name of your package, use the command line `Get-AppvClientPackage YourExecutable`, where `YourExecutable` is the name of the application. For example, enter `Get-AppvClientPackage Word`.
|
||||
|
||||
This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running.
|
||||
|
||||
|
||||
|
||||
|
||||
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
[Technical Reference for App-V](appv-technical-reference.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -42,49 +42,30 @@ You can obtain information about the App-V client or perform specific tasks by u
|
||||
|
||||
The client management console contains the following described main tabs.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Tab</th>
|
||||
<th align="left">Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Overview</p></td>
|
||||
<td align="left"><p>The <strong>Overview</strong> tab contains the following elements:</p>
|
||||
<ul>
|
||||
<li><p>Update – Use the <strong>Update</strong> tile to refresh a virtualized application or to receive a new virtualized package.</p>
|
||||
<p>The <strong>Last Refresh</strong> displays the current version of the virtualized package.</p></li>
|
||||
<li><p>Download all virtual applications – Use the <strong>Download</strong> tile to download all of the packages provisioned to the current user.</p>
|
||||
<p>(Associated Windows PowerShell cmdlet: <strong>Mount-AppvClientPackage</strong>)</p>
|
||||
<p></p></li>
|
||||
<li><p>Work Offline – Use this tile to disallow all automatic and manual virtual application updates.</p>
|
||||
<p>(Associated Windows PowerShell cmdlet: <strong>Set-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled</strong>)</p></li>
|
||||
</ul></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Virtual Apps</p></td>
|
||||
<td align="left"><p>The <strong>VIRTUAL APPS</strong> tab displays all of the packages that have been published to the user. You can also click a specific package and see all of the applications that are part of that package. This displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads. Additionally, you can repair the user state. A repair will delete all user data that is associated with a package.</p>
|
||||
<p></p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>App Connection Groups</p></td>
|
||||
<td align="left"><p>The <strong>APP CONNECTION GROUPS</strong> tab displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.</p>
|
||||
<p>(Associated Windows PowerShell cmdlets: Download - <strong>Mount-AppvClientConnectionGroup</strong>. Repair -<strong>AppvClientConnectionGroup</strong>.)</p>
|
||||
<p></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
- **Overview**: The **Overview** tab contains the following elements:
|
||||
|
||||
- **Update**: Refreshes a virtualized application or to receive a new virtualized package.
|
||||
- **Last Refresh**: Displays the current version of the virtualized package.
|
||||
- **Download all virtual applications**: Use the Download tile to download all of the packages provisioned to the current user.
|
||||
|
||||
Associated Windows PowerShell cmdlet: `Mount-AppvClientPackage`
|
||||
|
||||
- **Work Offline**: Disallows all automatic and manual virtual application updates.
|
||||
|
||||
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||
Associated Windows PowerShell cmdlet: `-AppvPublishServer –UserRefreshEnabled –GlobalRefreshEnabled`
|
||||
|
||||
- **VIRTUAL APPS**: Displays all of the packages that have been published to the user.
|
||||
|
||||
You can also click a specific package and see all of the applications that are part of that package. This option displays information about packages that are currently in use and how much of each package has been downloaded to the computer. You can also start and stop package downloads, and repair the user state. A repair will delete all user data that is associated with a package.
|
||||
|
||||
- **APP CONNECTION GROUPS**: Displays all of the connection groups that are available to the current user. Click a specific connection group to see all of the packages that are part of the selected group. This displays information about connection groups that are already in use and how much of the connection group contents have been downloaded to the computer. Additionally, you can start and stop connection group downloads. You can use this section to initiate a repair. A repair will remove all of the user state that is associated a connection group.
|
||||
|
||||
Associated Windows PowerShell cmdlets:
|
||||
|
||||
- Download: `Mount-AppvClientConnectionGroup`
|
||||
- Repair: `AppvClientConnectionGroup`
|
||||
|
||||
For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -77,84 +77,20 @@ To get the name of the Publishing server and the port number (`http://<PubServer
|
||||
|
||||
In your publishing metadata query, enter the string values that correspond to the client operating system that you’re using.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th align="left">Operating system</th>
|
||||
<th align="left">Architecture</th>
|
||||
<th align="left">String value</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Windows 10/11</p></td>
|
||||
<td align="left"><p>64-bit</p></td>
|
||||
<td align="left"><p>WindowsClient_10.0_x64</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Windows 10/11</p></td>
|
||||
<td align="left"><p>32-bit</p></td>
|
||||
<td align="left"><p>WindowsClient_10.0_x86</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Windows 8.1</p></td>
|
||||
<td align="left"><p>64-bit</p></td>
|
||||
<td align="left"><p>WindowsClient_6.2_x64</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Windows 8.1</p></td>
|
||||
<td align="left"><p>32-bit</p></td>
|
||||
<td align="left"><p>WindowsClient_6.2_x86</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Windows 8</p></td>
|
||||
<td align="left"><p>64-bit</p></td>
|
||||
<td align="left"><p>WindowsClient_6.2_x64</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Windows 8</p></td>
|
||||
<td align="left"><p>32-bit</p></td>
|
||||
<td align="left"><p>WindowsClient_6.2_x86</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Windows Server 2012 R2</p></td>
|
||||
<td align="left"><p>64-bit</p></td>
|
||||
<td align="left"><p>WindowsServer_6.2_x64</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Windows Server 2012 R2</p></td>
|
||||
<td align="left"><p>32-bit</p></td>
|
||||
<td align="left"><p>WindowsServer_6.2_x86</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Windows Server 2012</p></td>
|
||||
<td align="left"><p>64-bit</p></td>
|
||||
<td align="left"><p>WindowsServer_6.2_x64</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Windows Server 2012</p></td>
|
||||
<td align="left"><p>32-bit</p></td>
|
||||
<td align="left"><p>WindowsServer_6.2_x86</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Windows Server 2008 R2</p></td>
|
||||
<td align="left"><p>64-bit</p></td>
|
||||
<td align="left"><p>WindowsServer_6.1_x64</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Windows Server 2008 R2</p></td>
|
||||
<td align="left"><p>32-bit</p></td>
|
||||
<td align="left"><p>WindowsServer_6.1_x86</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Operating system|Architecture|String value|
|
||||
|--- |--- |--- |
|
||||
|Windows 10/11|64-bit|WindowsClient_10.0_x64|
|
||||
|Windows 10/11|32-bit|WindowsClient_10.0_x86|
|
||||
|Windows 8.1|64-bit|WindowsClient_6.2_x64|
|
||||
|Windows 8.1|32-bit|WindowsClient_6.2_x86|
|
||||
|Windows 8|64-bit|WindowsClient_6.2_x64|
|
||||
|Windows 8|32-bit|WindowsClient_6.2_x86|
|
||||
|Windows Server 2012 R2|64-bit|WindowsServer_6.2_x64|
|
||||
|Windows Server 2012 R2|32-bit|WindowsServer_6.2_x86|
|
||||
|Windows Server 2012|64-bit|WindowsServer_6.2_x64|
|
||||
|Windows Server 2012|32-bit|WindowsServer_6.2_x86|
|
||||
|Windows Server 2008 R2|64-bit|WindowsServer_6.1_x64|
|
||||
|Windows Server 2008 R2|32-bit|WindowsServer_6.1_x86|
|
||||
|
||||
|
||||
<br>For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv).
|
||||
|
||||
@ -60,7 +60,7 @@ Make sure that you install the latest Windows updates, cumulative updates, and r
|
||||
|
||||
1. Network Capture with ETW. Enter the following at an elevated command prompt:
|
||||
|
||||
```
|
||||
```cmd
|
||||
netsh trace start wireless_dbg capture=yes overwrite=yes maxsize=4096 tracefile=c:\tmp\wireless.etl
|
||||
```
|
||||
2. Reproduce the issue.
|
||||
@ -70,12 +70,12 @@ Make sure that you install the latest Windows updates, cumulative updates, and r
|
||||
- If intermittent connection drops trigger stop command on a script (ping or test network constantly until fail, then netsh trace stop).
|
||||
3. Stop the trace by entering the following command:
|
||||
|
||||
```
|
||||
```cmd
|
||||
netsh trace stop
|
||||
```
|
||||
4. To convert the output file to text format:
|
||||
|
||||
```
|
||||
```cmd
|
||||
netsh trace convert c:\tmp\wireless.etl
|
||||
```
|
||||
|
||||
@ -85,17 +85,13 @@ See the [example ETW capture](#example-etw-capture) at the bottom of this articl
|
||||
|
||||
The following is a high-level view of the main wifi components in Windows.
|
||||
|
||||
<table>
|
||||
<tr><td><img src="images/wcm.png" alt="Windows Connection Manager"></td><td>The <b>Windows Connection Manager</b> (Wcmsvc) is closely associated with the UI controls (taskbar icon) to connect to various networks, including wireless networks. It accepts and processes input from the user and feeds it to the core wireless service. </td></tr>
|
||||
<tr><td><img src="images/wlan.png" alt="WLAN Autoconfig Service"></td><td>The <b>WLAN Autoconfig Service</b> (WlanSvc) handles the following core functions of wireless networks in windows:
|
||||
|
||||
- Scanning for wireless networks in range
|
||||
- Managing connectivity of wireless networks</td></tr>
|
||||
<tr><td><img src="images/msm.png" alt="Media Specific Module"></td><td>The <b>Media Specific Module</b> (MSM) handles security aspects of connection being established.</td></tr>
|
||||
<tr><td><img src="images/wifi-stack.png" alt="Native WiFi stack"></td><td>The <b>Native WiFi stack</b> consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc.</td></tr>
|
||||
<tr><td><img src="images/miniport.png" alt="Wireless miniport"></td><td>Third-party <b>wireless miniport</b> drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows.</td></tr>
|
||||
</table>
|
||||
|
||||
|Wi-fi Components|Description|
|
||||
|--- |--- |
|
||||
||The Windows Connection Manager (Wcmsvc) is closely associated with the UI controls (taskbar icon) to connect to various networks, including wireless networks. It accepts and processes input from the user and feeds it to the core wireless service.|
|
||||
||The WLAN Autoconfig Service (WlanSvc) handles the following core functions of wireless networks in windows:<li> Scanning for wireless networks in range<li>Managing connectivity of wireless networks|
|
||||
||The Media Specific Module (MSM) handles security aspects of connection being established.|
|
||||
||The Native WiFi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc.|
|
||||
||Third-party wireless miniport drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows.|
|
||||
|
||||
The wifi connection state machine has the following states:
|
||||
- Reset
|
||||
@ -289,7 +285,7 @@ C:\tmp>dir
|
||||
|
||||
Copy and paste all the lines below and save them into a text file named "wifi.tat." Load the filter file into the TextAnalysisTool by clicking **File > Load Filters**.
|
||||
|
||||
```
|
||||
```xml
|
||||
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
|
||||
<TextAnalysisTool.NET version="2018-01-03" showOnlyFilteredLines="False">
|
||||
<filters>
|
||||
|
||||
@ -18,7 +18,8 @@ ms.date: 11/19/2019
|
||||
The AppLocker configuration service provider is used to specify which applications are allowed or disallowed. There is no user interface shown for apps that are blocked.
|
||||
|
||||
The following shows the AppLocker configuration service provider in tree format.
|
||||
```
|
||||
|
||||
```console
|
||||
./Vendor/MSFT
|
||||
AppLocker
|
||||
----ApplicationLaunchRestrictions
|
||||
@ -258,54 +259,29 @@ Data type is string.
|
||||
|
||||
Supported operations are Get, Add, Delete, and Replace.
|
||||
|
||||
6. On your phone under **Device discovery**, tap **Pair**. You will get a code (case sensitive).
|
||||
7. On the browser on the **Set up access page**, enter the code (case sensitive) into the text box and click **Submit**.
|
||||
1. On your phone under **Device discovery**, tap **Pair**. You will get a code (case sensitive).
|
||||
2. On the browser on the **Set up access page**, enter the code (case sensitive) into the text box and click **Submit**.
|
||||
|
||||
The **Device Portal** page opens on your browser.
|
||||
|
||||
|
||||
|
||||
8. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**.
|
||||
9. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps.
|
||||
3. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**.
|
||||
4. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps.
|
||||
|
||||
|
||||
|
||||
10. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed.
|
||||
5. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed.
|
||||
|
||||
|
||||
|
||||
The following table shows the mapping of information to the AppLocker publisher rule field.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Device portal data</th>
|
||||
<th>AppLocker publisher rule field</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>PackageFullName</p></td>
|
||||
<td><p>ProductName</p>
|
||||
<p>The product name is first part of the PackageFullName followed by the version number. In the Windows Camera example, the ProductName is Microsoft.WindowsCamera.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Publisher</p></td>
|
||||
<td><p>Publisher</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Version</p></td>
|
||||
<td><p>Version</p>
|
||||
<p>This can be used either in the HighSection or LowSection of the BinaryVersionRange.</p>
|
||||
<p>HighSection defines the highest version number and LowSection defines the lowest version number that should be trusted. You can use a wildcard for both versions to make a version- independent rule. Using a wildcard for one of the values will provide higher than or lower than a specific version semantics.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Device portal data|AppLocker publisher rule field|
|
||||
|--- |--- |
|
||||
|PackageFullName|ProductName<br><br> The product name is first part of the PackageFullName followed by the version number. In the Windows Camera example, the ProductName is Microsoft.WindowsCamera.|
|
||||
|Publisher|Publisher|
|
||||
|Version|Version<br> <br>This can be used either in the HighSection or LowSection of the BinaryVersionRange.<br> <br>HighSection defines the highest version number and LowSection defines the lowest version number that should be trusted. You can use a wildcard for both versions to make a version- independent rule. Using a wildcard for one of the values will provide higher than or lower than a specific version semantics.|
|
||||
|
||||
Here is an example AppLocker publisher rule:
|
||||
|
||||
@ -325,21 +301,11 @@ You can get the publisher name and product name of apps using a web API.
|
||||
|
||||
3. In your browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="100%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Request URI</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><code>https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/{app ID}/applockerdata</code></p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
Request URI:
|
||||
|
||||
```http
|
||||
https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/{app ID}/applockerdata
|
||||
```
|
||||
|
||||
Here is the example for Microsoft OneNote:
|
||||
|
||||
@ -360,35 +326,11 @@ Result
|
||||
}
|
||||
```
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Result data</th>
|
||||
<th>AppLocker publisher rule field</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>packageIdentityName</p></td>
|
||||
<td><p>ProductName</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>publisherCertificateName</p></td>
|
||||
<td><p>Publisher</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>windowsPhoneLegacyId</p></td>
|
||||
<td><p>Same value maps to the ProductName and Publisher name</p>
|
||||
<p>This value will only be present if there is a XAP package associated with the app in the Store.</p>
|
||||
<p>If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and another one using the windowsPhoneLegacyId value.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Result data|AppLocker publisher rule field|
|
||||
|--- |--- |
|
||||
|packageIdentityName|ProductName|
|
||||
|publisherCertificateName|Publisher|
|
||||
|windowsPhoneLegacyId|Same value maps to the ProductName and Publisher name. <br> <br> This value will only be present if there is a XAP package associated with the app in the Store. <br> <br>If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and another one using the windowsPhoneLegacyId value.|
|
||||
|
||||
|
||||
## <a href="" id="settingssplashapps"></a>Settings apps that rely on splash apps
|
||||
@ -428,464 +370,96 @@ The following list shows the apps that may be included in the inbox.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>App</th>
|
||||
<th>Product ID</th>
|
||||
<th>Product name</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="even">
|
||||
<td>3D Viewer</td>
|
||||
<td>f41647c9-d567-4378-b2ab-7924e5a152f3</td>
|
||||
<td>Microsoft.Microsoft3DViewer <p>(Added in Windows 10, version 1703)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Advanced info</td>
|
||||
<td>b6e3e590-9fa5-40c0-86ac-ef475de98e88</td>
|
||||
<td>b6e3e590-9fa5-40c0-86ac-ef475de98e88</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Age out worker</td>
|
||||
<td>09296e27-c9f3-4ab9-aa76-ecc4497d94bb</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Alarms and clock</td>
|
||||
<td>44f7d2b4-553d-4bec-a8b7-634ce897ed5f</td>
|
||||
<td>Microsoft.WindowsAlarms</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>App downloads</td>
|
||||
<td>20bf77a0-19c7-4daa-8db5-bc3dfdfa44ac</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Assigned access lock app</td>
|
||||
<td>b84f4722-313e-4f85-8f41-cf5417c9c5cb</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Bing lock images</td>
|
||||
<td>5f28c179-2780-41df-b966-27807b8de02c</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Block and filter</td>
|
||||
<td>59553c14-5701-49a2-9909-264d034deb3d</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Broker plug-in (same as Work or school account)</td>
|
||||
<td></td>
|
||||
<td>Microsoft.AAD.BrokerPlugin</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Calculator</td>
|
||||
<td>b58171c6-c70c-4266-a2e8-8f9c994f4456</td>
|
||||
<td>Microsoft.WindowsCalculator</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Camera</td>
|
||||
<td>f0d8fefd-31cd-43a1-a45a-d0276db069f1</td>
|
||||
<td>Microsoft.WindowsCamera</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>CertInstaller</td>
|
||||
<td>4c4ad968-7100-49de-8cd1-402e198d869e</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Color profile</td>
|
||||
<td>b08997ca-60ab-4dce-b088-f92e9c7994f3</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Connect</td>
|
||||
<td>af7d2801-56c0-4eb1-824b-dd91cdf7ece5</td>
|
||||
<td>Microsoft.DevicesFlow</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Contact Support</td>
|
||||
<td>0db5fcff-4544-458a-b320-e352dfd9ca2b</td>
|
||||
<td>Windows.ContactSupport</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Cortana</td>
|
||||
<td>fd68dcf4-166f-4c55-a4ca-348020f71b94</td>
|
||||
<td>Microsoft.Windows.Cortana</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Cortana Listen UI</td>
|
||||
<td></td>
|
||||
<td>CortanaListenUI</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Credentials Dialog Host</td>
|
||||
<td></td>
|
||||
<td>Microsoft.CredDialogHost</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Device Portal PIN UX</td>
|
||||
<td></td>
|
||||
<td>holopairingapp</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Email and accounts</td>
|
||||
<td>39cf127b-8c67-c149-539a-c02271d07060</td>
|
||||
<td>Microsoft.AccountsControl</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Enterprise installs app</td>
|
||||
<td>da52fa01-ac0f-479d-957f-bfe4595941cb</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Equalizer</td>
|
||||
<td>373cb76e-7f6c-45aa-8633-b00e85c73261</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Excel</td>
|
||||
<td>ead3e7c0-fae6-4603-8699-6a448138f4dc</td>
|
||||
<td>Microsoft.Office.Excel</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Facebook</td>
|
||||
<td>82a23635-5bd9-df11-a844-00237de2db9e</td>
|
||||
<td>Microsoft.MSFacebook</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Field Medic</td>
|
||||
<td>73c58570-d5a7-46f8-b1b2-2a90024fc29c</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>File Explorer</td>
|
||||
<td>c5e2524a-ea46-4f67-841f-6a9465d9d515</td>
|
||||
<td>c5e2524a-ea46-4f67-841f-6a9465d9d515</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>FM Radio</td>
|
||||
<td>f725010e-455d-4c09-ac48-bcdef0d4b626</td>
|
||||
<td>f725010e-455d-4c09-ac48-bcdef0d4b626</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Get Started</td>
|
||||
<td>b3726308-3d74-4a14-a84c-867c8c735c3c</td>
|
||||
<td>Microsoft.Getstarted</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Glance</td>
|
||||
<td>106e0a97-8b19-42cf-8879-a8ed2598fcbb</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Groove Music</td>
|
||||
<td>d2b6a184-da39-4c9a-9e0a-8b589b03dec0</td>
|
||||
<td>Microsoft.ZuneMusic</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Hands-Free Activation</td>
|
||||
<td>df6c9621-e873-4e86-bb56-93e9f21b1d6f</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Hands-Free Activation</td>
|
||||
<td>72803bd5-4f36-41a4-a349-e83e027c4722</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>HAP update background worker</td>
|
||||
<td>73c73cdd-4dea-462c-bd83-fa983056a4ef</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Holographic Shell</td>
|
||||
<td></td>
|
||||
<td>HoloShell</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Lumia motion data</td>
|
||||
<td>8fc25fd2-4e2e-4873-be44-20e57f6ec52b</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Maps</td>
|
||||
<td>ed27a07e-af57-416b-bc0c-2596b622ef7d</td>
|
||||
<td>Microsoft.WindowsMaps</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Messaging</td>
|
||||
<td>27e26f40-e031-48a6-b130-d1f20388991a</td>
|
||||
<td>Microsoft.Messaging</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Microsoft account</td>
|
||||
<td>3a4fae89-7b7e-44b4-867b-f7e2772b8253</td>
|
||||
<td>Microsoft.CloudExperienceHost</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Microsoft Edge</td>
|
||||
<td>395589fb-5884-4709-b9df-f7d558663ffd</td>
|
||||
<td>Microsoft.MicrosoftEdge</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Microsoft Frameworks</td>
|
||||
<td>ProductID = 00000000-0000-0000-0000-000000000000
|
||||
<p>PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"</p></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Migration UI</td>
|
||||
<td></td>
|
||||
<td>MigrationUIApp</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>MiracastView</td>
|
||||
<td>906beeda-b7e6-4ddc-ba8d-ad5031223ef9</td>
|
||||
<td>906beeda-b7e6-4ddc-ba8d-ad5031223ef9</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Mixed Reality Portal</td>
|
||||
<td></td>
|
||||
<td>Microsoft.Windows.HolographicFirstRun</td>
|
||||
<tr class="even">
|
||||
<td>Money</td>
|
||||
<td>1e0440f1-7abf-4b9a-863d-177970eefb5e</td>
|
||||
<td>Microsoft.BingFinance</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Movies and TV</td>
|
||||
<td>6affe59e-0467-4701-851f-7ac026e21665</td>
|
||||
<td>Microsoft.ZuneVideo</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Music downloads</td>
|
||||
<td>3da8a0c1-f7e5-47c0-a680-be8fd013f747</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Navigation bar</td>
|
||||
<td>2cd23676-8f68-4d07-8dd2-e693d4b01279</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Network services</td>
|
||||
<td>62f172d1-f552-4749-871c-2afd1c95c245</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>News</td>
|
||||
<td>9c3e8cad-6702-4842-8f61-b8b33cc9caf1</td>
|
||||
<td>Microsoft.BingNews</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>OneDrive</td>
|
||||
<td>ad543082-80ec-45bb-aa02-ffe7f4182ba8</td>
|
||||
<td>Microsoft.MicrosoftSkydrive</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>OneNote</td>
|
||||
<td>ca05b3ab-f157-450c-8c49-a1f127f5e71d</td>
|
||||
<td>Microsoft.Office.OneNote</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Outlook Calendar and Mail</td>
|
||||
<td>a558feba-85d7-4665-b5d8-a2ff9c19799b</td>
|
||||
<td>Microsoft.WindowsCommunicationsApps</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>People</td>
|
||||
<td>60be1fb8-3291-4b21-bd39-2221ab166481</td>
|
||||
<td>Microsoft.People</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Phone</td>
|
||||
<td>5b04b775-356b-4aa0-aaf8-6491ffea5611</td>
|
||||
<td>5b04b775-356b-4aa0-aaf8-6491ffea5611</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Phone (dialer)</td>
|
||||
<td>f41b5d0e-ee94-4f47-9cfe-3d3934c5a2c7</td>
|
||||
<td>Microsoft.CommsPhone</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Phone reset dialog</td>
|
||||
<td>2864278d-09b5-46f7-b502-1c24139ecbdd</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Photos</td>
|
||||
<td>fca55e1b-b9a4-4289-882f-084ef4145005</td>
|
||||
<td>Microsoft.Windows.Photos</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Podcasts</td>
|
||||
<td>c3215724-b279-4206-8c3e-61d1a9d63ed3</td>
|
||||
<td>Microsoft.MSPodcast</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Podcast downloads</td>
|
||||
<td>063773e7-f26f-4a92-81f0-aa71a1161e30</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>PowerPoint</td>
|
||||
<td>b50483c4-8046-4e1b-81ba-590b24935798</td>
|
||||
<td>Microsoft.Office.PowerPoint</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>PrintDialog</td>
|
||||
<td>0d32eeb1-32f0-40da-8558-cea6fcbec4a4</td>
|
||||
<td>Microsoft.PrintDialog</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Purchase dialog</td>
|
||||
<td>c60e79ca-063b-4e5d-9177-1309357b2c3f</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Rate your device</td>
|
||||
<td>aec3bfad-e38c-4994-9c32-50bd030730ec</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>RingtoneApp.WindowsPhone</td>
|
||||
<td>3e962450-486b-406b-abb5-d38b4ee7e6fe</td>
|
||||
<td>Microsoft.Tonepicker</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Save ringtone</td>
|
||||
<td>d8cf8ec7-ec6d-4892-aab9-1e3a4b5fa24b</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Settings</td>
|
||||
<td>2a4e62d8-8809-4787-89f8-69d0f01654fb</td>
|
||||
<td>2a4e62d8-8809-4787-89f8-69d0f01654fb</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Settings</td>
|
||||
<td></td>
|
||||
<td>SystemSettings</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Setup wizard</td>
|
||||
<td>07d87655-e4f0-474b-895a-773790ad4a32</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Sharing</td>
|
||||
<td>b0894dfd-4671-4bb9-bc17-a8b39947ffb6</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Sign in for Windows 10 Holographic</td>
|
||||
<td></td>
|
||||
<td>WebAuthBridgeInternetSso, WebAuthBridgeInternet, WebAuthBridgeIntranetSso, WebAuthBrokerInternetSso, WebAuthBrokerInternetSso, WebAuthBrokerInternetSso, WebAuthBrokerInternet, WebAuthBrokerIntranetSso, SignIn</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Skype</td>
|
||||
<td>c3f8e570-68b3-4d6a-bdbb-c0a3f4360a51</td>
|
||||
<td>Microsoft.SkypeApp</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Skype Video</td>
|
||||
<td>27e26f40-e031-48a6-b130-d1f20388991a</td>
|
||||
<td>Microsoft.Messaging</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Sports</td>
|
||||
<td>0f4c8c7e-7114-4e1e-a84c-50664db13b17</td>
|
||||
<td>Microsoft.BingSports</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>SSMHost</td>
|
||||
<td>e232aa77-2b6d-442c-b0c3-f3bb9788af2a</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Start</td>
|
||||
<td>5b04b775-356b-4aa0-aaf8-6491ffea5602</td>
|
||||
<td>5b04b775-356b-4aa0-aaf8-6491ffea5602</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Storage</td>
|
||||
<td>5b04b775-356b-4aa0-aaf8-6491ffea564d</td>
|
||||
<td>5b04b775-356b-4aa0-aaf8-6491ffea564d</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Store</td>
|
||||
<td>7d47d89a-7900-47c5-93f2-46eb6d94c159</td>
|
||||
<td>Microsoft.WindowsStore</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Touch (gestures and touch)</td>
|
||||
<td>bbc57c87-46af-4c2c-824e-ac8104cceb38</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Voice recorder</td>
|
||||
<td>7311b9c5-a4e9-4c74-bc3c-55b06ba95ad0</td>
|
||||
<td>Microsoft.WindowsSoundRecorder</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Wallet</td>
|
||||
<td>587a4577-7868-4745-a29e-f996203f1462</td>
|
||||
<td>Microsoft.MicrosoftWallet</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Wallet</td>
|
||||
<td>12ae577e-f8d1-4197-a207-4d24c309ff8f</td>
|
||||
<td>Microsoft.Wallet</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Weather</td>
|
||||
<td>63c2a117-8604-44e7-8cef-df10be3a57c8</td>
|
||||
<td>Microsoft.BingWeather</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Windows default lock screen</td>
|
||||
<td>cdd63e31-9307-4ccb-ab62-1ffa5721b503</td>
|
||||
<td></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Windows Feedback</td>
|
||||
<td>7604089d-d13f-4a2d-9998-33fc02b63ce3</td>
|
||||
<td>Microsoft.WindowsFeedback</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Word</td>
|
||||
<td>258f115c-48f4-4adb-9a68-1387e634459b</td>
|
||||
<td>Microsoft.Office.Word</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Work or school account</td>
|
||||
<td>e5f8b2c4-75ae-45ee-9be8-212e34f77747</td>
|
||||
<td>Microsoft.AAD.BrokerPlugin</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>Xbox</td>
|
||||
<td>b806836f-eebe-41c9-8669-19e243b81b83</td>
|
||||
<td>Microsoft.XboxApp</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>Xbox identity provider</td>
|
||||
<td>ba88225b-059a-45a2-a8eb-d3580283e49d</td>
|
||||
<td>Microsoft.XboxIdentityProvider</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|App|Product ID|Product name|
|
||||
|--- |--- |--- |
|
||||
|3D Viewer|f41647c9-d567-4378-b2ab-7924e5a152f3|Microsoft.Microsoft3DViewer (Added in Windows 10, version 1703)|
|
||||
|Advanced info|b6e3e590-9fa5-40c0-86ac-ef475de98e88|b6e3e590-9fa5-40c0-86ac-ef475de98e88|
|
||||
|Age out worker|09296e27-c9f3-4ab9-aa76-ecc4497d94bb||
|
||||
|Alarms and clock|44f7d2b4-553d-4bec-a8b7-634ce897ed5f|Microsoft.WindowsAlarms|
|
||||
|App downloads|20bf77a0-19c7-4daa-8db5-bc3dfdfa44ac||
|
||||
|Assigned access lock app|b84f4722-313e-4f85-8f41-cf5417c9c5cb||
|
||||
|Bing lock images|5f28c179-2780-41df-b966-27807b8de02c||
|
||||
|Block and filter|59553c14-5701-49a2-9909-264d034deb3d||
|
||||
|Broker plug-in (same as Work or school account)||Microsoft.AAD.BrokerPlugin|
|
||||
|Calculator|b58171c6-c70c-4266-a2e8-8f9c994f4456|Microsoft.WindowsCalculator|
|
||||
|Camera|f0d8fefd-31cd-43a1-a45a-d0276db069f1|Microsoft.WindowsCamera|
|
||||
|CertInstaller|4c4ad968-7100-49de-8cd1-402e198d869e||
|
||||
|Color profile|b08997ca-60ab-4dce-b088-f92e9c7994f3||
|
||||
|Connect|af7d2801-56c0-4eb1-824b-dd91cdf7ece5|Microsoft.DevicesFlow|
|
||||
|Contact Support|0db5fcff-4544-458a-b320-e352dfd9ca2b|Windows.ContactSupport|
|
||||
|Cortana|fd68dcf4-166f-4c55-a4ca-348020f71b94|Microsoft.Windows.Cortana|
|
||||
|Cortana Listen UI||CortanaListenUI|
|
||||
|Credentials Dialog Host||Microsoft.CredDialogHost|
|
||||
|Device Portal PIN UX||holopairingapp|
|
||||
|Email and accounts|39cf127b-8c67-c149-539a-c02271d07060|Microsoft.AccountsControl|
|
||||
|Enterprise installs app|da52fa01-ac0f-479d-957f-bfe4595941cb||
|
||||
|Equalizer|373cb76e-7f6c-45aa-8633-b00e85c73261||
|
||||
|Excel|ead3e7c0-fae6-4603-8699-6a448138f4dc|Microsoft.Office.Excel|
|
||||
|Facebook|82a23635-5bd9-df11-a844-00237de2db9e|Microsoft.MSFacebook|
|
||||
|Field Medic|73c58570-d5a7-46f8-b1b2-2a90024fc29c||
|
||||
|File Explorer|c5e2524a-ea46-4f67-841f-6a9465d9d515|c5e2524a-ea46-4f67-841f-6a9465d9d515|
|
||||
|FM Radio|f725010e-455d-4c09-ac48-bcdef0d4b626|f725010e-455d-4c09-ac48-bcdef0d4b626|
|
||||
|Get Started|b3726308-3d74-4a14-a84c-867c8c735c3c|Microsoft.Getstarted|
|
||||
|Glance|106e0a97-8b19-42cf-8879-a8ed2598fcbb||
|
||||
|Groove Music|d2b6a184-da39-4c9a-9e0a-8b589b03dec0|Microsoft.ZuneMusic|
|
||||
|Hands-Free Activation|df6c9621-e873-4e86-bb56-93e9f21b1d6f||
|
||||
|Hands-Free Activation|72803bd5-4f36-41a4-a349-e83e027c4722||
|
||||
|HAP update background worker|73c73cdd-4dea-462c-bd83-fa983056a4ef||
|
||||
|Holographic Shell||HoloShell|
|
||||
|Lumia motion data|8fc25fd2-4e2e-4873-be44-20e57f6ec52b||
|
||||
|Maps|ed27a07e-af57-416b-bc0c-2596b622ef7d|Microsoft.WindowsMaps|
|
||||
|Messaging|27e26f40-e031-48a6-b130-d1f20388991a|Microsoft.Messaging|
|
||||
|Microsoft account|3a4fae89-7b7e-44b4-867b-f7e2772b8253|Microsoft.CloudExperienceHost|
|
||||
|Microsoft Edge|395589fb-5884-4709-b9df-f7d558663ffd|Microsoft.MicrosoftEdge|
|
||||
|Microsoft Frameworks|ProductID = 00000000-0000-0000-0000-000000000000 PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"||
|
||||
|Migration UI||MigrationUIApp|
|
||||
|MiracastView|906beeda-b7e6-4ddc-ba8d-ad5031223ef9|906beeda-b7e6-4ddc-ba8d-ad5031223ef9|
|
||||
|Mixed Reality Portal||Microsoft.Windows.HolographicFirstRun|
|
||||
|Money|1e0440f1-7abf-4b9a-863d-177970eefb5e|Microsoft.BingFinance|
|
||||
|Movies and TV|6affe59e-0467-4701-851f-7ac026e21665|Microsoft.ZuneVideo|
|
||||
|Music downloads|3da8a0c1-f7e5-47c0-a680-be8fd013f747||
|
||||
|Navigation bar|2cd23676-8f68-4d07-8dd2-e693d4b01279||
|
||||
|Network services|62f172d1-f552-4749-871c-2afd1c95c245||
|
||||
|News|9c3e8cad-6702-4842-8f61-b8b33cc9caf1|Microsoft.BingNews|
|
||||
|OneDrive|ad543082-80ec-45bb-aa02-ffe7f4182ba8|Microsoft.MicrosoftSkydrive|
|
||||
|OneNote|ca05b3ab-f157-450c-8c49-a1f127f5e71d|Microsoft.Office.OneNote|
|
||||
|Outlook Calendar and Mail|a558feba-85d7-4665-b5d8-a2ff9c19799b|Microsoft.WindowsCommunicationsApps|
|
||||
|People|60be1fb8-3291-4b21-bd39-2221ab166481|Microsoft.People|
|
||||
|Phone|5b04b775-356b-4aa0-aaf8-6491ffea5611|5b04b775-356b-4aa0-aaf8-6491ffea5611|
|
||||
|Phone (dialer)|f41b5d0e-ee94-4f47-9cfe-3d3934c5a2c7|Microsoft.CommsPhone|
|
||||
|Phone reset dialog|2864278d-09b5-46f7-b502-1c24139ecbdd||
|
||||
|Photos|fca55e1b-b9a4-4289-882f-084ef4145005|Microsoft.Windows.Photos|
|
||||
|Podcasts|c3215724-b279-4206-8c3e-61d1a9d63ed3|Microsoft.MSPodcast|
|
||||
|Podcast downloads|063773e7-f26f-4a92-81f0-aa71a1161e30||
|
||||
|PowerPoint|b50483c4-8046-4e1b-81ba-590b24935798|Microsoft.Office.PowerPoint|
|
||||
|PrintDialog|0d32eeb1-32f0-40da-8558-cea6fcbec4a4|Microsoft.PrintDialog|
|
||||
|Purchase dialog|c60e79ca-063b-4e5d-9177-1309357b2c3f||
|
||||
|Rate your device|aec3bfad-e38c-4994-9c32-50bd030730ec||
|
||||
|RingtoneApp.WindowsPhone|3e962450-486b-406b-abb5-d38b4ee7e6fe|Microsoft.Tonepicker|
|
||||
|Save ringtone|d8cf8ec7-ec6d-4892-aab9-1e3a4b5fa24b||
|
||||
|Settings|2a4e62d8-8809-4787-89f8-69d0f01654fb|2a4e62d8-8809-4787-89f8-69d0f01654fb|
|
||||
|Settings||SystemSettings|
|
||||
|Setup wizard|07d87655-e4f0-474b-895a-773790ad4a32||
|
||||
|Sharing|b0894dfd-4671-4bb9-bc17-a8b39947ffb6||
|
||||
|Sign in for Windows 10 Holographic||WebAuthBridgeInternetSso, WebAuthBridgeInternet, WebAuthBridgeIntranetSso, WebAuthBrokerInternetSso, WebAuthBrokerInternetSso, WebAuthBrokerInternetSso, WebAuthBrokerInternet, WebAuthBrokerIntranetSso, SignIn|
|
||||
|Skype|c3f8e570-68b3-4d6a-bdbb-c0a3f4360a51|Microsoft.SkypeApp|
|
||||
|Skype Video|27e26f40-e031-48a6-b130-d1f20388991a|Microsoft.Messaging|
|
||||
|Sports|0f4c8c7e-7114-4e1e-a84c-50664db13b17|Microsoft.BingSports|
|
||||
|SSMHost|e232aa77-2b6d-442c-b0c3-f3bb9788af2a||
|
||||
|Start|5b04b775-356b-4aa0-aaf8-6491ffea5602|5b04b775-356b-4aa0-aaf8-6491ffea5602|
|
||||
|Storage|5b04b775-356b-4aa0-aaf8-6491ffea564d|5b04b775-356b-4aa0-aaf8-6491ffea564d|
|
||||
|Store|7d47d89a-7900-47c5-93f2-46eb6d94c159|Microsoft.WindowsStore|
|
||||
|Touch (gestures and touch)|bbc57c87-46af-4c2c-824e-ac8104cceb38||
|
||||
|Voice recorder|7311b9c5-a4e9-4c74-bc3c-55b06ba95ad0|Microsoft.WindowsSoundRecorder|
|
||||
|Wallet|587a4577-7868-4745-a29e-f996203f1462|Microsoft.MicrosoftWallet|
|
||||
|Wallet|12ae577e-f8d1-4197-a207-4d24c309ff8f|Microsoft.Wallet|
|
||||
|Weather|63c2a117-8604-44e7-8cef-df10be3a57c8|Microsoft.BingWeather|
|
||||
|Windows default lock screen|cdd63e31-9307-4ccb-ab62-1ffa5721b503||
|
||||
|Windows Feedback|7604089d-d13f-4a2d-9998-33fc02b63ce3|Microsoft.WindowsFeedback|
|
||||
|Word|258f115c-48f4-4adb-9a68-1387e634459b|Microsoft.Office.Word|
|
||||
|Work or school account|e5f8b2c4-75ae-45ee-9be8-212e34f77747|Microsoft.AAD.BrokerPlugin|
|
||||
|Xbox|b806836f-eebe-41c9-8669-19e243b81b83|Microsoft.XboxApp|
|
||||
|Xbox identity provider|ba88225b-059a-45a2-a8eb-d3580283e49d|Microsoft.XboxIdentityProvider|
|
||||
|
||||
## <a href="" id="allow-list-examples"></a>Allowlist examples
|
||||
|
||||
|
||||
@ -18,62 +18,21 @@ The **Assign seat** operation assigns seat for a specified user in the Microsoft
|
||||
|
||||
## Request
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Method</th>
|
||||
<th>Request URI</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>POST</p></td>
|
||||
<td><p>https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
**POST:**
|
||||
|
||||
```http
|
||||
https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}
|
||||
```
|
||||
|
||||
|
||||
### URI parameters
|
||||
|
||||
The following parameters may be specified in the request URI.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Parameter</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>productId</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Required. Product identifier for an application that is used by the Store for Business.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>skuId</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Required. Product identifier that specifies a specific SKU of an application.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>username</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Requires UserPrincipalName (UPN). User name of the target user account.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Parameter|Type|Description|
|
||||
|--- |--- |--- |
|
||||
|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
|
||||
|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
|
||||
|username|string|Requires UserPrincipalName (UPN). User name of the target user account.|
|
||||
|
||||
## Response
|
||||
|
||||
@ -81,58 +40,9 @@ The following parameters may be specified in the request URI.
|
||||
|
||||
The response body contains [SeatDetails](data-structures-windows-store-for-business.md#seatdetails).
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Error code</th>
|
||||
<th>Description</th>
|
||||
<th>Retry</th>
|
||||
<th>Data field</th>
|
||||
<th>Details</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>400</p></td>
|
||||
<td><p>Invalid parameters</p></td>
|
||||
<td><p>No</p></td>
|
||||
<td><p>Parameter name</p>
|
||||
<p>Reason: Invalid parameter</p>
|
||||
<p>Details: String</p></td>
|
||||
<td><p>Invalid can include productId, skuId or userName</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>404</p></td>
|
||||
<td><p>Not found</p></td>
|
||||
<td></td>
|
||||
<td><p>Item type: Inventory, User, Seat</p>
|
||||
<p>Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName</p></td>
|
||||
<td><p>ItemType: Inventory User Seat</p>
|
||||
<p>Values: ProductId/SkuId UserName ProductId/SkuId/UserName</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>409</p></td>
|
||||
<td><p>Conflict</p></td>
|
||||
<td></td>
|
||||
<td><p>Reason: Not online</p></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|Error code|Description|Retry|Data field|Details|
|
||||
|--- |--- |--- |--- |--- |
|
||||
|400|Invalid parameters|No|Parameter name <br>Reason: Invalid parameter<br>Details: String|Invalid can include productId, skuId or userName|
|
||||
|404|Not found||Item type: Inventory, User, Seat<br> <br>Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName|ItemType: Inventory User Seat<br> <br>Values: ProductId/SkuId UserName ProductId/SkuId/UserName|
|
||||
|409|Conflict||Reason: Not online||
|
||||
|
||||
|
||||
@ -135,7 +135,7 @@ Use the following steps to register a cloud-based MDM application with Azure AD.
|
||||
|
||||
8. Enter the login URL for your MDM service.
|
||||
|
||||
9. For the App ID, enter **https://<your\_tenant\_name>/ContosoMDM**, then select OK.
|
||||
9. For the App ID, enter `https://<your_tenant_name>/ContosoMDM`, then select OK.
|
||||
|
||||
10. While still in the Azure portal, select the **Configure** tab of your application.
|
||||
|
||||
@ -187,40 +187,14 @@ The following image show how MDM applications show up in the Azure app gallery.
|
||||
|
||||
The following table shows the required information to create an entry in the Azure AD app gallery.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Item</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Application ID</strong></p></td>
|
||||
<td><p>The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multi-tenant app.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Publisher</strong></p></td>
|
||||
<td><p>A string that identifies the publisher of the app.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Application URL</strong></p></td>
|
||||
<td><p>A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL isn't used for the actual enrollment.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p><strong>Description</strong></p></td>
|
||||
<td><p>A brief description of your MDM app, which must be under 255 characters.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p><strong>Icons</strong></p></td>
|
||||
<td><p>A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Item|Description|
|
||||
|--- |--- |
|
||||
|**Application ID**|The client ID of your MDM app that is configured within your tenant. This ID is the unique identifier for your multi-tenant app.|
|
||||
|**Publisher**|A string that identifies the publisher of the app.|
|
||||
|**Application URL**|A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL isn't used for the actual enrollment.|
|
||||
|**Description**|A brief description of your MDM app, which must be under 255 characters.|
|
||||
|**Icons**|A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215|
|
||||
|
||||
|
||||
|
||||
### Add on-premises MDM to the app gallery
|
||||
@ -250,42 +224,10 @@ The CSS files provided by Microsoft contain version information and we recommend
|
||||
|
||||
An MDM page must adhere to a predefined theme depending on the scenario that is displayed. For example, if the CXH-HOSTHTTP header is FRX, which is the OOBE scenario, then the page must support a dark theme with blue background color, which uses WinJS file Ui-dark.css ver 4.0 and oobe-desktop.css ver 1.0.4.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
<col width="20%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>CXH-HOST (HTTP HEADER)</th>
|
||||
<th>Scenario</th>
|
||||
<th>Background Theme</th>
|
||||
<th>WinJS</th>
|
||||
<th>Scenario CSS</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td>FRX</td>
|
||||
<td>OOBE</td>
|
||||
<td>Dark theme + blue background color</td>
|
||||
<td>Filename: Ui-dark.css</td>
|
||||
<td>Filename: oobe-dekstop.css</td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>MOSET</td>
|
||||
<td>Settings/
|
||||
<p>Post OOBE</p></td>
|
||||
<td>Light theme</td>
|
||||
<td>Filename: Ui-light.css</td>
|
||||
<td>Filename: settings-desktop.css</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|CXH-HOST (HTTP HEADER)|Scenario|Background Theme|WinJS|Scenario CSS|
|
||||
|--- |--- |--- |--- |--- |
|
||||
|FRX|OOBE|Dark theme + blue background color|Filename: Ui-dark.css|Filename: oobe-dekstop.css|
|
||||
|MOSET|Settings/Post OOBE|Light theme|Filename: Ui-light.css|Filename: settings-desktop.css|
|
||||
|
||||
## Terms of Use protocol semantics
|
||||
|
||||
@ -293,40 +235,16 @@ The Terms of Use endpoint is hosted by the MDM server. During the Azure AD Join
|
||||
|
||||
### Redirect to the Terms of Use endpoint
|
||||
|
||||
This redirect is a full page redirect to the Terms of User endpoint hosted by the MDM. Here's an example URL, https:<span></span>//fabrikam.contosomdm.com/TermsOfUse.
|
||||
This redirect is a full page redirect to the Terms of User endpoint hosted by the MDM. Here's an example URL, `https://fabrikam.contosomdm.com/TermsOfUse`.
|
||||
|
||||
The following parameters are passed in the query string:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Item</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>redirect_uri</p></td>
|
||||
<td><p>After the user accepts or rejects the Terms of Use, the user is redirected to this URL.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>client-request-id</p></td>
|
||||
<td><p>A GUID that is used to correlate logs for diagnostic and debugging purposes. Use this parameter to log or trace the state of the enrollment request to help find the root cause of failures.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>api-version</p></td>
|
||||
<td><p>Specifies the version of the protocol requested by the client. This value provides a mechanism to support version revisions of the protocol.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>mode</p></td>
|
||||
<td><p>Specifies that the device is organization owned when mode=azureadjoin. This parameter isn't present for BYOD devices.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Item|Description|
|
||||
|--- |--- |
|
||||
|redirect_uri|After the user accepts or rejects the Terms of Use, the user is redirected to this URL.|
|
||||
|client-request-id|A GUID that is used to correlate logs for diagnostic and debugging purposes. Use this parameter to log or trace the state of the enrollment request to help find the root cause of failures.|
|
||||
|api-version|Specifies the version of the protocol requested by the client. This value provides a mechanism to support version revisions of the protocol.|
|
||||
|mode|Specifies that the device is organization owned when mode=azureadjoin. This parameter isn't present for BYOD devices.|
|
||||
|
||||
|
||||
### Access token
|
||||
@ -337,37 +255,13 @@ Azure AD issues a bearer access token. The token is passed in the authorization
|
||||
|
||||
The following claims are expected in the access token passed by Windows to the Terms of Use endpoint:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Item</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Object ID</p></td>
|
||||
<td><p>Identifier of the user object corresponding to the authenticated user.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>UPN</p></td>
|
||||
<td><p>A claim containing the user principal name (UPN) of the authenticated user.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>TID</p></td>
|
||||
<td><p>A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Resource</p></td>
|
||||
<td><p>A sanitized URL representing the MDM application. Example, https:<span></span>//fabrikam.contosomdm.com.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<br/>
|
||||
|Item|Description|
|
||||
|--- |--- |
|
||||
|Object ID|Identifier of the user object corresponding to the authenticated user.|
|
||||
|UPN|A claim containing the user principal name (UPN) of the authenticated user.|
|
||||
|TID|A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.|
|
||||
|Resource|A sanitized URL representing the MDM application. Example: `https://fabrikam.contosomdm.com` |
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> There's no device ID claim in the access token because the device may not yet be enrolled at this time.
|
||||
@ -428,184 +322,35 @@ Location: ms-appx-web://App1/ToUResponse?error=access_denied&error_description=A
|
||||
|
||||
The following table shows the error codes.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Cause</th>
|
||||
<th>HTTP status</th>
|
||||
<th>Error</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>api-version</p></td>
|
||||
<td><p>302</p></td>
|
||||
<td><p>invalid_request</p></td>
|
||||
<td><p>unsupported version</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Tenant or user data are missing or other required prerequisites for device enrollment are not met</p></td>
|
||||
<td><p>302</p></td>
|
||||
<td><p>unauthorized_client</p></td>
|
||||
<td><p>unauthorized user or tenant</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Azure AD token validation failed</p></td>
|
||||
<td><p>302</p></td>
|
||||
<td><p>unauthorized_client</p></td>
|
||||
<td><p>unauthorized_client</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>internal service error</p></td>
|
||||
<td><p>302</p></td>
|
||||
<td><p>server_error</p></td>
|
||||
<td><p>internal service error</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Cause|HTTP status|Error|Description|
|
||||
|--- |--- |--- |--- |
|
||||
|api-version|302|invalid_request|unsupported version|
|
||||
|Tenant or user data are missing or other required prerequisites for device enrollment are not met|302|unauthorized_client|unauthorized user or tenant|
|
||||
|Azure AD token validation failed|302|unauthorized_client|unauthorized_client|
|
||||
|internal service error|302|server_error|internal service error|
|
||||
|
||||
|
||||
## Enrollment protocol with Azure AD
|
||||
|
||||
With Azure integrated MDM enrollment, there's no discovery phase and the discovery URL is directly passed down to the system from Azure. The following table shows the comparison between the traditional and Azure enrollments.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Detail</th>
|
||||
<th>Traditional MDM enrollment</th>
|
||||
<th>Azure AD Join (organization-owned device)</th>
|
||||
<th>Azure AD adds a work account (user-owned device)</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>MDM auto-discovery using email address to retrieve MDM discovery URL</p></td>
|
||||
<td><p>Enrollment</p></td>
|
||||
<td><p>Not applicable</p>
|
||||
<p>Discovery URL provisioned in Azure</p></td>
|
||||
<td><p></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Uses MDM discovery URL</p></td>
|
||||
<td><p>Enrollment</p>
|
||||
<p>Enrollment renewal</p>
|
||||
<p>ROBO</p></td>
|
||||
<td><p>Enrollment</p>
|
||||
<p>Enrollment renewal</p>
|
||||
<p>ROBO</p></td>
|
||||
<td><p>Enrollment</p>
|
||||
<p>Enrollment renewal</p>
|
||||
<p>ROBO</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Is MDM enrollment required?</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
<td><p>No</p>
|
||||
<p>User can decline.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Authentication type</p></td>
|
||||
<td><p>OnPremise</p>
|
||||
<p>Federated</p>
|
||||
<p>Certificate</p></td>
|
||||
<td><p>Federated</p></td>
|
||||
<td><p>Federated</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>EnrollmentPolicyServiceURL</p></td>
|
||||
<td><p>Optional (all auth)</p></td>
|
||||
<td><p>Optional (all auth)</p>
|
||||
<p></p></td>
|
||||
<td><p>Optional (all auth)</p>
|
||||
<p></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>EnrollmentServiceURL</p></td>
|
||||
<td><p>Required (all auth)</p></td>
|
||||
<td><p>Used (all auth)</p></td>
|
||||
<td><p>Used (all auth)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL</p></td>
|
||||
<td><p>Highly recommended</p></td>
|
||||
<td><p>Highly recommended</p></td>
|
||||
<td><p>Highly recommended</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>AuthenticationServiceURL used</p></td>
|
||||
<td><p>Used (Federated auth)</p></td>
|
||||
<td><p>Skipped</p></td>
|
||||
<td><p>Skipped</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>BinarySecurityToken</p></td>
|
||||
<td><p>Custom per MDM</p></td>
|
||||
<td><p>Azure AD issued token</p></td>
|
||||
<td><p>Azure AD issued token</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>EnrollmentType</p></td>
|
||||
<td><p>Full</p></td>
|
||||
<td><p>Device</p></td>
|
||||
<td><p>Full</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Enrolled certificate type</p></td>
|
||||
<td><p>User certificate</p></td>
|
||||
<td><p>Device certificate</p></td>
|
||||
<td><p>User certificate</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Enrolled certificate store</p></td>
|
||||
<td><p>My/User</p></td>
|
||||
<td><p>My/System</p></td>
|
||||
<td><p>My/User</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>CSR subject name</p></td>
|
||||
<td><p>User Principal Name</p></td>
|
||||
<td><p>Device ID</p></td>
|
||||
<td><p>User Principal Name</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL</p></td>
|
||||
<td><p>Not supported</p></td>
|
||||
<td><p>Supported</p></td>
|
||||
<td><p>Supported</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>CSPs accessible during enrollment</p></td>
|
||||
<td><p>Windows 10 support:</p>
|
||||
<ul>
|
||||
<li>DMClient</li>
|
||||
<li>CertificateStore</li>
|
||||
<li>RootCATrustedCertificates</li>
|
||||
<li>ClientCertificateInstall</li>
|
||||
<li>EnterpriseModernAppManagement</li>
|
||||
<li>PassportForWork</li>
|
||||
<li>Policy</li>
|
||||
<li>w7 APPLICATION</li>
|
||||
</ul>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Detail|Traditional MDM enrollment|Azure AD Join (organization-owned device)|Azure AD adds a work account (user-owned device)|
|
||||
|--- |--- |--- |--- |
|
||||
|MDM auto-discovery using email address to retrieve MDM discovery URL|Enrollment|Not applicable<br>Discovery URL provisioned in Azure||
|
||||
|Uses MDM discovery URL|Enrollment<br>Enrollment renewal<br>ROBO|Enrollment<br>Enrollment renewal<br>ROBO|Enrollment<br>Enrollment renewal<br>ROBO|
|
||||
|Is MDM enrollment required?|Yes|Yes|No<br>User can decline.|
|
||||
|Authentication type|OnPremise<br>Federated<br>Certificate|Federated|Federated|
|
||||
|EnrollmentPolicyServiceURL|Optional (all auth)|Optional (all auth)|Optional (all auth)|
|
||||
|EnrollmentServiceURL|Required (all auth)|Used (all auth)|Used (all auth)|
|
||||
|EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL|Highly recommended|Highly recommended|Highly recommended|
|
||||
|AuthenticationServiceURL used|Used (Federated auth)|Skipped|Skipped|
|
||||
|BinarySecurityToken|Custom per MDM|Azure AD issued token|Azure AD issued token|
|
||||
|EnrollmentType|Full|Device|Full|
|
||||
|Enrolled certificate type|User certificate|Device certificate|User certificate|
|
||||
|Enrolled certificate store|My/User|My/System|My/User|
|
||||
|CSR subject name|User Principal Name|Device ID|User Principal Name|
|
||||
|EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL|Not supported|Supported|Supported|
|
||||
|CSPs accessible during enrollment|Windows 10 support: <br/>- DMClient <br/>- CertificateStore <br/>- RootCATrustedCertificates <br/> - ClientCertificateInstall <br/>- EnterpriseModernAppManagement <br/> - PassportForWork <br/> - Policy <br/> - w7 APPLICATION|||
|
||||
|
||||
## Management protocol with Azure AD
|
||||
|
||||
@ -737,202 +482,41 @@ When a user is enrolled into MDM through Azure Active Directory Join and then di
|
||||
|
||||
## Error codes
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Code</th>
|
||||
<th>ID</th>
|
||||
<th>Error message</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td>0x80180001</td>
|
||||
<td>"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180002</td>
|
||||
<td>"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180003</td>
|
||||
<td>"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR</td>
|
||||
<td><p>This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180004</td>
|
||||
<td>"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR</td>
|
||||
<td><p>There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180005</td>
|
||||
<td>"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180006</td>
|
||||
<td>"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180007</td>
|
||||
<td>"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180008</td>
|
||||
<td>"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180009</td>
|
||||
<td>"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS</td>
|
||||
<td><p>Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x8018000A</td>
|
||||
<td>"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED</td>
|
||||
<td><p>This device is already enrolled. You can contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x8018000D</td>
|
||||
<td>"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID</td>
|
||||
<td><p>There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x8018000E</td>
|
||||
<td>"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x8018000F</td>
|
||||
<td>"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180010</td>
|
||||
<td>"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180012</td>
|
||||
<td>"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT</td>
|
||||
<td><p>There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180013</td>
|
||||
<td>"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED</td>
|
||||
<td><p>Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180014</td>
|
||||
<td>"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED</td>
|
||||
<td><p>This feature isn't supported. Contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180015</td>
|
||||
<td>"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED</td>
|
||||
<td><p>This feature isn't supported. Contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180016</td>
|
||||
<td>"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW</td>
|
||||
<td><p>The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180017</td>
|
||||
<td>"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE</td>
|
||||
<td><p>The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x80180018</td>
|
||||
<td>"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE</td>
|
||||
<td><p>There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x80180019</td>
|
||||
<td>"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID</td>
|
||||
<td><p>Looks like the server isn't correctly configured. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>"rejectedTermsOfUse"</td>
|
||||
<td>"idErrorRejectedTermsOfUse"</td>
|
||||
<td><p>Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c0001</td>
|
||||
<td>"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x801c0002</td>
|
||||
<td>"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c0003</td>
|
||||
<td>"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR</td>
|
||||
<td><p>This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x801c0006</td>
|
||||
<td>"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c000B</td>
|
||||
<td>"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED</td>
|
||||
<td>The server being contacted isn't trusted. Contact your system administrator with the error code {0}.</td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x801c000C</td>
|
||||
<td>"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c000E</td>
|
||||
<td>"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED</td>
|
||||
<td><p>Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x801c000F</td>
|
||||
<td>"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT</td>
|
||||
<td><p>A reboot is required to complete device registration.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c0010</td>
|
||||
<td>"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR</td>
|
||||
<td><p>Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x801c0011</td>
|
||||
<td>"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c0012</td>
|
||||
<td>"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR</td>
|
||||
<td><p>There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td>0x801c0013</td>
|
||||
<td>"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td>0x801c0014</td>
|
||||
<td>"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND</td>
|
||||
<td><p>There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|Code|ID|Error message|
|
||||
|--- |--- |--- |
|
||||
|0x80180001|"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x80180002|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180003|"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180004|"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180005|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x80180006|"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x80180007|"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180008|"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x80180009|"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS|Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x8018000A|"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED|This device is already enrolled. You can contact your system administrator with the error code {0}.|
|
||||
|0x8018000D|"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x8018000E|"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x8018000F|"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180010|"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x80180012|"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT|There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180013|"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.|
|
||||
|0x80180014|"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.|
|
||||
|0x80180015|"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED|This feature isn't supported. Contact your system administrator with the error code {0}.|
|
||||
|0x80180016|"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW|The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180017|"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE|The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.|
|
||||
|0x80180018|"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE|There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x80180019|"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID|Looks like the server isn't correctly configured. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|"rejectedTermsOfUse"|"idErrorRejectedTermsOfUse"|Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.|
|
||||
|0x801c0001|"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x801c0002|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x801c0003|"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR|This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x801c0006|"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x801c000B|"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED|The server being contacted isn't trusted. Contact your system administrator with the error code {0}.|
|
||||
|0x801c000C|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x801c000E|"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED|Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.|
|
||||
|0x801c000F|"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT|A reboot is required to complete device registration.|
|
||||
|0x801c0010|"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR|Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.|
|
||||
|0x801c0011|"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x801c0012|"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR|There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}|
|
||||
|0x801c0013|"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|0x801c0014|"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND|There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.|
|
||||
|
||||
@ -17,14 +17,15 @@ ms.date: 06/26/2017
|
||||
|
||||
The BrowserFavorite configuration service provider is used to add and remove URLs from the favorites list on a device.
|
||||
|
||||
> **Note** BrowserFavorite CSP is only supported in Windows Phone 8.1.
|
||||
> [!Note]
|
||||
> BrowserFavorite CSP is only supported in Windows Phone 8.1.
|
||||
|
||||
|
||||
|
||||
The BrowserFavorite configuration service provider manages only the favorites at the root favorite folder level. It does not manage subfolders under the root favorite folder nor does it manage favorites under a subfolder.
|
||||
|
||||
> **Note**
|
||||
This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_INTERNET\_EXPLORER\_FAVORITES capabilities to be accessed from a network configuration application.
|
||||
> [!Note]
|
||||
> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_INTERNET\_EXPLORER\_FAVORITES capabilities to be accessed from a network configuration application.
|
||||
|
||||
|
||||
|
||||
@ -39,7 +40,8 @@ favorite name
|
||||
<a href="" id="favorite-name-------------"></a>***favorite name***
|
||||
Required. Specifies the user-friendly name of the favorite URL that is displayed in the Favorites list of Internet Explorer.
|
||||
|
||||
> **Note** The *favorite name* should contain only characters that are valid in the Windows file system. The invalid characters are: \\ / : \* ? " < > |
|
||||
> [!Note]
|
||||
> The *favorite name* should contain only characters that are valid in the Windows file system. The invalid characters are: \\ / : \* ? " < > |
|
||||
|
||||
|
||||
|
||||
@ -69,40 +71,12 @@ Adding a new browser favorite.
|
||||
|
||||
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Elements</th>
|
||||
<th>Available</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Parm-query</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Noparm</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Nocharacteristic</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Characteristic-query</p></td>
|
||||
<td><p>Yes</p>
|
||||
<p>Recursive query: Yes</p>
|
||||
<p>Top-level query: Yes</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Elements|Available|
|
||||
|--- |--- |
|
||||
|Parm-query|Yes|
|
||||
|Noparm|Yes|
|
||||
|Nocharacteristic|Yes|
|
||||
|Characteristic-query|Yes<br> <br>Recursive query: Yes<br> <br>Top-level query: Yes|
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -18,66 +18,22 @@ The **Bulk assign and reclaim seats from users** operation returns reclaimed or
|
||||
|
||||
## Request
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Method</th>
|
||||
<th>Request URI</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>POST</p></td>
|
||||
<td><p>https:<span></span>//bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
**POST**:
|
||||
|
||||
```http
|
||||
https:<span></span>//bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats
|
||||
```
|
||||
|
||||
### URI parameters
|
||||
|
||||
The following parameters may be specified in the request URI.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
<col width="33%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Parameter</th>
|
||||
<th>Type</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>productId</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Required. Product identifier for an application that is used by the Store for Business.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>skuId</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Required. Product identifier that specifies a specific SKU of an application.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>username</p></td>
|
||||
<td><p>string</p></td>
|
||||
<td><p>Requires UserPrincipalName (UPN). User name of the target user account.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>seatAction</p></td>
|
||||
<td><p><a href="data-structures-windows-store-for-business.md#seataction" data-raw-source="[SeatAction](data-structures-windows-store-for-business.md#seataction)">SeatAction</a></p></td>
|
||||
<td></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Parameter|Type|Description|
|
||||
|--- |--- |--- |
|
||||
|productId|string|Required. Product identifier for an application that is used by the Store for Business.|
|
||||
|skuId|string|Required. Product identifier that specifies a specific SKU of an application.|
|
||||
|username|string|Requires UserPrincipalName (UPN). User name of the target user account.|
|
||||
|seatAction|[SeatAction](data-structures-windows-store-for-business.md#seataction) ||
|
||||
|
||||
|
||||
## Response
|
||||
@ -86,37 +42,8 @@ The following parameters may be specified in the request URI.
|
||||
|
||||
The response body contains [BulkSeatOperationResultSet](data-structures-windows-store-for-business.md#bulkseatoperationresultset).
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
<col width="25%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Error code</th>
|
||||
<th>Description</th>
|
||||
<th>Retry</th>
|
||||
<th>Data field</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>404</p></td>
|
||||
<td><p>Not found</p></td>
|
||||
<td></td>
|
||||
<td><p>Item type: Inventory</p>
|
||||
<p>Values: ProductId/SkuId</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|Error code|Description|Retry|Data field|
|
||||
|--- |--- |--- |--- |
|
||||
|404|Not found||Item type: Inventory<br> Values: ProductId/SkuId|
|
||||
|
||||
|
||||
|
||||
@ -30,32 +30,11 @@ CellularSettings
|
||||
<a href="" id="dataroam"></a>**DataRoam**
|
||||
<p> Optional. Integer. Specifies the default roaming value. Valid values are:</p>
|
||||
|
||||
<table><table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Value</th>
|
||||
<th>Setting</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>0</p></td>
|
||||
<td><p>Don’t roam</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>1</p></td>
|
||||
<td><p>Don’t roam (or Domestic roaming if applicable)</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>2</p></td>
|
||||
<td><p>Roam</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Value|Setting|
|
||||
|--- |--- |
|
||||
|0|Don’t roam|
|
||||
|1|Don’t roam (or Domestic roaming if applicable)|
|
||||
|2|Roam|
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -70,38 +70,14 @@ CM_CellularEntries
|
||||
<a href="" id="connectiontype"></a>**ConnectionType**
|
||||
<p>Optional. Type: String. Specifies the type of connection used for the APN. The following connection types are available:
|
||||
|
||||
<table><table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Gprs</p></td>
|
||||
<td><p>Default. Used for GPRS type connections (GPRS + GSM + EDGE + UMTS + LTE).</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Cdma</p></td>
|
||||
<td><p>Used for CDMA type connections (1XRTT + EVDO).</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Lte</p></td>
|
||||
<td><p>Used for LTE type connections (eHRPD + LTE) when the device is registered HOME.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Legacy</p></td>
|
||||
<td><p>Used for GPRS + GSM + EDGE + UMTS connections.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Lte_iwlan</p></td>
|
||||
<td><p>Used for GPRS type connections that may be offloaded over WiFi</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Iwlan</p></td>
|
||||
<td><p>Used for connections that are implemented over WiFi offload only</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Connection type|Usage|
|
||||
|--- |--- |
|
||||
|Gprs|Default. Used for GPRS type connections (GPRS + GSM + EDGE + UMTS + LTE).|
|
||||
|Cdma|Used for CDMA type connections (1XRTT + EVDO).|
|
||||
|Lte|Used for LTE type connections (eHRPD + LTE) when the device is registered HOME.|
|
||||
|Legacy|Used for GPRS + GSM + EDGE + UMTS connections.|
|
||||
|Lte_iwlan|Used for GPRS type connections that may be offloaded over WiFi|
|
||||
|Iwlan|Used for connections that are implemented over WiFi offload only|
|
||||
|
||||
|
||||
|
||||
@ -295,36 +271,13 @@ Configuring a CDMA connection:
|
||||
|
||||
## Microsoft Custom Elements
|
||||
|
||||
|
||||
The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Element</th>
|
||||
<th>Available</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Nocharacteristic</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Characteristic-query</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Parm-query</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Element|Available|
|
||||
|--- |--- |
|
||||
|Nocharacteristic|Yes|
|
||||
|Characteristic-query|Yes|
|
||||
|Parm-query|Yes|
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -29,7 +29,7 @@ Each policy entry identifies one or more applications in combination with a host
|
||||
|
||||
The following shows the CMPolicy configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management.
|
||||
|
||||
```
|
||||
```console
|
||||
./Vendor/MSFT
|
||||
CMPolicy
|
||||
----PolicyName
|
||||
@ -42,6 +42,7 @@ CMPolicy
|
||||
----------------ConnectionID
|
||||
----------------Type
|
||||
```
|
||||
|
||||
<a href="" id="policyname"></a>***policyName***
|
||||
Defines the name of the policy.
|
||||
|
||||
@ -83,154 +84,44 @@ For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you hav
|
||||
|
||||
For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Connection type</th>
|
||||
<th>GUID</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>GSM</p></td>
|
||||
<td><p>{A05DC613-E393-40ad-AA89-CCCE04277CD9}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>CDMA</p></td>
|
||||
<td><p>{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Legacy 3GPP</p></td>
|
||||
<td><p>{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>LTE</p></td>
|
||||
<td><p>{2378E547-8312-46A5-905E-5C581E92693B}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Wi-Fi</p></td>
|
||||
<td><p>{8568B401-858E-4B7B-B3DF-0FD4927F131B}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Wi-Fi hotspot</p></td>
|
||||
<td><p>{072FC7DC-1D93-40D1-9BB0-2114D7D73434}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Connection type|GUID|
|
||||
|--- |--- |
|
||||
|GSM|{A05DC613-E393-40ad-AA89-CCCE04277CD9}|
|
||||
|CDMA|{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}|
|
||||
|Legacy 3GPP|{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}|
|
||||
|LTE|{2378E547-8312-46A5-905E-5C581E92693B}|
|
||||
|Wi-Fi|{8568B401-858E-4B7B-B3DF-0FD4927F131B}|
|
||||
|Wi-Fi hotspot|{072FC7DC-1D93-40D1-9BB0-2114D7D73434}|
|
||||
|
||||
|
||||
For `CMST_CONNECTION_NETWORK_TYPE`, specify the GUID for the desired network type. The curly brackets {} around the GUID are required. The following network types are available:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Network type</th>
|
||||
<th>GUID</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>GPRS</p></td>
|
||||
<td><p>{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>1XRTT</p></td>
|
||||
<td><p>{B1E700AE-A62F-49FF-9BBE-B880C995F27D}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>EDGE</p></td>
|
||||
<td><p>{C347F8EC-7095-423D-B838-7C7A7F38CD03}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>WCDMA UMTS</p></td>
|
||||
<td><p>{A72F04C6-9BE6-4151-B5EF-15A53E12C482}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>WCDMA FOMA</p></td>
|
||||
<td><p>{B8326098-F845-42F3-804E-8CC3FF7B50B4}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>1XEVDO</p></td>
|
||||
<td><p>{DD42DF39-EBDF-407C-8146-1685416401B2}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>1XEVDV</p></td>
|
||||
<td><p>{61BF1BFD-5218-4CD4-949C-241CA3F326F6}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>HSPA HSDPA</p></td>
|
||||
<td><p>{047F7282-BABD-4893-AA77-B8B312657F8C}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>HSPA HSUPA</p></td>
|
||||
<td><p>{1536A1C6-A4AF-423C-8884-6BDDA3656F84}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>LTE</p></td>
|
||||
<td><p>{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>EHRPD</p></td>
|
||||
<td><p>{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Ethernet 10 Mbps</p></td>
|
||||
<td><p>{97D3D1B3-854A-4C32-BD1C-C13069078370}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Ethernet 100 Mbps</p></td>
|
||||
<td><p>{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Ethernet Gbps</p></td>
|
||||
<td><p>{556C1E6B-B8D4-448E-836D-9451BA4CCE75}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|Network type|GUID|
|
||||
|--- |--- |
|
||||
|GPRS|{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}|
|
||||
|1XRTT|{B1E700AE-A62F-49FF-9BBE-B880C995F27D}|
|
||||
|EDGE|{C347F8EC-7095-423D-B838-7C7A7F38CD03}|
|
||||
|WCDMA UMTS|{A72F04C6-9BE6-4151-B5EF-15A53E12C482}|
|
||||
|WCDMA FOMA|{B8326098-F845-42F3-804E-8CC3FF7B50B4}|
|
||||
|1XEVDO|{DD42DF39-EBDF-407C-8146-1685416401B2}|
|
||||
|1XEVDV|{61BF1BFD-5218-4CD4-949C-241CA3F326F6}|
|
||||
|HSPA HSDPA|{047F7282-BABD-4893-AA77-B8B312657F8C}|
|
||||
|HSPA HSUPA|{1536A1C6-A4AF-423C-8884-6BDDA3656F84}|
|
||||
|LTE|{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}|
|
||||
|EHRPD|{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}|
|
||||
|Ethernet 10 Mbps|{97D3D1B3-854A-4C32-BD1C-C13069078370}|
|
||||
|Ethernet 100 Mbps|{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}|
|
||||
|Ethernet Gbps|{556C1E6B-B8D4-448E-836D-9451BA4CCE75}|
|
||||
|
||||
|
||||
For `CMST_CONNECTION_DEVICE_TYPE`, specify the GUID for the desired device type. The curly brackets {} around the GUID are required. The following device types are available:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="20%" />
|
||||
<col width="80%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Device type</th>
|
||||
<th>GUID</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Cellular device</p></td>
|
||||
<td><p>{F9A53167-4016-4198-9B41-86D9522DC019}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Ethernet</p></td>
|
||||
<td><p>{97844272-00C7-4572-B20A-D8D861C095F2}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Bluetooth</p></td>
|
||||
<td><p>{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Virtual</p></td>
|
||||
<td><p>{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Device type|GUID|
|
||||
|--- |--- |
|
||||
|Cellular device|{F9A53167-4016-4198-9B41-86D9522DC019}|
|
||||
|Ethernet|{97844272-00C7-4572-B20A-D8D861C095F2}|
|
||||
|Bluetooth|{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}|
|
||||
|Virtual|{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}|
|
||||
|
||||
|
||||
|
||||
@ -479,36 +370,11 @@ Adding a host-based mapping policy:
|
||||
## Microsoft Custom Elements
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Element</th>
|
||||
<th>Available</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>parm-query</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>uncharacteristic</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>characteristic-query</p></td>
|
||||
<td><p>Yes</p>
|
||||
<p>Recursive query: Yes</p>
|
||||
<p>Top-level query: Yes</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Element|Available|
|
||||
|--- |--- |
|
||||
|parm-query|Yes|
|
||||
|uncharacteristic|Yes|
|
||||
|characteristic-query|Yes<br> <br>Recursive query: Yes<br> <br>Top-level query: Yes|
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -29,7 +29,8 @@ Each policy entry identifies one or more applications in combination with a host
|
||||
**Default Policies**: Policies are applied in order of their scope with the most specific policies considered before the more general policies. The phone’s default behavior applies to all applications and all domains and is only used when no other, more specific policy is available. The default policy is to use any available Wi-Fi network first and then any available APN.
|
||||
|
||||
The following shows the CMPolicyEnterprise configuration service provider management object in tree format as used by both Open Mobile Alliance (OMA) Client Provisioning and OMA Device Management.
|
||||
```
|
||||
|
||||
```console
|
||||
./Vendor/MSFT
|
||||
CMPolicy
|
||||
----PolicyName
|
||||
@ -83,156 +84,44 @@ For `CMST_CONNECTION_NAME`, specify the connection name. For example, if you hav
|
||||
|
||||
For `CMST_CONNECTION_TYPE`, specify the GUID for the desired connection type. The curly brackets {} around the GUID are required. The following connection types are available:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Connection type</th>
|
||||
<th>GUID</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>GSM</p></td>
|
||||
<td><p>{A05DC613-E393-40ad-AA89-CCCE04277CD9}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>CDMA</p></td>
|
||||
<td><p>{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Legacy 3GPP</p></td>
|
||||
<td><p>{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>LTE</p></td>
|
||||
<td><p>{2378E547-8312-46A5-905E-5C581E92693B}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Wi-Fi</p></td>
|
||||
<td><p>{8568B401-858E-4B7B-B3DF-0FD4927F131B}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Wi-Fi hotspot</p></td>
|
||||
<td><p>{072FC7DC-1D93-40D1-9BB0-2114D7D73434}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|Connection type|GUID|
|
||||
|--- |--- |
|
||||
|GSM|{A05DC613-E393-40ad-AA89-CCCE04277CD9}|
|
||||
|CDMA|{274AD55A-4A70-4E35-93B3-AE2D2E6727FC}|
|
||||
|Legacy 3GPP|{6DE4C04B-B74E-47FA-99E5-8F2097C06A92}|
|
||||
|LTE|{2378E547-8312-46A5-905E-5C581E92693B}|
|
||||
|Wi-Fi|{8568B401-858E-4B7B-B3DF-0FD4927F131B}|
|
||||
|Wi-Fi hotspot|{072FC7DC-1D93-40D1-9BB0-2114D7D73434}|
|
||||
|
||||
|
||||
|
||||
For `CMST_CONNECTION_NETWORK_TYPE`, specify the GUID for the desired network type. The curly brackets {} around the GUID are required. The following network types are available:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Network type</th>
|
||||
<th>GUID</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>GPRS</p></td>
|
||||
<td><p>{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>1XRTT</p></td>
|
||||
<td><p>{B1E700AE-A62F-49FF-9BBE-B880C995F27D}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>EDGE</p></td>
|
||||
<td><p>{C347F8EC-7095-423D-B838-7C7A7F38CD03}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>WCDMA UMTS</p></td>
|
||||
<td><p>{A72F04C6-9BE6-4151-B5EF-15A53E12C482}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>WCDMA FOMA</p></td>
|
||||
<td><p>{B8326098-F845-42F3-804E-8CC3FF7B50B4}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>1XEVDO</p></td>
|
||||
<td><p>{DD42DF39-EBDF-407C-8146-1685416401B2}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>1XEVDV</p></td>
|
||||
<td><p>{61BF1BFD-5218-4CD4-949C-241CA3F326F6}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>HSPA HSDPA</p></td>
|
||||
<td><p>{047F7282-BABD-4893-AA77-B8B312657F8C}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>HSPA HSUPA</p></td>
|
||||
<td><p>{1536A1C6-A4AF-423C-8884-6BDDA3656F84}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>LTE</p></td>
|
||||
<td><p>{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>EHRPD</p></td>
|
||||
<td><p>{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Ethernet 10Mbps</p></td>
|
||||
<td><p>{97D3D1B3-854A-4C32-BD1C-C13069078370}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Ethernet 100Mbps</p></td>
|
||||
<td><p>{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Ethernet Gbps</p></td>
|
||||
<td><p>{556C1E6B-B8D4-448E-836D-9451BA4CCE75}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Network type|GUID|
|
||||
|--- |--- |
|
||||
|GPRS|{AFB7D659-FC1F-4EA5-BDD0-0FDA62676D96}|
|
||||
|1XRTT|{B1E700AE-A62F-49FF-9BBE-B880C995F27D}|
|
||||
|EDGE|{C347F8EC-7095-423D-B838-7C7A7F38CD03}|
|
||||
|WCDMA UMTS|{A72F04C6-9BE6-4151-B5EF-15A53E12C482}|
|
||||
|WCDMA FOMA|{B8326098-F845-42F3-804E-8CC3FF7B50B4}|
|
||||
|1XEVDO|{DD42DF39-EBDF-407C-8146-1685416401B2}|
|
||||
|1XEVDV|{61BF1BFD-5218-4CD4-949C-241CA3F326F6}|
|
||||
|HSPA HSDPA|{047F7282-BABD-4893-AA77-B8B312657F8C}|
|
||||
|HSPA HSUPA|{1536A1C6-A4AF-423C-8884-6BDDA3656F84}|
|
||||
|LTE|{B41CBF43-6994-46FF-9C2F-D6CA6D45889B}|
|
||||
|EHRPD|{7CFA04A5-0F3F-445C-88A4-C86ED2AD94EA}|
|
||||
|Ethernet 10Mbps|{97D3D1B3-854A-4C32-BD1C-C13069078370}|
|
||||
|Ethernet 100Mbps|{A8F4FE66-8D04-43F5-9DD2-2A85BD21029B}|
|
||||
|Ethernet Gbps|{556C1E6B-B8D4-448E-836D-9451BA4CCE75}|
|
||||
|
||||
For `CMST_CONNECTION_DEVICE_TYPE`, specify the GUID for the desired device type. The curly brackets {} around the GUID are required. The following device types are available:
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Device type</th>
|
||||
<th>GUID</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Cellular device</p></td>
|
||||
<td><p>{F9A53167-4016-4198-9B41-86D9522DC019}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Ethernet</p></td>
|
||||
<td><p>{97844272-00C7-4572-B20A-D8D861C095F2}</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>Bluetooth</p></td>
|
||||
<td><p>{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Virtual</p></td>
|
||||
<td><p>{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Device type|GUID|
|
||||
|--- |--- |
|
||||
|Cellular device|{F9A53167-4016-4198-9B41-86D9522DC019}|
|
||||
|Ethernet|{97844272-00C7-4572-B20A-D8D861C095F2}|
|
||||
|Bluetooth|{1D793123-701A-4fd0-B6AE-9C3C57E99C2C}|
|
||||
|Virtual|{EAA02CE5-9C70-4E87-97FE-55C9DEC847D4}|
|
||||
|
||||
<a href="" id="type"></a>**Type**
|
||||
Specifies the type of connection being referenced. The following list describes the available connection types:
|
||||
@ -479,36 +368,11 @@ Adding a host-based mapping policy:
|
||||
## Microsoft Custom Elements
|
||||
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
<col width="50%" />
|
||||
<col width="50%" />
|
||||
</colgroup>
|
||||
<thead>
|
||||
<tr class="header">
|
||||
<th>Element</th>
|
||||
<th>Available</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>parm-query</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>nocharacteristic</p></td>
|
||||
<td><p>Yes</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td><p>characteristic-query</p></td>
|
||||
<td><p>Yes</p>
|
||||
<p>Recursive query: Yes</p>
|
||||
<p>Top level query: Yes</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
|
||||
|Element|Available|
|
||||
|--- |--- |
|
||||
|parm-query|Yes|
|
||||
|nocharacteristic|Yes|
|
||||
|characteristic-query|Yes<br> <br>Recursive query: Yes<br> <br>Top level query: Yes|
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -19,13 +19,13 @@ Use these settings to configure the Account Manager service.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DeletionPolicy](#deletionpolicy) | | | | ✔️ | |
|
||||
| [EnableProfileManager](#enableprofilemanager) | | | | ✔️ | |
|
||||
| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | | ✔️ | |
|
||||
| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | | ✔️ | |
|
||||
| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | | ✔️ | |
|
||||
| Settings | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [DeletionPolicy](#deletionpolicy) | | | ✔️ | |
|
||||
| [EnableProfileManager](#enableprofilemanager) | | | ✔️ | |
|
||||
| [ProfileInactivityThreshold](#profileinactivitythreshold) | | | ✔️ | |
|
||||
| [StorageCapacityStartDeletion](#storagecapacitystartdeletion) | | | ✔️ | |
|
||||
| [StorageCapacityStopDeletion](#storagecapacitystopdeletion) | | | ✔️ | |
|
||||
|
||||
>[!NOTE]
|
||||
>Although the AccountManagement settings are available in advanced provisioning for other editions, you should only use them for HoloLens devices.
|
||||
|
||||
@ -19,7 +19,7 @@ Use these settings to join a device to an Active Directory domain or an Azure Ac
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [Azure](#azure) | ✔️ | ✔️ | ✔️ | |
|
||||
| [ComputerAccount](#computeraccount) | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
@ -26,10 +26,10 @@ Starting in Windows 10, version 1703, you can import (*ingest*) select Group Pol
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | | |
|
||||
| [ConfigOperations](#configoperations) | ✔️ | | | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [ConfigADMXInstalledPolicy](#configadmxinstalledpolicy) | ✔️ | | | |
|
||||
| [ConfigOperations](#configoperations) | ✔️ | | | |
|
||||
|
||||
## ConfigADMXInstalledPolicy
|
||||
|
||||
|
||||
@ -19,10 +19,10 @@ Use this setting to configure single use (kiosk) devices.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | | ✔️ | |
|
||||
| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | | ✔️ | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [AssignedAccessSettings](#assignedaccesssettings) | ✔️ | | ✔️ | |
|
||||
| [MultiAppAssignedAccessSettings](#multiappassignedaccesssettings) | ✔️ | | ✔️ | |
|
||||
|
||||
|
||||
## AssignedAccessSettings
|
||||
|
||||
@ -19,13 +19,13 @@ Use to configure browser settings that should only be set by OEMs who are part o
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowPrelaunch](#allowprelaunch) | | | ✔️ | | |
|
||||
| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | | |
|
||||
| [Favorites](#favorites) | | ✔️ | | | |
|
||||
| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [SearchProviders](#searchproviders) | | ✔️ | | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowPrelaunch](#allowprelaunch) | | ✔️ | | |
|
||||
| [FavoriteBarItems](#favoritebaritems) | ✔️ | | | |
|
||||
| [Favorites](#favorites) | | | | |
|
||||
| [PartnerSearchCode](#partnersearchcode) | ✔️ | ✔️ | | |
|
||||
| [SearchProviders](#searchproviders) | | | | |
|
||||
|
||||
|
||||
## AllowPrelaunch
|
||||
|
||||
@ -24,26 +24,26 @@ Use to configure settings for cellular data.
|
||||
|
||||
## Applies to
|
||||
|
||||
Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core
|
||||
--- | :---: | :---: | :---: | :---: | :---:
|
||||
PerDevice: [CellConfigurations](#cellconfigurations) | | ✔️ | | | |
|
||||
PerDevice: [CellData](#celldata) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [CGDual](#cgdual) | | ✔️ | | |
|
||||
PerDevice: [eSim](#esim) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [External](#external) | | ✔️ | | |
|
||||
PerDevice: [General](#general) | | ✔️ | | |
|
||||
PerDevice: [RCS](#rcs) | | ✔️ | | |
|
||||
PerDevice: [SMS](#sms) | ✔️ | ✔️ | ✔️ | |
|
||||
PerDevice: [UIX](#uix) | | ✔️ | | |
|
||||
PerDevice: [UTK](#utk) | | ✔️ | | |
|
||||
PerlMSI: [CellData](#celldata2) | | ✔️ | | |
|
||||
PerIMSI: [CellUX](#cellux2) | | ✔️ | | |
|
||||
PerIMSI: [General](#general2) | | ✔️ | | |
|
||||
PerIMSI: [RCS](#rcs2) | | ✔️ | | |
|
||||
PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | ✔️ | |
|
||||
PerIMSI: [UTK](#utk2) | | ✔️ | | |
|
||||
PerIMSI: [VoLTE](#volte) | | ✔️ | | |
|
||||
Setting groups | Windows client | Surface Hub | HoloLens | IoT Core
|
||||
--- | :---: | :---: | :---: | :---:
|
||||
PerDevice: [CellConfigurations](#cellconfigurations) | | | | |
|
||||
PerDevice: [CellData](#celldata) | ✔️ | ✔️ | |
|
||||
PerDevice: [CellUX](#cellux) | ✔️ | ✔️ | |
|
||||
PerDevice: [CGDual](#cgdual) | | | |
|
||||
PerDevice: [eSim](#esim) | ✔️ | ✔️ | |
|
||||
PerDevice: [External](#external) | | | |
|
||||
PerDevice: [General](#general) | | | |
|
||||
PerDevice: [RCS](#rcs) | | | |
|
||||
PerDevice: [SMS](#sms) | ✔️ | ✔️ | |
|
||||
PerDevice: [UIX](#uix) | | | |
|
||||
PerDevice: [UTK](#utk) | | | |
|
||||
PerlMSI: [CellData](#celldata2) | | | |
|
||||
PerIMSI: [CellUX](#cellux2) | | | |
|
||||
PerIMSI: [General](#general2) | | | |
|
||||
PerIMSI: [RCS](#rcs2) | | | |
|
||||
PerIMSI: [SMS](#sms2) | ✔️ | ✔️ | |
|
||||
PerIMSI: [UTK](#utk2) | | | |
|
||||
PerIMSI: [VoLTE](#volte) | | | |
|
||||
|
||||
|
||||
## PerDevice
|
||||
|
||||
@ -21,9 +21,9 @@ Use to configure settings for cellular connections.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
## PerDevice
|
||||
|
||||
|
||||
@ -25,9 +25,9 @@ Use to deploy Root Certificate Authority (CA) certificates to devices. The follo
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All setting groups | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
|
||||
## CACertificates
|
||||
|
||||
@ -19,10 +19,10 @@ Use to remove user-installed and pre-installed applications, with the option to
|
||||
|
||||
## Applies to
|
||||
|
||||
| Settings | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| CleanPCRetainingUserData | ✔️ | | | | |
|
||||
| CleanPCWithoutRetainingUserData | ✔️ | | | | |
|
||||
| Settings | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| CleanPCRetainingUserData | ✔️ | | | |
|
||||
| CleanPCWithoutRetainingUserData | ✔️ | | | |
|
||||
|
||||
For each setting, the options are **Enable** and **Not configured**.
|
||||
|
||||
|
||||
@ -19,9 +19,9 @@ Use to configure settings related to various types of phone connections.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
For each setting group:
|
||||
|
||||
@ -19,14 +19,14 @@ Use to configure profiles that a user will connect with, such as an email accoun
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Email](#email) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [Exchange](#exchange) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
||||
| [WiFiSense](#wifisense) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [Email](#email) | ✔️ | ✔️ | | |
|
||||
| [Exchange](#exchange) | ✔️ | ✔️ | | |
|
||||
| [KnownAccounts](#knownaccounts) | ✔️ | ✔️ | | |
|
||||
| [VPN](#vpn) | ✔️ | ✔️ | ✔️ | |
|
||||
| [WiFiSense](#wifisense) | ✔️ | ✔️ | | |
|
||||
| [WLAN](#wlan) | ✔️ | ✔️ | ✔️ | |
|
||||
|
||||
## Email
|
||||
|
||||
|
||||
@ -19,8 +19,8 @@ Use to configure a setting that partners must customize to ship Windows devices
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| CountryCodeForExtendedCapabilityPrompts | ✔️ | ✔️ | | |
|
||||
|
||||
You can set the **CountryCodeForExtendedCapabilityPrompts** setting for **China** to enable additional capability prompts when apps use privacy-sensitive features (such as Contacts or Microphone).
|
||||
|
||||
@ -19,7 +19,7 @@ Do not use. Instead, use the [Personalization settings](wcd-personalization.md).
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
|
||||
@ -19,18 +19,16 @@ Use to unlock developer mode on HoloLens devices and configure authentication to
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EnableDeveloperMode](#enabledevelopermode) | | | | ✔️ | |
|
||||
| [AuthenticationMode](#authenticationmode) | | | | ✔️ | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [EnableDeveloperMode](#developersetupsettings-enabledevelopermode) | | | ✔️ | |
|
||||
| [AuthenticationMode](#windowsdeviceportalsettings-authentication-mode) | | | ✔️ | |
|
||||
|
||||
|
||||
<span id="enabledevelopermode" />
|
||||
## DeveloperSetupSettings: EnableDeveloperMode
|
||||
|
||||
When this setting is configured as **True**, the device is unlocked for developer functionality.
|
||||
|
||||
<span id="authenticationmode" />
|
||||
## WindowsDevicePortalSettings: Authentication Mode
|
||||
|
||||
When AuthenticationMode is set to **Basic Auth**, enter a user name and password to enable the device to connect to and authenticate with the Windows Device Portal.
|
||||
|
||||
@ -19,9 +19,9 @@ Use to identify the form factor of the device.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| DeviceForm | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| DeviceForm | ✔️ | ✔️ | | |
|
||||
|
||||
Specifies the device form factor running Windows 10. Generally, the device form is set by the original equipment manufacturer (OEM), however you might want to change the device form based on its usage in your organization.
|
||||
|
||||
|
||||
@ -19,12 +19,12 @@ Use to configure device management settings.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Accounts](#accounts) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [PGList](#pglist) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [Policies](#policies) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [Accounts](#accounts) | ✔️ | ✔️ | | |
|
||||
| [PGList](#pglist) | ✔️ | ✔️ | | |
|
||||
| [Policies](#policies) | ✔️ | ✔️ | | |
|
||||
| [TrustedProvisioningSource](#trustedprovisioningsource) | ✔️ | ✔️ | | |
|
||||
|
||||
## Accounts
|
||||
|
||||
|
||||
@ -17,7 +17,7 @@ Do not use **DeviceUpdateCenter** settings at this time.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
|
||||
@ -19,9 +19,9 @@ Use to specify enterprise-specific mobile device management configuration settin
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| UpdateManagementServiceAddress | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| UpdateManagementServiceAddress | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
For the **UpdateManagementServiceAddress** setting, enter a list of servers. The first server in the semi-colon delimited list is the server that will be used to instantiate MDM sessions.
|
||||
|
||||
|
||||
@ -19,11 +19,11 @@ Use to upgrade the edition of Windows 10 on the device. [Learn about Windows 10
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ChangeProductKey](#changeproductkey) | ✔️ | ✔️ | | | |
|
||||
| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | ✔️ | | ✔️ | |
|
||||
| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | ✔️ | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [ChangeProductKey](#changeproductkey) | ✔️ | | | |
|
||||
| [UpgradeEditionWithLicense](#upgradeeditionwithlicense) | ✔️ | | ✔️ | |
|
||||
| [UpgradeEditionWithProductKey](#upgradeeditionwithproductkey) | ✔️ | | | |
|
||||
|
||||
|
||||
## ChangeProductKey
|
||||
|
||||
@ -19,9 +19,9 @@ Use to enable AllJoyn router to work on public networks.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| EnableAllJoynOnPublicNetwork | | | | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| EnableAllJoynOnPublicNetwork | | | | ✔️ |
|
||||
|
||||
Set to **True** or **False**.
|
||||
|
||||
|
||||
@ -19,9 +19,9 @@ Use these settings to configure the out-of-box experience (OOBE) to set up HoloL
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | ✔️ | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | ✔️ | |
|
||||
|
||||
Setting | Description
|
||||
--- | ---
|
||||
|
||||
@ -19,8 +19,8 @@ Use to add files to the device.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| PublicDocuments | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| PublicDocuments | ✔️ | ✔️ | | |
|
||||
|
||||
Browse to and select a file or files that will be included in the provisioning package and added to the public profile documents folder on the target device. You can use the **Relative path to directory on target device** field to create a new folder within the public profile documents folder.
|
||||
|
||||
@ -19,12 +19,12 @@ Use KioskBrowser settings to configure Internet sharing.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | | ✔️ |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | ✔️ |
|
||||
|
||||
>[!NOTE]
|
||||
>To configure Kiosk Browser settings for desktop editions, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
|
||||
>To configure Kiosk Browser settings for Windows client, go to [Policies > KioskBrowser](wcd-policies.md#kioskbrowser).
|
||||
|
||||
Kiosk Browser settings | Use this setting to
|
||||
--- | ---
|
||||
|
||||
@ -19,10 +19,10 @@ Use for settings related to Microsoft licensing programs.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | | |
|
||||
| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowWindowsEntitlementReactivation](#allowwindowsentitlementreactivation) | ✔️ | | | |
|
||||
| [DisallowKMSClientOnlineAVSValidation](#disallowkmsclientonlineavsvalidation) | ✔️ | | | |
|
||||
|
||||
## AllowWindowsEntitlementReactivation
|
||||
|
||||
|
||||
@ -18,9 +18,9 @@ Use Location settings to configure location services.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EnableLocation](#enablelocation) | | | | | ✔️ |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [EnableLocation](#enablelocation) | | | | ✔️ |
|
||||
|
||||
## EnableLocation
|
||||
|
||||
|
||||
@ -18,11 +18,11 @@ Use for settings related to Maps.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [ChinaVariantWin10](#chinavariantwin10) | ✔️ | ✔️ | | |
|
||||
| [UseExternalStorage](#useexternalstorage) | ✔️ | ✔️ | | |
|
||||
| [UseSmallerCache](#usesmallercache) | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
## ChinaVariantWin10
|
||||
|
||||
@ -18,9 +18,9 @@ Use for settings related to NetworkProxy.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | ✔️ | | |
|
||||
|
||||
|
||||
## AutoDetect
|
||||
|
||||
@ -18,9 +18,9 @@ Use to create network Quality of Service (QoS) policies. A QoS policy performs a
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | ✔️ | | |
|
||||
|
||||
1. In **Available customizations**, select **NetworkQ0SPolicy**, enter a friendly name for the account, and then click **Add**.
|
||||
2. In **Available customizations**, select the name that you just created. The following table describes the settings you can configure.
|
||||
|
||||
@ -18,35 +18,21 @@ Use to configure settings for the [Out Of Box Experience (OOBE)](/windows-hardwa
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | | |
|
||||
| [Desktop > HideOobe](#hided) | ✔️ | | | | |
|
||||
| [Mobile > EnforceEnterpriseProvisioning](#nforce) | | ✔️ | | | |
|
||||
| [Mobile > HideOobe](#hidem) | | ✔️ | | | |
|
||||
|
||||
|
||||
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [Desktop > EnableCortanaVoice](#enablecortanavoice) | ✔️ | | | |
|
||||
| [Desktop > HideOobe](#hideoobe-for-desktop) | ✔️ | | | |
|
||||
|
||||
## EnableCortanaVoice
|
||||
|
||||
Use this setting to control whether Cortana voice-over is enabled during OOBE. The voice-over is disabled by default on Windows 10 Pro, Education, and Enterprise. The voice-over is enabled by default on Windows 10 Home. Select **True** to enable voice-over during OOBE, or **False** to disable voice-over during OOBE.
|
||||
|
||||
<span id="hided" />
|
||||
## HideOobe for desktop
|
||||
|
||||
When set to **True**, it hides the interactive OOBE flow for Windows 10.
|
||||
|
||||
>[!NOTE]
|
||||
>You must create a user account if you set the value to true or the device will not be usable.
|
||||
> [!NOTE]
|
||||
> You must create a user account if you set the value to true or the device will not be usable.
|
||||
|
||||
When set to **False**, the OOBE screens are displayed.
|
||||
|
||||
<span id="nforce" />
|
||||
## EnforceEnterpriseProvisioning
|
||||
|
||||
When set to **True**, it forces the OOBE flow into using the enterprise provisioning page without making the user interact with the Windows button. This is the default setting.
|
||||
|
||||
When set to **False**, it does not force the OOBE flow to the enterprise provisioning page.
|
||||
|
||||
<span id="hidem" />
|
||||
|
||||
@ -18,12 +18,12 @@ Use to configure settings to personalize a PC.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | | |
|
||||
| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | | |
|
||||
| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | | |
|
||||
| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [DeployDesktopImage](#deploydesktopimage) | ✔️ | | | |
|
||||
| [DeployLockScreenImage](#deploylockscreenimage) | ✔️ | | | |
|
||||
| [DesktopImageUrl](#desktopimageurl) | ✔️ | | | |
|
||||
| [LockScreenImageUrl](#lockscreenimageurl) | ✔️ | | | |
|
||||
|
||||
## DeployDesktopImage
|
||||
|
||||
|
||||
@ -18,315 +18,316 @@ This section describes the **Policies** settings that you can configure in [prov
|
||||
|
||||
## AboveLock
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | ✔️ | | | |
|
||||
| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowActionCenterNotifications](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowactioncenternotifications) | Allow Action Center notifications above the device lock screen. | | | | |
|
||||
| [AllowToasts](/windows/client-management/mdm/policy-configuration-service-provider#abovelock-allowtoasts) | Allow toast notifications above the device lock screen. | ✔️ | | | |
|
||||
|
||||
## Accounts
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | ✔️ | | | |
|
||||
| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | ✔️ | | | |
|
||||
| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddingNonMicrosoftAccountManually](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowaddingnonmicrosoftaccountsmanually) | Whether users can add non-Microsoft email accounts | ✔️ | | | |
|
||||
| [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountconnection) | Whether users can use a Microsoft account for non-email-related connection authentication and services | ✔️ | | ✔️ | |
|
||||
| [AllowMicrosoftAccountSigninAssistant](/windows/client-management/mdm/policy-configuration-service-provider#accounts-allowmicrosoftaccountsigninassistant) | Disable the **Microsoft Account Sign-In Assistant** (wlidsvc) NT service | ✔️ | | | |
|
||||
| [DomainNamesForEmailSync](/windows/client-management/mdm/policy-configuration-service-provider#accounts-domainnamesforemailsync) | List of domains that are allowed to sync email on the devices | ✔️ | | | |
|
||||
|
||||
|
||||
## ApplicationDefaults
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [DefaultAssociationsConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#applicationdefaults-defaultassociationsconfiguration) | Set default file type and protocol associations | ✔️ | | | |
|
||||
|
||||
|
||||
## ApplicationManagement
|
||||
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | ✔️ | | | ✔️ |
|
||||
| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | ✔️ | | | ✔️ |
|
||||
| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | | |
|
||||
| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | ✔️ | | | |
|
||||
| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | ✔️ | | | |
|
||||
| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | ✔️ | | | |
|
||||
| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | | |
|
||||
| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
|
||||
| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | ✔️ | | | ✔️ |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAllTrustedApps](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowalltrustedapps) | Whether non-Microsoft Store apps are allowed | ✔️ | | | ✔️ |
|
||||
| [AllowAppStoreAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowappstoreautoupdate) | Whether automatic update of apps from Microsoft Store is allowed | ✔️ | | | ✔️ |
|
||||
| [AllowDeveloperUnlock](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowdeveloperunlock) | Whether developer unlock of device is allowed | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowGameDVR](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowgamedvr) |Whether DVR and broadcasting is allowed | ✔️ | | | |
|
||||
| [AllowSharedUserAppData](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowshareduserappdata) | Whether multiple users of the same app can share data | ✔️ | | | |
|
||||
| [AllowStore](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-allowstore) | Whether app store is allowed at device | | | | |
|
||||
| [ApplicationRestrictions](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-applicationrestrictions) | An XML blob that specifies app restrictions, such as an allow list, disallow list, etc. | | | | |
|
||||
| [LaunchAppAfterLogOn](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-launchappafterlogon) |Whether to launch an app or apps when the user signs in. | ✔️ | | | |
|
||||
| [RestrictAppDataToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictappdatatosystemvolume) | Whether app data is restricted to the system drive | ✔️ | | | ✔️ |
|
||||
| [RestrictAppToSystemVolume](/windows/client-management/mdm/policy-configuration-service-provider#applicationmanagement-restrictapptosystemvolume) | Whether the installation of apps is restricted to the system drive | ✔️ | | | ✔️ |
|
||||
|
||||
|
||||
|
||||
|
||||
## Authentication
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowFastReconnect](/windows/client-management/mdm/policy-csp-authentication#authentication-allowfastreconnect) | Allows EAP Fast Reconnect from being attempted for EAP Method TLS. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [EnableFastFirstSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablefastfirstsignin) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EnableWebSignin](/windows/client-management/mdm/policy-csp-authentication#authentication-enablewebsignin) | Enables Windows logon support for non-ADFS federated providers (e.g. SAML). | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreferredAadTenantDomainName](/windows/client-management/mdm/policy-csp-authentication#authentication-preferredaadtenantdomainname) | Specifies the preferred domain among available domains in the Azure AD tenant. | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
|
||||
## BitLocker
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [EncryptionMethod](/windows/client-management/mdm/policy-configuration-service-provider#bitlocker-encryptionmethod) | Specify BitLocker drive encryption method and cipher strength | ✔️ | | | |
|
||||
|
||||
|
||||
## Bluetooth
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAdvertising](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowadvertising) | Whether the device can send out Bluetooth advertisements | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowDiscoverableMode](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowdiscoverablemode) | Whether other Bluetooth-enabled devices can discover the device | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowPrepairing](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-allowprepairing) | Whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| AllowPromptedProximalConnections | Whether Windows will prompt users when Bluetooth devices that are connectable are in range of the user's device | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [LocalDeviceName](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-localdevicename) | Set the local Bluetooth device name | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ServicesAllowedList](/windows/client-management/mdm/policy-configuration-service-provider#bluetooth-servicesallowedlist) | Set a list of allowable services and profiles | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
## Browser
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | | |
|
||||
| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | ✔️ | | | |
|
||||
[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | ✔️ | | | |
|
||||
| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | | |
|
||||
| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | | |
|
||||
| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | | |
|
||||
| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | | |
|
||||
| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | | ✔️ | |
|
||||
| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | | |
|
||||
| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | | |
|
||||
| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | | |
|
||||
| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | | |
|
||||
| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | ✔️ | | | |
|
||||
| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | | |
|
||||
| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | | |
|
||||
| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | | |
|
||||
| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | | |
|
||||
| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | | |
|
||||
| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | | |
|
||||
| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | | |
|
||||
| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | | |
|
||||
[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | | |
|
||||
| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | | |
|
||||
| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | | |
|
||||
| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | ✔️ | | | |
|
||||
| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | | |
|
||||
[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | ✔️ | | | |
|
||||
| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | | |
|
||||
| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | | |
|
||||
| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | | |
|
||||
| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | ✔️ | | | |
|
||||
| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | | |
|
||||
| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | | |
|
||||
| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | | |
|
||||
| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | | |
|
||||
| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | | |
|
||||
| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | | |
|
||||
[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddressBarDropdown](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowaddressbardropdown) | Specify whether to allow the address bar drop-down functionality in Microsoft Edge. If you want to minimize network connections from Microsoft Edge to Microsoft services, we recommend disabling this functionality. | ✔️ | | | |
|
||||
| [AllowAutofill](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowautofill) | Specify whether autofill on websites is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowBrowser](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowbrowser) | Specify whether the browser is allowed on the device (for Windows 10, version 1803 and earlier only). | ✔️ | | | |
|
||||
[AllowConfigurationUpdateForBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) | Specify whether Microsoft Edge can automatically update the configuration data for the Books Library. | ✔️ | | | |
|
||||
| [AllowCookies](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowcookies) | Specify whether cookies are allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowDeveloperTools](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdevelopertools) | Specify whether employees can use F12 Developer Tools on Microsoft Edge. | ✔️ | | | |
|
||||
| [AllowDoNotTrack](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowdonottrack) | Specify whether Do Not Track headers are allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowextensions) | Specify whether Microsoft Edge extensions are allowed. | ✔️ | | | |
|
||||
| [AllowFlash](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflash) | Specify whether Adobe Flash can run in Microsoft Edge. | ✔️ | | | |
|
||||
| [AllowFlashClickToRun](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowflashclicktorun) | Specify whether users must take an action, such as clicking the content or a Click-to-Run button, before seeing content in Adobe Flash. | ✔️ | | | |
|
||||
| [AllowFullScreenMode](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowfullscreenmode) | Specify whether full-screen mode is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowInPrivate](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowinprivate) | Specify whether InPrivate browsing is allowed on corporate networks. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowMicrosoftCompatibilityList](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowmicrosoftcompatibilitylist) | Specify whether to use the Microsoft compatibility list in Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowPasswordManager](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpasswordmanager) | Specify whether saving and managing passwords locally on the device is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowPopups](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowpopups) | Specify whether pop-up blocker is allowed or enabled. | ✔️ | | ✔️ | |
|
||||
| [AllowPrelaunch](/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | Specify whether Microsoft Edge can pre-launch as a background process during Windows startup when the system is idle waiting to be launched by the user. | ✔️ | | | |
|
||||
| [AllowPrinting](/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | Specify whether users can print web content in Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSavingHistory](/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | Specify whether Microsoft Edge saves the browsing history. | ✔️ | | | |
|
||||
| [AllowSearchEngineCustomization](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchenginecustomization) | Allow search engine customization for MDM-enrolled devices. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSearchSuggestionsinAddressBar](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsearchsuggestionsinaddressbar) | Specify whether search suggestions are allowed in the address bar. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowSideloadingOfExtensions](/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | Specify whether extensions can be sideloaded in Microsoft Edge. | ✔️ | | | |
|
||||
| [AllowSmartScreen](/windows/client-management/mdm/policy-configuration-service-provider#browser-allowsmartscreen) | Specify whether Windows Defender SmartScreen is allowed. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowTabPreloading](/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | Specify whether preloading the Start and New tab pages during Windows sign-in is allowed. | ✔️ | | | |
|
||||
| [AllowWebContentOnNewTabPage](/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | Specify whether a New tab page opens with the default content or a blank page. | ✔️ | ✔️ | | ✔️ |
|
||||
[AlwaysEnableBooksLibrary](/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | Always show the Books Library in Microsoft Edge. | ✔️ | | | |
|
||||
| [ClearBrowsingDataOnExit](/windows/client-management/mdm/policy-configuration-service-provider#browser-clearbrowsingdataonexit) | Specify whether to clear browsing data when exiting Microsoft Edge. | ✔️ | | | |
|
||||
| [ConfigureAdditionalSearchEngines](/windows/client-management/mdm/policy-configuration-service-provider#browser-configureadditionalsearchengines) | Allows you to add up to 5 additional search engines for MDM-enrolled devices. | ✔️ | ✔️ | | ✔️ |
|
||||
| [ConfigureFavoritesBar](/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | Specify whether the Favorites bar is shown or hidden on all pages. | ✔️ | | | |
|
||||
| [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | Configure whether the Home button will be shown, and what should happen when it is selected. You should also configure the [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) setting. To configure this setting and also allow users to make changes to the Home button, see the [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) setting. | ✔️ | | | |
|
||||
| [ConfigureKioskMode](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | Configure how Microsoft Edge operates when it's running in kiosk mode, either as a single-app kiosk or as one of multiple apps running on the kiosk device. | ✔️ | | | |
|
||||
| [ConfigureKioskResetAfterIdleTimeout](/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | Specify the time, in minutes, after which Microsoft Edge running in kiosk mode resets to the default kiosk configuration. | ✔️ | | | |
|
||||
| [ConfigureOpenMicrosoftEdgeWith](/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | Specify which pages should load when Microsoft Edge opens. You should also configure the [ConfigureStartPages](/windows/client-management/mdm/policy-csp-browser#browser-configurestartpages) setting and [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) setting. | ✔️ | | | |
|
||||
| [ConfigureTelemetryForMicrosoft365Analytics](/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | Specify whether to send Microsoft Edge browsing history data to Microsoft 365 Analytics. | ✔️ | | | |
|
||||
| [DisableLockdownOfStartPages](/windows/client-management/mdm/policy-configuration-service-provider#browser-disablelockdownofstartpages) | Specify whether the lockdown on the Start pages is disabled. | ✔️ | | | |
|
||||
[EnableExtendedBooksTelemetry](/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) | Enable this setting to send additional diagnostic data, on top of the basic diagnostic data, from the Books tab. | ✔️ | ✔️ | | |
|
||||
| [EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist) | Allow the user to specify a URL of an enterprise site list. | ✔️ | | | |
|
||||
| [EnterpriseSiteListServiceUrl](/windows/client-management/mdm/policy-csp-browser#browser-enterprisesitelistserviceurl) | This policy (introduced in Windows 10, version 1507) was deprecated in Windows 10, version 1511 by [Browser/EnterpriseModeSiteList](/windows/client-management/mdm/policy-configuration-service-provider#browser-enterprisemodesitelist). | ✔️ | | | |
|
||||
| [FirstRunURL](/windows/client-management/mdm/policy-configuration-service-provider#browser-firstrunurl) | Specify the URL that Microsoft Edge will use when it is opened for the first time. | ✔️ | | | |
|
||||
| [HomePages](/windows/client-management/mdm/policy-configuration-service-provider#browser-homepages) | Specify your Start pages for MDM-enrolled devices. | ✔️ | | | |
|
||||
[LockdownFavorites](/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) | Configure whether employees can add, import, sort, or edit the Favorites list in Microsoft Edge. | ✔️ | | | |
|
||||
| [PreventAccessToAboutFlagsInMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventaccesstoaboutflagsinmicrosoftedge) | Specify whether users can access the **about:flags** page, which is used to change developer settings and to enable experimental features. | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventCertErrorOverrides](/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | Specify whether to override security warnings about sites that have SSL errors. | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventFirstRunPage](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventfirstrunpage) | Specify whether to enable or disable the First Run webpage. | ✔️ | | | |
|
||||
| [PreventLiveTileDataCollection](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventlivetiledatacollection) | Specify whether Microsoft can collect information to create a Live Tile when pinning a site to Start from Microsoft Edge. | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventSmartScreenPromptOverride](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverride) | Specify whether users can override the Windows Defender SmartScreen warnings about potentially malicious websites. | ✔️ | ✔️ | | ✔️ |
|
||||
| [PreventSmartScreenPromptOverrideForFiles](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventsmartscreenpromptoverrideforfiles) | Specify whether users can override the Windows Defender SmartScreen warnings about downloading unverified files. | ✔️ | ✔️ | | ✔️ |
|
||||
PreventTabPreloading | Prevent Microsoft Edge from starting and loading the Start and New Tab page at Windows startup and each time Microsoft Edge is closed. Applies to Windows 10, version 1803 and earlier only. | ✔️ | | | |
|
||||
| [PreventTurningOffRequiredExtensions](/windows/client-management/mdm/policy-configuration-service-provider#browser-forceenabledextensions) | Enter a list of extensions in Microsoft Edge that users cannot turn off, using a semi-colon delimited list of extension package family names. | ✔️ | | | |
|
||||
| [PreventUsingLocalHostIPAddressForWebRTC](/windows/client-management/mdm/policy-configuration-service-provider#browser-preventusinglocalhostipaddressforwebrtc) | Specify whether a user's localhost IP address is displayed while making phone calls using the WebRTC protocol. | ✔️ | ✔️ | | ✔️ |
|
||||
[ProvisionFavorites](/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) | Configure a default set of favorites which will appear for employees. | ✔️ | | | |
|
||||
| [SendIntranetTraffictoInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-sendintranettraffictointernetexplorer) | Specify whether to send intranet traffic to Internet Explorer. | ✔️ | | | |
|
||||
| [SetDefaultSearchEngine](/windows/client-management/mdm/policy-configuration-service-provider#browser-setdefaultsearchengine) | Configure the default search engine for your employees. | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetHomeButtonURL](/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | Specify a custom URL for the Home button. You should also enable the [ConfigureHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) setting and select the **Show the home button; clicking the home button loads a specific URL** option. | ✔️ | | | |
|
||||
| [SetNewTabPageURL](/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | Specify a custom URL for a New tab page. | ✔️ | | | |
|
||||
| [ShowMessageWhenOpeningSitesInInternetExplorer](/windows/client-management/mdm/policy-configuration-service-provider#browser-showmessagewhenopeningsitesininternetexplorer) | Specify whether users should see a full interstitial page in Microsoft Edge when opening sites that are configured to open in Internet Explorer using the Enterprise Site list. | ✔️ | | | |
|
||||
| [SyncFavoritesBetweenIEAndMicrosoftEdge](/windows/client-management/mdm/policy-configuration-service-provider#browser-syncfavoritesbetweenieandmicrosoftedge) | Specify whether favorites are kept in sync between Internet Explorer and Microsoft Edge. | ✔️ | | | |
|
||||
| [UnlockHomeButton](/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | Specify whether users can make changes to the Home button. | ✔️ | | | |
|
||||
[UseSharedFolderForBooks](/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) | Specify whether organizations should use a folder shared across users to store books from the Books Library. | ✔️ | | | |
|
||||
|
||||
|
||||
## Camera
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowCamera](/windows/client-management/mdm/policy-configuration-service-provider#camera-allowcamera) | Disable or enable the camera. | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
## Connectivity
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | ✔️ | | | ✔️ |
|
||||
| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | ✔️ | | | ✔️ |
|
||||
| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlyinng connections VPN is allowed to use. |✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowBluetooth](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowbluetooth) | Allow the user to enable Bluetooth or restrict access. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowCellularData](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardata) | Allow the cellular data channel on the device. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowCellularDataRoaming](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowcellulardataroaming) | Allow or disallow cellular data roaming on the device. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowConnectedDevices](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowconnecteddevices) | Allows IT admins the ability to disable the Connected Devices Platform component. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowNFC](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allownfc) | Allow or disallow near field communication (NFC) on the device. | | | | ✔️ |
|
||||
| [AllowUSBConnection](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowusbconnection) | Enable USB connection between the device and a computer to sync files with the device or to use developer tools or to deploy or debug applications. | | | | ✔️ |
|
||||
| [AllowVPNOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnovercellular) | Specify what type of underlying connections VPN is allowed to use. |✔️ | ✔️ | | ✔️ |
|
||||
| [AllowVPNRoamingOverCellular](/windows/client-management/mdm/policy-configuration-service-provider#connectivity-allowvpnroamingovercellular) | Prevent the device from connecting to VPN when the device roams over cellular networks. | ✔️ | ✔️ | | ✔️ |
|
||||
| HideCellularConnectionMode | Hide the checkbox that lets the user change the connection mode. | ✔️ | ✔️ | | ✔️ |
|
||||
| HideCellularRoamingOption | Hide the dropdown menu that lets the user change the roaming preferences. | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## CredentialProviders
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
[DisableAutomaticReDeploymentCredentials](/windows/client-management/mdm/policy-csp-credentialproviders) | This setting disables the visibility of the credential provider that triggers the PC refresh on a device. This policy does not actually trigger the refresh. The admin user is required to authenticate to trigger the refresh on the target device. The Windows 10 Autopilot Reset feature allows admin to reset devices to a known good managed state while preserving the management enrollment. After the automatic redeployment is triggered the devices are for ready for use by information workers or students. | ✔️ | | | |
|
||||
|
||||
## Cryptography
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | ✔️ | | | |
|
||||
| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowFipsAlgorithmPolicy](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-allowfipsalgorithmpolicy) | Allow or disallow the Federal Information Processing Standard (FIPS) policy. | ✔️ | | | |
|
||||
| [TLSCiperSuites](/windows/client-management/mdm/policy-configuration-service-provider#cryptography-tlsciphersuites) | List the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. | ✔️ | | | |
|
||||
|
||||
## Defender
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | | |
|
||||
| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | | |
|
||||
| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | | |
|
||||
| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | | |
|
||||
| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | | |
|
||||
| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | | |
|
||||
| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | | |
|
||||
| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | | |
|
||||
| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | | |
|
||||
| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | | |
|
||||
| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | | |
|
||||
| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | | |
|
||||
| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defeder scan (in percent). | ✔️ | | | | |
|
||||
| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | | |
|
||||
| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore durinng a scan. Separate each file type in the list by using \|. | ✔️ | | | | |
|
||||
| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | | |
|
||||
| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore durinng a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | | |
|
||||
| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | | |
|
||||
| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | | |
|
||||
| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | | |
|
||||
| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | | |
|
||||
| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | | |
|
||||
| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | | |
|
||||
| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | | |
|
||||
| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowArchiveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowarchivescanning) | Allow or disallow scanning of archives. | ✔️ | | | |
|
||||
| [AllowBehaviorMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowbehaviormonitoring) | Allow or disallow Windows Defender Behavior Monitoring functionality. | ✔️ | | | |
|
||||
| [AllowCloudProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowcloudprotection) | To best protect your PC, Windows Defender will send information to Microsoft about any problems it finds. Microsoft will analyze that information, learn more about problems affecting you and other customers, and offer improved solutions. | ✔️ | | | |
|
||||
| [AllowEmailScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowemailscanning) | Allow or disallow scanning of email. | ✔️ | | | |
|
||||
| [AllowFullScanOnMappedNetworkDrives](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanonmappednetworkdrives) | Allow or disallow a full scan of mapped network drives. | ✔️ | | | |
|
||||
| [AllowFullScanRemovableDriveScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowfullscanremovabledrivescanning) | Allow or disallow a full scan of removable drives. | ✔️ | | | |
|
||||
| [AllowIntrusionPreventionSystem](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowintrusionpreventionsystem) | Allow or disallow Windows Defender Intrusion Prevention functionality. | ✔️ | | | |
|
||||
| [AllowIOAVProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowioavprotection) | Allow or disallow Windows Defender IOAVP Protection functionality. | ✔️ | | | |
|
||||
| [AllowOnAccessProtection](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowonaccessprotection) | Allow or disallow Windows Defender On Access Protection functionality. | ✔️ | | | |
|
||||
| [AllowRealtimeMonitoring](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowrealtimemonitoring) | Allow or disallow Windows Defender Realtime Monitoring functionality. | ✔️ | | | |
|
||||
| [AllowScanningNetworkFiles](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscanningnetworkfiles) | Allow or disallow scanning of network files. | ✔️ | | | |
|
||||
| [AllowScriptScanning](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowscriptscanning) | Allow or disallow Windows Defender Script Scanning functionality. | ✔️ | | | |
|
||||
| [AllowUserUIAccess](/windows/client-management/mdm/policy-configuration-service-provider#defender-allowuseruiaccess) | Allow or disallow user access to the Windows Defender UI. | ✔️ | | | |
|
||||
| [AvgCPULoadFactor](/windows/client-management/mdm/policy-configuration-service-provider#defender-avgcpuloadfactor) | Represents the average CPU load factor for the Windows Defender scan (in percent). | ✔️ | | | |
|
||||
| [DaysToRetainCleanedMalware](/windows/client-management/mdm/policy-configuration-service-provider#defender-daystoretaincleanedmalware) | Specify time period (in days) that quarantine items will be stored on the system. | ✔️ | | | |
|
||||
| [ExcludedExtensions](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedextensions) | Specify a list of file type extensions to ignore during a scan. Separate each file type in the list by using \|. | ✔️ | | | |
|
||||
| [ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) | Specify a list of directory paths to ignore during a scan. Separate each path in the list by using \|. | ✔️ | | | |
|
||||
| [ExcludedProcesses](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedprocesses) | Specify a list of files opened by processes to ignore during a scan. Separate each file type in the list by using \|. The process itself is not excluded from the scan, but can be excluded by using the [Defender/ExcludedPaths](/windows/client-management/mdm/policy-configuration-service-provider#defender-excludedpaths) policy to exclude its path. | ✔️ | | | |
|
||||
| [RealTimeScanDirection](/windows/client-management/mdm/policy-configuration-service-provider#defender-realtimescandirection) | Control which sets of files should be monitored. | ✔️ | | | |
|
||||
| [ScanParameter](/windows/client-management/mdm/policy-configuration-service-provider#defender-scanparameter) | Select whether to perform a quick scan or full scan. | ✔️ | | | |
|
||||
| [ScheduleQuickScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulequickscantime) | Specify the time of day that Windows Defender quick scan should run. | ✔️ | | | |
|
||||
| [ScheduleScanDay](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescanday) | Select the day that Windows Defender scan should run. | ✔️ | | | |
|
||||
| [ScheduleScanTime](/windows/client-management/mdm/policy-configuration-service-provider#defender-schedulescantime) | Select the time of day that the Windows Defender scan should run. | ✔️ | | | |
|
||||
| [SignatureUpdateInterval](/windows/client-management/mdm/policy-configuration-service-provider#defender-signatureupdateinterval) | Specify the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. | ✔️ | | | |
|
||||
| [SubmitSamplesConsent](/windows/client-management/mdm/policy-configuration-service-provider#defender-submitsamplesconsent) | Checks for the user consent level in Windows Defender to send data. | ✔️ | | | |
|
||||
| [ThreatSeverityDefaultAction](/windows/client-management/mdm/policy-configuration-service-provider#defender-threatseveritydefaultaction) | Specify any valid threat severity levels and the corresponding default action ID to take. | ✔️ | | | |
|
||||
|
||||
## DeliveryOptimization
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | | |
|
||||
| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | | |
|
||||
| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | | |
|
||||
| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | | |
|
||||
| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | | |
|
||||
| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | | |
|
||||
| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | | |
|
||||
| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | | |
|
||||
| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | | |
|
||||
| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | | |
|
||||
| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity usinng Delivery Optimization. | ✔️ | | | | |
|
||||
| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | | |
|
||||
| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | | |
|
||||
| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capabity in GB) for the device to use Peer Caching. | ✔️ | | | | |
|
||||
| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | | |
|
||||
| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB requried to use Peer Caching. | ✔️ | | | | |
|
||||
| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | | |
|
||||
| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | | |
|
||||
| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | | |
|
||||
| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [DOAbsoluteMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doabsolutemaxcachesize) | Specify the maximum size in GB of Delivery Optimization cache. | ✔️ | | | |
|
||||
| [DOAllowVPNPeerCaching](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-doallowvpnpeercaching) | Specify whether the device is allowed to participate in Peer Caching while connected via VPN to the domain network. | ✔️ | | | |
|
||||
| [DODelayBackgroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelaybackgrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. | ✔️ | | | |
|
||||
| [DODelayForegroundDownloadFromHttp](/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodelayforegrounddownloadfromhttp) | Allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. | ✔️ | | | |
|
||||
| [DODownloadMode](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dodownloadmode) | Specify the download method that Delivery Optimization can use in downloads of Windows Updates, apps, and app updates. | ✔️ | | | |
|
||||
| [DOGroupId](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupid) | Specify an arbitrary group ID that the device belongs to. | ✔️ | | | |
|
||||
| [DOGroupIdSource](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dogroupidsource) | Set this policy to restrict peer selection to a specific source | ✔️ | | | |
|
||||
| [DOMaxCacheAge](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcacheage) | Specify the maximum time in seconds that each file is held in the Delivery Optimization cache after downloading successfully. | ✔️ | | | |
|
||||
| [DOMaxCacheSize](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxcachesize) | Specify the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). | ✔️ | | | |
|
||||
| [DOMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxdownloadbandwidth) | Specify the maximum download bandwidth in kilobytes/second that the device can use across all concurrent download activities using Delivery Optimization. | ✔️ | | | |
|
||||
| [DOMaxUploadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domaxuploadbandwidth) | Specify the maximum upload bandwidth in kilobytes/second that a device will use across all concurrent upload activity using Delivery Optimization. | ✔️ | | | |
|
||||
| [DOMinBackgroundQos](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbackgroundqos) | Specify the minimum download QoS (Quality of Service or speed) i kilobytes/second for background downloads. | ✔️ | | | |
|
||||
| [DOMinBatteryPercentageAllowedToUpload](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominbatterypercentageallowedtoupload) | Specify any value between 1 and 100 (in percentage) to allow the device to upload data to LAN and group peers while on battery power. | ✔️ | | | |
|
||||
| [DOMinDiskSizeAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domindisksizeallowedtopeer) | Specify the required minimum disk size (capacity in GB) for the device to use Peer Caching. | ✔️ | | | |
|
||||
| [DOMinFileSizeToCache](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominfilesizetocache) | Specify the minimum content file size in MB enabled to use Peer Caching. | ✔️ | | | |
|
||||
| [DOMinRAMAllowedToPeer](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dominramallowedtopeer) | Specify the minimum RAM size in GB required to use Peer Caching. | ✔️ | | | |
|
||||
| [DOModifyCacheDrive](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domodifycachedrive) | Specify the drive that Delivery Optimization should use for its cache. | ✔️ | | | |
|
||||
| [DOMonthlyUploadDataCap](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-domonthlyuploaddatacap) | Specify the maximum total bytes in GB that Delivery Optimization is allowed to upload to Internet peers in each calendar month. | ✔️ | | | |
|
||||
| [DOPercentageMaxBackDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxbackgroundbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||
| [DOPercentageMaxDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxdownloadbandwidth) | Specify the maximum download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||
| [DOPercentageMaxForeDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dopercentagemaxforegroundbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||
| [DORestrictPeerSelectionBy](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dorestrictpeerselectionby) | Set this policy to restrict peer selection by the selected option. | ✔️ | | | |
|
||||
| [DOSetHoursToLimitBackgroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) | Specify the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||
| [DOSetHoursToLimitForegroundDownloadBandwidth](/windows/client-management/mdm/policy-configuration-service-provider#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) | Specify the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. | ✔️ | | | |
|
||||
|
||||
## DeviceGuard
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
[EnableVirtualizationBasedSecurity](/windows/client-management/mdm/policy-csp-deviceguard) | Turns on virtualization based security(VBS) at the next reboot. virtualization based security uses the Windows Hypervisor to provide support for security services. | ✔️ | | | |
|
||||
|
||||
## DeviceLock
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | ✔️ | | | |
|
||||
| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | ✔️ | | | |
|
||||
| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | ✔️ | | ✔️ | |
|
||||
|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowIdleReturnWithoutPassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowidlereturnwithoutpassword) | Specify whether the user must input a PIN or password when the device resumes from an idle state. | | | | |
|
||||
| [AllowScreenTimeoutWhileLockedUserConfig](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowscreentimeoutwhilelockeduserconfig) | Specify whether to show a user-configurable setting to control the screen timeout while on the lock screen. | | | | |
|
||||
| [AllowSimpleDevicePassword](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-allowsimpledevicepassword) | Specify whether PINs or passwords such as "1111" or "1234" are allowed. For the desktop, it also controls the use of picture passwords. | ✔️ | | ✔️ | |
|
||||
|[AlphanumericDevicePasswordRequired](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-alphanumericdevicepasswordrequired) | Select the type of PIN or password required. | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordEnabled](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordenabled) | Specify whether device password is enabled. | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordExpiration](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordexpiration) | Specify when the password expires (in days). | ✔️ | | ✔️ | |
|
||||
| [DevicePasswordHistory](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-devicepasswordhistory) | Specify how many passwords can be stored in the history that can't be reused. | ✔️ | | ✔️ | |
|
||||
| [MaxDevicePasswordFailedAttempts](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxdevicepasswordfailedattempts) | Specify the number of authentication failures allowed before the device will be wiped. | ✔️ | | ✔️ | |
|
||||
| [MaxInactivityTimeDeviceLock](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-maxinactivitytimedevicelock) |Specify the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked. | ✔️ | | ✔️ | |
|
||||
| [MinDevicePasswordComplexCharacters](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordcomplexcharacters) | Specify the number of complex element types (uppercase and lowercase letters, numbers, and punctuation) required for a strong PIN or password. | ✔️ | | ✔️ | |
|
||||
| [MinDevicePasswordLength](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-mindevicepasswordlength) | Specify the minimum number or characters required in the PIN or password. | ✔️ | | ✔️ | |
|
||||
| [ScreenTimeoutWhileLocked](/windows/client-management/mdm/policy-configuration-service-provider#devicelock-screentimeoutwhilelocked) | Specify the duration in seconds for the screen timeout while on the lock screen. | | | | |
|
||||
|
||||
|
||||
## DeviceManagement
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| DisableMDMEnrollment | Use this setting to prevent the device from enrolling in MDM. | ✔️ | | | |
|
||||
|
||||
|
||||
|
||||
## Experience
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | ✔️ | | | |
|
||||
| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | ✔️ | | | |
|
||||
| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | ✔️ | | | |
|
||||
| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | ✔️ | | | |
|
||||
| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | ✔️ | | | |
|
||||
| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | ✔️ | | | |
|
||||
| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | | |
|
||||
| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | ✔️ | | | |
|
||||
| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | | |
|
||||
| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | ✔️ | | | |
|
||||
| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggetions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | | |
|
||||
| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | | |
|
||||
| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | | |
|
||||
| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | | |
|
||||
| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | | |
|
||||
| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowCopyPaste](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcopypaste) | Specify whether copy and paste is allowed. | | | | |
|
||||
| [AllowCortana](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowcortana) | Specify whether Cortana is allowed on the device. | ✔️ | | ✔️ | |
|
||||
| [AllowDeviceDiscovery](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowdevicediscovery) | Allow users to turn device discovery on or off in the UI. | ✔️ | | | |
|
||||
| [AllowFindMyDevice](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowfindmydevice) | Turn on **Find my device** feature. | ✔️ | | | |
|
||||
| [AllowManualMDMUnenrollment](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowmanualmdmunenrollment) | Specify whether the user is allowed to delete the workplace account. | ✔️ | | ✔️ | |
|
||||
| [AllowScreenCapture](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowscreencapture) | Specify whether screen capture is allowed. | | | | |
|
||||
| [AllowSIMErrorDialogPromptWhenNoSIM](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsimerrordialogpromptwhennosim) | Specify whether to display a dialog prompt when no SIM card is detected. | | | | |
|
||||
| [AllowSyncMySettings](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowsyncmysettings) | Allow or disallow all Windows sync settings on the device. | ✔️ | | | |
|
||||
| [AllowTailoredExperiencesWithDiagnosticData](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtailoredexperienceswithdiagnosticdata) | Prevent Windows from using diagnostic data to provide customized experiences to the user. | ✔️ | | | |
|
||||
| [AllowTaskSwitcher](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowtaskswitcher) | Allow or disallow task switching on the device. | | | | |
|
||||
| [AllowThirdPartySuggestionsInWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowthirdpartysuggestionsinwindowsspotlight) | Specify whether to allow app and content suggestions from third-party software publishers in Windows Spotlight. | ✔️ | | | |
|
||||
| [AllowVoiceRecording](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowvoicerecording) | Specify whether voice recording is allowed for apps. | | | | |
|
||||
| [AllowWindowsConsumerFeatures](/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsconsumerfeatures) | Turn on experiences that are typically for consumers only, such as Start suggestions, membership notifications, post-OOBE app install, and redirect tiles. | ✔️ | | | |
|
||||
| [AllowWindowsSpotlight](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlight) |Specify whether to turn off all Windows Spotlight features at once. | ✔️ | | | |
|
||||
| [AllowWindowsSpotlightOnActionCenter](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightonactioncenter) | Prevent Windows Spotlight notifications from being displayed in the Action Center. | ✔️ | | | |
|
||||
| [AllowWindowsSpotlightWindowsWelcomeExperience](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowsspotlightwindowswelcomeexperience) | Turn off the Windows Spotlight Windows welcome experience feature. | ✔️ | | | |
|
||||
| [AllowWindowsTips](/windows/client-management/mdm/policy-configuration-service-provider#experience-allowwindowstips) | Enable or disable Windows Tips. | ✔️ | | | |
|
||||
| [ConfigureWindowsSpotlightOnLockScreen](/windows/client-management/mdm/policy-configuration-service-provider#experience-configurewindowsspotlightonlockscreen) | Specify whether Spotlight should be used on the user's lock screen. | ✔️ | | | |
|
||||
|
||||
## ExploitGuard
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) | See the [explanation of ExploitProtectionSettings](/windows/client-management/mdm/policy-csp-exploitguard) in the Policy CSP for instructions. In the **ExploitProtectionSettings** field, you can enter a path (local, UNC, or URI) to the mitigation options config, or you can enter the XML for the config. | ✔️ | | | |
|
||||
|
||||
|
||||
## Games
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAdvancedGamingServices](/windows/client-management/mdm/policy-configuration-service-provider#games-allowadvancedgamingservices) | Currently not supported. | ✔️ | | | |
|
||||
|
||||
|
||||
## KioskBrowser
|
||||
|
||||
These settings apply to the **Kiosk Browser** app available in Microsoft Store. For more information, see [Guidelines for web browsers](../guidelines-for-assigned-access-app.md#guidelines-for-web-browsers).
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | | |
|
||||
[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | | |
|
||||
[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | | |
|
||||
[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | | |
|
||||
[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | | |
|
||||
[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | | |
|
||||
[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
|[BlockedUrlExceptions](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurlexceptions) | List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. | ✔️ | | | |
|
||||
|[BlockedUrls](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-blockedurls) | List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. | ✔️ | | | |
|
||||
|[DefaultURL](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-defaulturl) | Configures the default URL kiosk browsers to navigate on launch and restart. | ✔️ | | | |
|
||||
|[EnableEndSessionButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enableendsessionbutton) | Enable/disable kiosk browser's end session button. | ✔️ | | | |
|
||||
|[EnableHomeButton](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablehomebutton) | Enable/disable kiosk browser's home button. | ✔️ | | | |
|
||||
|[EnableNavigationButtons](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | ✔️ | | | |
|
||||
|[RestartOnIdleTime](/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | ✔️ | | | |
|
||||
|
||||
To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer:
|
||||
|
||||
@ -339,252 +340,253 @@ To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in
|
||||
|
||||
## LocalPoliciesSecurityOptions
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | | |
|
||||
| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | | |
|
||||
| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [InteractiveLogon_DoNotDisplayLastSignedIn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) | Specify whether the Windows sign-in screen will show the username of the last person who signed in. | ✔️ | | | |
|
||||
| [Shutdown_AllowSystemtobeShutDownWithoutHavingToLogOn](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) | Specify whether a computer can be shut down without signing in. | ✔️ | | | |
|
||||
| [UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) | Configure how an elevation prompt should behave for standard users. | ✔️ | | | |
|
||||
|
||||
## Location
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [EnableLocation](/windows/client-management/mdm/policy-configuration-service-provider#location-enablelocation) | Do not use. | | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [EnableLocation](/windows/client-management/mdm/policy-configuration-service-provider#location-enablelocation) | Do not use. | | | | |
|
||||
|
||||
## Power
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | | |
|
||||
| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | | |
|
||||
| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | | |
|
||||
| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | | |
|
||||
| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | | |
|
||||
| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | | |
|
||||
| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | | |
|
||||
| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | | |
|
||||
| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | | |
|
||||
| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | | |
|
||||
| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | | |
|
||||
| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | | |
|
||||
| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | | |
|
||||
| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | | |
|
||||
| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | | |
|
||||
| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | | |
|
||||
| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | | |
|
||||
| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | | |
|
||||
| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | | |
|
||||
| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | | |
|
||||
| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | | |
|
||||
| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowStandbyStatesWhenSleepingOnBattery](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingonbattery) | Specify whether Windows can use standby states when putting the computer in a sleep state while on battery. | ✔️ | | | |
|
||||
| [AllowStandbyWhenSleepingPluggedIn](/windows/client-management/mdm/policy-csp-power#allowstandbystateswhensleepingpluggedin) | Specify whether Windows can use standby states when putting the computer in a sleep state while plugged in. | ✔️ | | | |
|
||||
| [DisplayOffTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#displayofftimeoutonbattery) | Specify the period of inactivity before Windows turns off the display while on battery. | ✔️ | | | |
|
||||
| [DisplayOffTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#displayofftimeoutpluggedin) | Specify the period of inactivity before Windows turns off the display while plugged in. | ✔️ | | | |
|
||||
| [EnergySaverBatteryThresholdOnBattery](/windows/client-management/mdm/policy-csp-power#energysaverbatterythresholdonbattery) | Specify the battery charge level at which Energy Saver is turned on while on battery. | ✔️ | | | |
|
||||
| [EnergySaverBatteryThresholdPluggedIn](/windows/client-management/mdm/policy-csp-power#EnergySaverBatteryThresholdPluggedIn) | Specify the battery charge level at which Energy Saver is turned on while plugged in. | ✔️ | | | |
|
||||
| [HibernateTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to hibernate while on battery. | ✔️ | | | |
|
||||
| [HibernateTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#hibernatetimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to hibernate while plugged in. | ✔️ | | | |
|
||||
| [RequirePasswordWhenComputerWakesOnBattery](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakesonbattery) | Specify whether the user is prompted for a password when the system resumes from sleep while on battery. | ✔️ | | | |
|
||||
| [RequirePasswordWhenComputerWakesPluggedIn](/windows/client-management/mdm/policy-csp-power#requirepasswordwhencomputerwakespluggedin) | Specify whether the user is prompted for a password when the system resumes from sleep while plugged in. | ✔️ | | | |
|
||||
| [SelectLidCloseActionBattery](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on battery. | ✔️ | | | |
|
||||
| [SelectLidCloseActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectlidcloseactionpluggedin) | Select the action to be taken when a user closes the lid on a mobile device while on plugged in. | ✔️ | | | |
|
||||
| [SelectPowerButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactiononbattery) | Select the action to be taken when the user presses the power button while on battery. | ✔️ | | | |
|
||||
| [SelectPowerButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectpowerbuttonactionpluggedin) | Select the action to be taken when the user presses the power button while on plugged in. | ✔️ | | | |
|
||||
| [SelectSleepButtonActionOnBattery](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactiononbattery) | Select the action to be taken when the user presses the sleep button while on battery. | ✔️ | | | |
|
||||
| [SelectSleepButtonActionPluggedIn](/windows/client-management/mdm/policy-csp-power#selectsleepbuttonactionpluggedin) | Select the action to be taken when the user presses the sleep button while plugged in. | ✔️ | | | |
|
||||
| [StandbyTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#StandbyTimeoutOnBattery) | Specify the period of inactivity before Windows transitions the system to sleep while on battery. | ✔️ | | | |
|
||||
| [StandbyTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#standbytimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep while plugged in. | ✔️ | | | |
|
||||
| [TurnOffHybridSleepOnBattery](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeponbattery) | Turn off hybrid sleep while on battery. | ✔️ | | | |
|
||||
| [TurnOffHybridSleepPluggedIn](/windows/client-management/mdm/policy-csp-power#turnoffhybridsleeppluggedin) | Turn off hybrid sleep while plugged in. | ✔️ | | | |
|
||||
| [UnattendedSleepTimeoutOnBattery](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutonbattery) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while on battery. | ✔️ | | | |
|
||||
| [UnattendedSleepTimeoutPluggedIn](/windows/client-management/mdm/policy-csp-power#unattendedsleeptimeoutpluggedin) | Specify the period of inactivity before Windows transitions the system to sleep automatically when a user is not present while plugged in. | ✔️ | | | |
|
||||
|
||||
## Privacy
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | ✔️ | | | |
|
||||
| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | ✔️ | | ✔️ | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoAcceptPairingAndPrivacyConsentPrompts](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowautoacceptpairingandprivacyconsentprompts) | Allow or disallow the automatic acceptance of the pairing and privacy user consent dialog boxes when launching apps. | | | | |
|
||||
| [AllowInputPersonalization](/windows/client-management/mdm/policy-configuration-service-provider#privacy-allowinputpersonalization) | Allow the use of cloud-based speech services for Cortana, dictation, or Store apps. | ✔️ | | ✔️ | |
|
||||
|
||||
|
||||
## Search
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | ✔️ | | | |
|
||||
[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | | |
|
||||
| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | ✔️ | | | |
|
||||
| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | ✔️ | | | |
|
||||
| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.</br></br>- **Off** setting disables Windows indexer</br>- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)</br>- **Enterprise** setting reduces potential network loads for enterprises</br>- **Standard** setting is appropriate for consuemrs | ✔️ | ✔️ | | | |
|
||||
| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | ✔️ | | | |
|
||||
| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | ✔️ | | | |
|
||||
| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | ✔️ | | | |
|
||||
| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | ✔️ | | | |
|
||||
| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | ✔️ | | | |
|
||||
| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | ✔️ | | | |
|
||||
| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
[AllowCloudSearch](/windows/client-management/mdm/policy-csp-search#search-allowcloudsearch) | Allow search and Cortana to search cloud sources like OneDrive and SharePoint. T | ✔️ | | | |
|
||||
[AllowCortanaInAAD](/windows/client-management/mdm/policy-csp-search#search-allowcortanainaad) | This specifies whether the Cortana consent page can appear in the Azure Active Directory (AAD) device out-of-box-experience (OOBE) flow. | ✔️ | | | |
|
||||
| [AllowIndexingEncryptedStoresOrItems](/windows/client-management/mdm/policy-configuration-service-provider#search-allowindexingencryptedstoresoritems) | Allow or disallow the indexing of items. | ✔️ | | | |
|
||||
| [AllowSearchToUseLocation](/windows/client-management/mdm/policy-configuration-service-provider#search-allowsearchtouselocation) | Specify whether search can use location information. | ✔️ | | ✔️ | |
|
||||
| [AllowUsingDiacritics](/windows/client-management/mdm/policy-configuration-service-provider#search-allowusingdiacritics) | Allow the use of diacritics. | ✔️ | | | |
|
||||
| [AllowWindowsIndexer](/windows/client-management/mdm/policy-csp-search#search-allowwindowsindexer) | The indexer provides fast file, email, and web history search for apps and system components including Cortana, Outlook, file explorer, and Edge. To do this, it requires access to the file system and app data stores such as Outlook OST files.</br></br>- **Off** setting disables Windows indexer</br>- **EnterpriseSecure** setting stops the indexer from indexing encrypted files or stores, and is recommended for enterprises using Windows Information Protection (WIP)</br>- **Enterprise** setting reduces potential network loads for enterprises</br>- **Standard** setting is appropriate for consumers | ✔️ | | | |
|
||||
| [AlwaysUseAutoLangDetection](/windows/client-management/mdm/policy-configuration-service-provider#search-alwaysuseautolangdetection) | Specify whether to always use automatic language detection when indexing content and properties. | ✔️ | | | |
|
||||
| [DoNotUseWebResults](/windows/client-management/mdm/policy-configuration-service-provider#search-donotusewebresults) | Specify whether to allow Search to perform queries on the web. | ✔️ | | | |
|
||||
| [DisableBackoff](/windows/client-management/mdm/policy-configuration-service-provider#search-disablebackoff) | If enabled, the search indexer backoff feature will be disabled. | ✔️ | | | |
|
||||
| [DisableRemovableDriveIndexing](/windows/client-management/mdm/policy-configuration-service-provider#search-disableremovabledriveindexing) | Configure whether locations on removable drives can be added to libraries. | ✔️ | | | |
|
||||
| [PreventIndexingLowDiskSpaceMB](/windows/client-management/mdm/policy-configuration-service-provider#search-preventindexinglowdiskspacemb) | Prevent indexing from continuing after less than the specified amount of hard drive space is left on the same drive as the index location. | ✔️ | | | |
|
||||
| [PreventRemoteQueries](/windows/client-management/mdm/policy-configuration-service-provider#search-preventremotequeries) | If enabled, clients will be unable to query this device's index remotely. | ✔️ | | | |
|
||||
| [SafeSearchPermissions](/windows/client-management/mdm/policy-configuration-service-provider#search-safesearchpermissions) | Specify the level of safe search (filtering adult content) required. | | | | |
|
||||
|
||||
|
||||
|
||||
## Security
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | ✔️ | | | |
|
||||
| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | ✔️ | | | |
|
||||
| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAddProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowaddprovisioningpackage) | Specify whether to allow installation of provisioning packages. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowManualRootCertificateInstallation](/windows/client-management/mdm/policy-configuration-service-provider#security-allowmanualrootcertificateinstallation) | Specify whether the user is allowed to manually install root and intermediate CA certificates. | | | | |
|
||||
| [AllowRemoveProvisioningPackage](/windows/client-management/mdm/policy-configuration-service-provider#security-allowremoveprovisioningpackage) | Specify whether removal of provisioning packages is allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AntiTheftMode](/windows/client-management/mdm/policy-configuration-service-provider#security-antitheftmode) | Allow or disallow Anti Theft Mode on the device. | | | | |
|
||||
| [RequireDeviceEncryption](/windows/client-management/mdm/policy-configuration-service-provider#security-requiredeviceencryption) | Specify whether encryption is required. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [RequireProvisioningPackageSignature](/windows/client-management/mdm/policy-configuration-service-provider#security-requireprovisioningpackagesignature) | Specify whether provisioning packages must have a certificate signed by a device-trusted authority. | ✔️ | ✔️ | | ✔️ |
|
||||
| [RequireRetrieveHealthCertificateOnBoot](/windows/client-management/mdm/policy-configuration-service-provider#security-requireretrievehealthcertificateonboot) | Specify whether to retrieve and post TCG Boot logs, and get or cache an encrypted or signed Health Attestation Report from the Microsoft Health Attestation Service when a device boots or reboots. | ✔️ | | | |
|
||||
|
||||
## Settings
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | ✔️ | | | |
|
||||
| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | ✔️ | | | |
|
||||
| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | ✔️ | | ✔️ | |
|
||||
| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | | |
|
||||
[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoPlay](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowautoplay) | Allow the user to change AutoPlay settings. | | | | |
|
||||
| [AllowDataSense](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowdatasense) | Allow the user to change Data Sense settings. | | | | |
|
||||
| [AllowVPN](/windows/client-management/mdm/policy-configuration-service-provider#settings-allowvpn) | Allow the user to change VPN settings. | | | ✔️ | |
|
||||
| [ConfigureTaskbarCalendar](/windows/client-management/mdm/policy-configuration-service-provider#settings-configuretaskbarcalendar) | Configure the default setting for showing additional calendars (besides the default calendar for the locale) in the taskbar clock and calendar flyout. | ✔️ | | | |
|
||||
[PageVisiblityList](/windows/client-management/mdm/policy-csp-settings#settings-pagevisibilitylist) | Allows IT admins to prevent specific pages in the System Settings app from being visible or accessible. Pages are identified by a shortened version of their already [published URIs](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference), which is the URI minus the "ms-settings:" prefix. For example, if the URI for a settings page is "ms-settings:foo", the page identifier used in the policy will be just "foo". Multiple page identifiers are separated by semicolons. | ✔️ | | | |
|
||||
|
||||
## Start
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloadds shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | | |
|
||||
| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | | |
|
||||
DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | | |
|
||||
| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | | |
|
||||
| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | | |
|
||||
| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | | |
|
||||
| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | | |
|
||||
| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | | |
|
||||
| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | | |
|
||||
| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | | |
|
||||
| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | | |
|
||||
| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | | |
|
||||
| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | | |
|
||||
| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | | |
|
||||
| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | | |
|
||||
| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | | |
|
||||
| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | | |
|
||||
| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | | |
|
||||
| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowPinnedFolderDocuments](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | Control the visibility of the Documents shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderDownloads](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | Control the visibility of the Downloads shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderFileExplorer](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | Control the visibility of the File Explorer shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderHomeGroup](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | Control the visibility of the Home Group shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderMusic](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | Control the visibility of the Music shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderNetwork](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | Control the visibility of the Network shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderPersonalFolder](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | Control the visibility of the Personal Folder shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderPictures](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | Control the visibility of the Pictures shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderSettings](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | Control the visibility of the Settings shortcut on the Start menu. | ✔️ | | | |
|
||||
| [AllowPinnedFolderVideos](/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) |Control the visibility of the Videos shortcut on the Start menu. | ✔️ | | | |
|
||||
| DisableContextMenus | Prevent context menus from being invoked in the Start menu. | ✔️ | | | |
|
||||
| [ForceStartSize](/windows/client-management/mdm/policy-configuration-service-provider#start-forcestartsize) | Force the size of the Start screen. | ✔️ | | | |
|
||||
| [HideAppList](/windows/client-management/mdm/policy-configuration-service-provider#start-hideapplist) | Collapse or remove the all apps list. | ✔️ | | | |
|
||||
| [HideChangeAccountSettings](/windows/client-management/mdm/policy-configuration-service-provider#start-hidechangeaccountsettings) | Hide **Change account settings** from appearing in the user tile. | ✔️ | | | |
|
||||
| [HideFrequentlyUsedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hidefrequentlyusedapps) | Hide **Most used** section of Start. | ✔️ | | | |
|
||||
| [HideHibernate](/windows/client-management/mdm/policy-configuration-service-provider#start-hidehibernate) | Prevent **Hibernate** option from appearing in the Power button. | ✔️ | | | |
|
||||
| [HideLock](/windows/client-management/mdm/policy-configuration-service-provider#start-hidelock) | Prevent **Lock** from appearing in the user tile. | ✔️ | | | |
|
||||
| HidePeopleBar | Remove the people icon from the taskbar, as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. | ✔️ | | | |
|
||||
| [HidePowerButton](/windows/client-management/mdm/policy-configuration-service-provider#start-hidepowerbutton) | Hide the **Power** button. | ✔️ | | | |
|
||||
| [HideRecentJumplists](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentjumplists) | Hide jumplists of recently opened items. | ✔️ | | | |
|
||||
| [HideRecentlyAddedApps](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderecentlyaddedapps) | Hide **Recently added** section of Start. | ✔️ | | | |
|
||||
| [HideRestart](/windows/client-management/mdm/policy-configuration-service-provider#start-hiderestart) | Prevent **Restart** and **Update and restart** from appearing in the Power button. | ✔️ | | | |
|
||||
| [HideShutDown](/windows/client-management/mdm/policy-configuration-service-provider#start-hideshutdown) | Prevent **Shut down** and **Update and shut down** from appearing in the Power button. | ✔️ | | | |
|
||||
| [HideSignOut](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesignout) | Prevent **Sign out** from appearing in the user tile. | ✔️ | | | |
|
||||
| [HideSleep](/windows/client-management/mdm/policy-configuration-service-provider#start-hidesleep) | Prevent **Sleep** from appearing in the Power button. | ✔️ | | | |
|
||||
| [HideSwitchAccount](/windows/client-management/mdm/policy-configuration-service-provider#start-hideswitchaccount) | Prevent **Switch account** from appearing in the user tile. | ✔️ | | | |
|
||||
| [HideUserTile](/windows/client-management/mdm/policy-configuration-service-provider#start-hideusertile) | Hide the user tile. | ✔️ | | | |
|
||||
| [ImportEdgeAssets](/windows/client-management/mdm/policy-configuration-service-provider#start-importedgeassets) | Import Edge assets for secondary tiles. For more information, see [Add image for secondary Microsoft Edge tiles](../start-secondary-tiles.md). | ✔️ | | | |
|
||||
| [NoPinningToTaskbar](/windows/client-management/mdm/policy-configuration-service-provider#start-nopinningtotaskbar) | Prevent users from pinning and unpinning apps on the taskbar. | ✔️ | | | |
|
||||
| [StartLayout](/windows/client-management/mdm/policy-configuration-service-provider#start-startlayout) | Apply a custom Start layout. For more information, see [Customize Windows 10 Start and taskbar with provisioning packages](../customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) | ✔️ | | | |
|
||||
|
||||
## System
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | ✔️ | | | |
|
||||
| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | ✔️ | | | |
|
||||
| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | ✔️ | | ✔️ | |
|
||||
| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | ✔️ | | | |
|
||||
ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | ✔️ | | | |
|
||||
ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | ✔️ | | | |
|
||||
| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
|
||||
| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | ✔️ | | | |
|
||||
| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | | |
|
||||
| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowBuildPreview](/windows/client-management/mdm/policy-configuration-service-provider#system-allowbuildpreview) | Specify whether users can access the Insider build controls in the **Advanced Options** for Windows Update. | ✔️ | | | |
|
||||
| [AllowEmbeddedMode](/windows/client-management/mdm/policy-configuration-service-provider#system-allowembeddedmode) | Specify whether to set general purpose device to be in embedded mode. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowExperimentation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowexperimentation) | Determine the level that Microsoft can experiment with the product to study user preferences or device behavior. | ✔️ | | | |
|
||||
| [AllowLocation](/windows/client-management/mdm/policy-configuration-service-provider#system-allowlocation) | Specify whether to allow app access to the Location service. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowStorageCard](/windows/client-management/mdm/policy-configuration-service-provider#system-allowstoragecard) | Specify whether the user is allowed to use the storage card for device storage. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowTelemetry](/windows/client-management/mdm/policy-configuration-service-provider#system-allowtelemetry) | Allow the device to send diagnostic and usage data. | ✔️ | | ✔️ | |
|
||||
| [AllowUserToResetPhone](/windows/client-management/mdm/policy-configuration-service-provider#system-allowusertoresetphone) | Allow the user to factory reset the phone. | ✔️ | | | |
|
||||
ConfigureTelemetryOptInChangeNotification | This policy setting determines whether a device shows notifications about telemetry levels to people on first sign-in or when changes occur in Settings. | ✔️ | | | |
|
||||
ConfigureTelemetryOptInSettingsUx | This policy setting determines whether people can change their own telemetry levels in Settings | ✔️ | | | |
|
||||
| DisableDeviceDelete | Specify whether the delete diagnostic data is enabled in the Diagnostic & Feedback Settings page. | ✔️ | | | |
|
||||
| DisableDataDiagnosticViewer | Configure whether users can enable and launch the Diagnostic Data Viewer from the Diagnostic & Feedback Settings page. | ✔️ | | | |
|
||||
| [DisableOneDriveFileSync](/windows/client-management/mdm/policy-configuration-service-provider#system-disableonedrivefilesync) | Prevent apps and features from working with files on OneDrive. | ✔️ | | | |
|
||||
| [LimitEnhancedDiagnosticDataWindowsAnalytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics) | This policy setting, in combination with the System/AllowTelemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must enable this policy setting, and set Allow Telemetry to level 2 (Enhanced). When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented in [Windows 10, version 1703 basic level Windows diagnostic events and fields](/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields). Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level diagnostic data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the System/AllowTelemetry policy. | ✔️ | | | |
|
||||
|
||||
|
||||
## TextInput
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | | |
|
||||
| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | | |
|
||||
| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | | |
|
||||
| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | | |
|
||||
| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | | |
|
||||
| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | | |
|
||||
| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | | |
|
||||
| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | | |
|
||||
| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | | |
|
||||
| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
||||
| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowIMELogging](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimelogging) | Allow the user to turn on and off the logging for incorrect conversion and saving auto-tuning result to a file and history-based predictive input. | ✔️ | | | |
|
||||
| [AllowIMENetworkAccess](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowimenetworkaccess) | Allow the user to turn on Open Extended Dictionary, Internet search integration, or cloud candidate features to provide input suggestions that do not exist in the device's local dictionary. | ✔️ | | | |
|
||||
| [AllowInputPanel](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowinputpanel) | Disable the touch/handwriting keyboard. | ✔️ | | | |
|
||||
| [AllowJapaneseIMESurrogatePairCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseimesurrogatepaircharacters) | Allow the Japanese IME surrogate pair characters. | ✔️ | | | |
|
||||
| [AllowJapaneseIVSCharacters](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseivscharacters) | Allow Japanese Ideographic Variation Sequence (IVS) characters. | ✔️ | | | |
|
||||
| [AllJapaneseNonPublishingStandardGlyph](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapanesenonpublishingstandardglyph) | All the Japanese non-publishing standard glyph. | ✔️ | | | |
|
||||
| [AllowJapaneseUserDictionary](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowjapaneseuserdictionary) | Allow the Japanese user dictionary. | ✔️ | | | |
|
||||
| [AllowKeyboardTextSuggestions](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowkeyboardtextsuggestions) | Specify whether text prediction is enabled or disabled for the on-screen keyboard, touch keyboard, and handwriting recognition tool. | ✔️ | | | |
|
||||
| [AllowLanguageFeaturesUninstall](/windows/client-management/mdm/policy-configuration-service-provider#textinput-allowlanguagefeaturesuninstall) | All language features to be uninstalled. | ✔️ | | | |
|
||||
| AllowUserInputsFromMiracastRecevier | Do not use. Instead, use [WirelessDisplay](#wirelessdisplay)/[AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
|
||||
| [ExcludeJapaneseIMEExceptISO208andEUDC](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptjis0208andeudc) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
|
||||
| [ExcludeJapaneseIMEExceptShiftJIS](/windows/client-management/mdm/policy-configuration-service-provider#textinput-excludejapaneseimeexceptshiftjis) | Allow users to restrict character code range of conversion by setting the character filter. | ✔️ | | | |
|
||||
|
||||
|
||||
## TimeLanguageSettings
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowSet24HourClock](/windows/client-management/mdm/policy-configuration-service-provider#timelanguagesettings-allowset24hourclock) | Configure the default clock setting to be the 24 hour format. | | | | |
|
||||
|
||||
|
||||
## Update
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------:|:---------------:|:-----------:|:--------:|:--------:|
|
||||
| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update rboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windws Update (WU) drivers during quality updates. | ✔️ | | ✔️ | | ✔️ |
|
||||
| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| PhoneUpdateRestrictions | Deprecated | | ✔️ | | | |
|
||||
| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
|---------|-------------|:--------------:|:-----------:|:--------:|:--------:|
|
||||
| [ActiveHoursEnd](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | | ✔️ |
|
||||
| [ActiveHoursMaxRange](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | ✔️ | ✔️ | | ✔️ |
|
||||
| [ActiveHoursStart](/windows/client-management/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowAutoUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork) | Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowMUUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AllowNonMicrosoftSignedUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AllowUpdateService](/windows/client-management/mdm/policy-configuration-service-provider#update-allowupdateservice) | Specify whether the device can use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [AutoRestartDeadlinePeriodInDays](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindays) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartDeadlinePeriodInDaysForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-autorestartdeadlineperiodindaysforfeatureupdates) | Specify number of days (between 2 and 30) after which a forced restart will occur outside of active hours when restart is pending. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartNotificationSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartnotificationschedule) | Specify the period for auto-restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||
| [AutoRestartRequiredNotificationDismissal](/windows/client-management/mdm/policy-configuration-service-provider#update-autorestartrequirednotificationdismissal) | Specify the method by which the auto-restart required notification is dismissed. | ✔️ | ✔️ | | ✔️ |
|
||||
| [BranchReadinessLevel](/windows/client-management/mdm/policy-configuration-service-provider#update-branchreadinesslevel) | Select which branch a device receives their updates from. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferfeatureupdatesperiodindays) | Defer Feature Updates for the specified number of days. | ✔️ | ✔️ | | ✔️ |
|
||||
| [DeferQualityUpdatesPeriodInDays](/windows/client-management/mdm/policy-configuration-service-provider#update-deferqualityupdatesperiodindays) | Defer Quality Updates for the specified number of days. | ✔️ | ✔️ | | ✔️ |
|
||||
| [DeferUpdatePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupdateperiod) | Specify update delays for up to 4 weeks. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DeferUpgradePeriod](/windows/client-management/mdm/policy-csp-update#update-deferupgradeperiod) | Specify upgrade delays for up to 8 months. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DetectionFrequency](/windows/client-management/mdm/policy-configuration-service-provider#update-detectionfrequency) | Specify the frequency to scan for updates, from every 1-22 hours. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [DisableDualScan](/windows/client-management/mdm/policy-csp-update#update-disabledualscan) | Do not allow update deferral policies to cause scans against Windows Update. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartDeadline](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadline) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartdeadlineforfeatureupdates) | Specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartSnoozeSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozeschedule) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartSnoozeScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestartsnoozescheduleforfeatureupdates) | Specify the number of days a user can snooze Engaged restart reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartTransitionSchedule](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionschedule) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | | ✔️ |
|
||||
| [EngagedRestartTransitionScheduleForFeatureUpdates](/windows/client-management/mdm/policy-configuration-service-provider#update-engagedrestarttransitionscheduleforfeatureupdates) | Specify the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. | ✔️ | ✔️ | | ✔️ |
|
||||
| [ExcludeWUDriversInQualityUpdate](/windows/client-management/mdm/policy-configuration-service-provider#update-excludewudriversinqualityupdate) | Exclude Windows Update (WU) drivers during quality updates. | ✔️ | ✔️ | | ✔️ |
|
||||
| [FillEmptyContentUrls](/windows/client-management/mdm/policy-configuration-service-provider#update-fillemptycontenturls) | Allow Windows Update Agent to determine the download URL when it is missing from the metadata. | ✔️ | ✔️ | | ✔️ |
|
||||
| ManagePreviewBuilds | Use to enable or disable preview builds. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| PhoneUpdateRestrictions | Deprecated | | ✔️ | | |
|
||||
| [RequireDeferUpgrade](/windows/client-management/mdm/policy-configuration-service-provider#update-requiredeferupgrade) | Configure device to receive updates from Current Branch for Business (CBB). | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallDay](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstallday) | Schedule the day for update installation. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) | To schedule update installation every week, set the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallFirstWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfirstweek) | To schedule update installation the first week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallFourthWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallfourthweek) | To schedule update installation the fourth week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallSecondWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallsecondweek) | To schedule update installation the second week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallThirdWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallthirdweek) | To schedule update installation the third week of the month, see the value as `1`. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduledInstallTime](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduledinstalltime) | Schedule the time for update installation. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-scheduleimminentrestartwarning) | Specify the period for auto-restart imminent warning notifications. | ✔️ | ✔️ | | ✔️ |
|
||||
| [ScheduleRestartWarning](/windows/client-management/mdm/policy-configuration-service-provider#update-schedulerestartwarning) | Specify the period for auto-restart warning reminder notifications. | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetAutoRestartNotificationDisable](/windows/client-management/mdm/policy-configuration-service-provider#update-setautorestartnotificationdisable) | Disable auto-restart notifications for update installations. | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetDisablePauseUXAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisablepauseuxaccess) | Disable access to scan Windows Update. | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetDisableUXWUAccess](/windows/client-management/mdm/policy-configuration-service-provider#update-setdisableuxwuaccess) | Disable the **Pause updates** feature. | ✔️ | ✔️ | | ✔️ |
|
||||
| [SetEDURestart](/windows/client-management/mdm/policy-configuration-service-provider#update-setedurestart) | Skip the check for battery level to ensure that the reboot will happen at ScheduledInstallTime. | ✔️ | ✔️ | | ✔️ |
|
||||
| UpdateNotificationLevel | Specify whether to enable or disable Windows Update notifications, including restart warnings. | ✔️ | ✔️ | | ✔️ |
|
||||
| [UpdateServiceUrl](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurl) | Configure the device to check for updates from a WSUS server instead of Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [UpdateServiceUrlAlternate](/windows/client-management/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | Specify an alternate intranet server to host updates from Microsoft Update. | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
## WiFi
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | ✔️ | | | |
|
||||
| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | ✔️ | | | |
|
||||
| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | ✔️ | | | |
|
||||
| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | ✔️ | | | |
|
||||
| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowAutoConnectToWiFiSenseHotspots](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowautoconnecttowifisensehotspots) | Allow the device to connect automatically to Wi-Fi hotspots. | ✔️ | | | |
|
||||
| [AllowInternetSharing](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowinternetsharing) | Allow Internet sharing. | ✔️ | | | |
|
||||
| [AllowManualWiFiConfiguration](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowmanualwificonfiguration) | Allow connecting to Wi-Fi outside of MDM server-installed networks. | | | | |
|
||||
| [AllowWiFi](/windows/client-management/mdm/policy-configuration-service-provider#wifi-allowwifi) | Allow Wi-Fi connections. | | | | |
|
||||
| [WLANScanMode](/windows/client-management/mdm/policy-configuration-service-provider#wifi-wlanscanmode) | Configure the WLAN scanning behavior and how aggressively devices should be actively scanning for Wi-Fi networks to get devices connected. | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## WindowsInkWorkspace
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | | |
|
||||
| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowSuggestedAppsInWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) | Show recommended app suggestions in the ink workspace. | ✔️ | | | |
|
||||
| [AllowWindowsInkWorkspace](/windows/client-management/mdm/policy-configuration-service-provider#windowsinkworkspace-allowwindowsinkworkspace) | Specify whether to allow the user to access the ink workspace. | ✔️ | | | |
|
||||
|
||||
|
||||
## WindowsLogon
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | | |
|
||||
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [HideFastUserSwitching](/windows/client-management/mdm/policy-configuration-service-provider#windowslogon-hidefastuserswitching) | Hide the **Switch account** button on the sign-in screen, Start, and the Task Manager. | ✔️ | | | |
|
||||
|
||||
## WirelessDisplay
|
||||
|
||||
| Setting | Description | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | ✔️ | | | |
|
||||
| Setting | Description | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | --- | :---: | :---: | :---: | :---: |
|
||||
| [AllowUserInputFromWirelessDisplayReceiver](/windows/client-management/mdm/policy-configuration-service-provider#wirelessdisplay-allowuserinputfromwirelessdisplayreceiver) | This policy controls whether or not the wireless display can send input (keyboard, mouse, pen, and touch, dependent upon display support) back to the source device. For example, a Surface Laptop is projecting wirelessly to a Surface Hub. If input from the wireless display receiver is allowed, users can draw with a pen on the Surface Hub. | ✔️ | | | |
|
||||
|
||||
@ -17,9 +17,9 @@ Use **Privacy** to configure settings for app activation with voice.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## LetAppsActivateWithVoice
|
||||
|
||||
|
||||
@ -19,9 +19,9 @@ Use ProvisioningCommands settings to install Windows desktop applications using
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
For instructions on adding apps to provisioning packages, see [Provision PCs with apps](../provisioning-packages/provision-pcs-with-apps.md).
|
||||
|
||||
|
||||
@ -20,9 +20,9 @@ Use SharedPC settings to optimize Windows 10 for shared use scenarios, such as t
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
## AccountManagement
|
||||
|
||||
|
||||
@ -19,9 +19,9 @@ Use SMISettings settings to customize the device with custom shell, suppress Win
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
## All settings in SMISettings
|
||||
|
||||
|
||||
@ -19,12 +19,12 @@ Use Start settings to apply a customized Start screen to devices.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| StartLayout | ✔️ | | | |
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The StartLayout setting is available in the advanced provisioning for Windows 10 desktop editions, but shouldn't be used. For desktop editions, use [Policies > StartLayout](wcd-policies.md#start).
|
||||
>The StartLayout setting is available in the advanced provisioning for Windows 10, but shouldn't be used. For Windows client, use [Policies > StartLayout](wcd-policies.md#start).
|
||||
|
||||
## StartLayout
|
||||
|
||||
|
||||
@ -19,8 +19,8 @@ Use StartupApp settings to configure the default app that will run on start for
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| Default | | | | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| Default | | | | ✔️ |
|
||||
|
||||
Enter the [Application User Model ID (AUMID)](/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the default app.
|
||||
@ -19,7 +19,7 @@ Documentation not available at this time.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | ✔️ |
|
||||
|
||||
|
||||
@ -22,6 +22,6 @@ Use **StorageD3InModernStandby** to enable or disable low-power state (D3) durin
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | | ✔️ |
|
||||
@ -24,9 +24,9 @@ Use SurfaceHubManagement settings to set the administrator group that will manag
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | ✔️ | | |
|
||||
|
||||
|
||||
## GroupName
|
||||
|
||||
@ -19,9 +19,9 @@ Use TabletMode to configure settings related to tablet mode.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | ✔️ | | |
|
||||
|
||||
## ConvertibleSlateModePromptPreference
|
||||
|
||||
|
||||
@ -19,9 +19,9 @@ Use TakeATest to configure the Take A Test app, a secure browser for test-taking
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | |
|
||||
|
||||
## AllowScreenMonitoring
|
||||
|
||||
|
||||
@ -17,9 +17,9 @@ Use **Time** to configure settings for time zone setup for Windows 10, version (
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [ProvisionSetTimeZone](#provisionsettimezone) | ✔️ | | | |
|
||||
|
||||
## ProvisionSetTimeZone
|
||||
|
||||
|
||||
@ -40,9 +40,9 @@ The overlay doesn't mirror the entire volume. It dynamically grows to keep track
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | ✔️ | | | ✔️ |
|
||||
|
||||
## FilterEnabled
|
||||
|
||||
|
||||
@ -22,13 +22,13 @@ Use UniversalAppInstall settings to install Windows apps from the Microsoft Stor
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [DeviceContextApp](#devicecontextapp) | ✔️ | | ✔️ | | |
|
||||
| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | | ✔️ | | |
|
||||
| [StoreInstall](#storeinstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [DeviceContextApp](#devicecontextapp) | ✔️ | ✔️ | | |
|
||||
| [DeviceContextAppLicense](#devicecontextapplicense) | ✔️ | ✔️ | | |
|
||||
| [StoreInstall](#storeinstall) | ✔️ | ✔️ | | ✔️ |
|
||||
| [UserContextApp](#usercontextapp) | ✔️ | ✔️ | | ✔️ |
|
||||
| [UserContextAppLicense](#usercontextapplicense) | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## DeviceContextApp
|
||||
|
||||
|
||||
@ -20,10 +20,10 @@ Use UniversalAppUninstall settings to uninstall or remove Windows apps.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | | |
|
||||
| [Uninstall](#uninstall) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [RemoveProvisionedApp](#removeprovisionedapp) | ✔️ | | | |
|
||||
| [Uninstall](#uninstall) | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## RemoveProvisionedApp
|
||||
|
||||
|
||||
@ -20,9 +20,9 @@ Allows an OEM to hide the USB option UI in Settings and all USB device errors.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | ✔️ | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [HideUsbErrorNotifyOptionUI](#hideusberrornotifyoptionui) | ✔️ | ✔️ | ✔️ | |
|
||||
|
||||
## HideUsbErrorNotifyOptionUI
|
||||
|
||||
|
||||
@ -20,10 +20,10 @@ Use WeakCharger settings to configure the charger notification UI.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | ✔️ | | |
|
||||
| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [HideWeakChargerNotifyOptionUI](#hideweakchargernotifyoptionui) | ✔️ | ✔️ | | |
|
||||
| [NotifyOnWeakCharger](#notifyonweakcharger) | ✔️ | ✔️ | | |
|
||||
|
||||
|
||||
## HideWeakChargerNotifyOptionUI
|
||||
|
||||
@ -19,9 +19,9 @@ Use WindowsHelloForBusiness settings to specify whether [FIDO2 security keys for
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting groups | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [SecurityKeys](#securitykeys) | ✔️ | | | | |
|
||||
| Setting groups | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [SecurityKeys](#securitykeys) | ✔️ | | | |
|
||||
|
||||
## SecurityKeys
|
||||
|
||||
|
||||
@ -20,9 +20,9 @@ Use WindowsTeamSettings settings to configure Surface Hub.
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | ✔️ | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | ✔️ | | |
|
||||
|
||||
## Connect
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ Do not use at this time. Instead, use [ConnectivityProfiles > WLAN](wcd-connecti
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | | |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| All settings | | | | |
|
||||
|
||||
|
||||
@ -20,9 +20,9 @@ Use Workplace settings to configure bulk user enrollment to a mobile device mana
|
||||
|
||||
## Applies to
|
||||
|
||||
| Setting | Desktop editions | Mobile editions | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: | :---: |
|
||||
| [Enrollments](#enrollments) | ✔️ | ✔️ | ✔️ | | ✔️ |
|
||||
| Setting | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [Enrollments](#enrollments) | ✔️ | ✔️ | | ✔️ |
|
||||
|
||||
## Enrollments
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ This section describes the settings that you can configure in [provisioning pack
|
||||
|
||||
## Edition that each group of settings applies to
|
||||
|
||||
| Setting group | Desktop editions | Surface Hub | HoloLens | IoT Core |
|
||||
| Setting group | Windows client | Surface Hub | HoloLens | IoT Core |
|
||||
| --- | :---: | :---: | :---: | :---: |
|
||||
| [AccountManagement](wcd-accountmanagement.md) | | | ✔️ | |
|
||||
| [Accounts](wcd-accounts.md) | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
|
||||
@ -15,32 +15,46 @@ metadata:
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/06/2021
|
||||
ms.technology: windows-sec
|
||||
ms.date: 11/10/2021
|
||||
ms.technology: mde
|
||||
|
||||
title: Advanced security auditing FAQ
|
||||
|
||||
|
||||
|
||||
This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
|
||||
summary: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies.
|
||||
|
||||
- [What is Windows security auditing and why might I want to use it?](#what-is-windows-security-auditing-and-why-might-i-want-to-use-it-)
|
||||
|
||||
- [What is the difference between audit policies located in Local Policies\\Audit Policy and audit policies located in Advanced Audit Policy Configuration?](#what-is-the-difference-between-audit-policies-located-in-local-policies--audit-policy-and-audit-policies-located-in-advanced-audit-policy-configuration-)
|
||||
|
||||
- [What is the interaction between basic audit policy settings and advanced audit policy settings?](#what-is-the-interaction-between-basic-audit-policy-settings-and-advanced-audit-policy-settings-)
|
||||
|
||||
- [How are audit settings merged by Group Policy?](#how-are-audit-settings-merged-by-group-policy-)
|
||||
|
||||
- [What is the difference between an object DACL and an object SACL?](#what-is-the-difference-between-an-object-dacl-and-an-object-sacl-)
|
||||
|
||||
- [Why are audit policies applied on a per-computer basis rather than per user?](#why-are-audit-policies-applied-on-a-per-computer-basis-rather-than-per-user-)
|
||||
|
||||
- [What are the differences in auditing functionality between versions of Windows?](#what-are-the-differences-in-auditing-functionality-between-versions-of-windows-)
|
||||
|
||||
- [Can I use advanced audit policy from a domain controller running Windows Server 2003 or Windows 2000 Server?](#can-i-use-advanced-audit-policies-from-a-domain-controller-running-windows-server-2003-or-windows-2000-server-)
|
||||
|
||||
- [What is the difference between success and failure events? Is something wrong if I get a failure audit?](#what-is-the-difference-between-success-and-failure-events--is-something-wrong-if-i-get-a-failure-audit-)
|
||||
|
||||
- [How can I set an audit policy that affects all objects on a computer?](#how-can-i-set-an-audit-policy-that-affects-all-objects-on-a-computer-)
|
||||
|
||||
- [How do I figure out why someone was able to access a resource?](#how-do-i-figure-out-why-someone-was-able-to-access-a-resource-)
|
||||
|
||||
- [How do I know when changes are made to access control settings, by whom, and what the changes were?](#how-do-i-know-when-changes-are-made-to-access-control-settings--by-whom--and-what-the-changes-were-)
|
||||
|
||||
- [How can I roll back security audit policies from the advanced audit policy to the basic audit policy?](#how-can-i-roll-back-security-audit-policies-from-the-advanced-audit-policy-to-the-basic-audit-policy-)
|
||||
|
||||
- [How can I monitor if changes are made to audit policy settings?](#how-can-i-monitor-if-changes-are-made-to-audit-policy-settings-)
|
||||
|
||||
- [How can I minimize the number of events that are generated?](#how-can-i-minimize-the-number-of-events-that-are-generated-)
|
||||
|
||||
- [What are the best tools to model and manage audit policy?](#what-are-the-best-tools-to-model-and-manage-audit-policies-)
|
||||
|
||||
- [Where can I find information about all the possible events that I might receive?](#where-can-i-find-information-about-all-the-possible-events-that-i-might-receive-)
|
||||
|
||||
- [Where can I find more detailed information?](#where-can-i-find-more-detailed-information-)
|
||||
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user